Search

With the dynamic growth of the use of the Internet by enterprises, the number of computer threats and the level of the associated risks has increased rapidly. According to the Ponemon report, ‘The Impact of Cybercrime on Business’, every week there is an average of 66 successful cyber-attacks that cause business disruptions.1 Targeted attacks cost enterprises $214,000. The expenses are arise from forensic investigation, investments in technology and brand recovery costs. Comprehensive cost-benefit analysis plays a crucial role in the decision-making process when it comes to investments in information security solutions. The cost of breaches needs to be analysed in the context of spending on protection measures. However, no methods exist that facilitate the quick and rough prediction of true expenditures on security protection systems. Rafal Leszczyna of Gdansk University of Technology presents a novel method for evaluating the cost of computer security activities and tests it against a real-world example. [Copyright &y& Elsevier]

Although data classification is considered by many professionals to be the foundation of any information security activity, few organisations outside of defence and the security services have done much about it. The discipline is a crucial one, however – not least because, in an ideal world, it should drive the rules that determine what users are permitted to do, or not do, with corporate information. In fact, information security professionals are increasingly starting to view data classification as the core of all other information security activity. Cath Everett explores why it is so important, what benefits it offers and why, despite this, it has not been more widely adopted to date. She also puts forward suggestions for constructing a business case for data classification and looks at what steps organisations need to take to ensure that these complex change projects succeed. [ABSTRACT FROM AUTHOR]

These days, it is generally accepted that economic, regulatory and social pressures are coming together to drive growth in remote working in businesses of all sizes and in all sectors. At the same time, organisations have recognised a parallel increase in hacking attacks and other forms of unauthorised access relating to corporate networks. [Copyright &y& Elsevier]

It is often observed that addressing security can be as much about people as it is technology. One of the key aspects here is establishing the correct mindset, and ensuring that people are working for (or at least with) security rather than against it. Unfortunately, people are very often perceived as an obstacle rather than an asset in this regard. Indeed, to quote an Information Security magazine survey from a few years ago, one of the biggest hurdles for organisations to overcome in their attempts to address security is the problem of “unalert, uninterested, lax, ignorant, uncaring end users”. One of the most prevalent problems when protecting information assets is the apathetic attitude, and resulting actions and behaviour, of employees. Given that the corporate culture of an organisation shapes the beliefs and values of those within it, it becomes essential to address the mindsets of employees and ensure that relevant security knowledge and skills are communicated to them. However, organisations cannot assume a uniform starting point; employees will have varying degrees of compliance that may evolve to become more compliant or more disobedient depending on the guidance provided by management. This article examines the levels of security acceptance that can exist amongst employees within an organisation, and how these levels relate to three recognised levels of corporate culture. It then proceeds to identify several factors that could be relevant to the development of culture, from traditional awareness-raising techniques through to context-aware promotion of security. [Copyright &y& Elsevier]

The security industry generally places most emphasis on dealing with threats from external sources, that is, from outside the corporate network. Companies are encouraged to implement firewalls and perimeter defence tools to keep intruders out. Network administrators monitor traffic for abnormal events, raising the alarm as soon as a suspicious email attachment is spotted. So it is fair to say that there is a general assumption that security threats come from outside. [ABSTRACT FROM AUTHOR]

In October 2011, Jonathan Bamford, head of strategic liaison at the Information Commissioner''s Office, said: “I don''t believe that any of those people who are involved in those security blunders are ill informed in terms of the need to look after people''s information, or information that is entrusted to them.” [ABSTRACT FROM AUTHOR]

Email is a vital channel, indeed the preferred choice, of communications in companies today. Although more fanciful headlines would have us believe that email is on the verge of extinction, the reality is that email is embedded in company culture and will remain a core communications channel. In fact, studies suggest that over 80% of corporate information is now stored in emails, including attachments. Social networks and mobile devices have transformed the landscape of personal communication. Workers from Generation Gmail have grown up with this technology and now want to operate as flexibly at work as they do at home. To achieve this, employees mix and match technologies, putting corporate security under threat. Getting employees to care about the risks is only part of the solution – employers must take responsibility for closing this generation gap, argues Nathaniel Borenstein of Mimecast. [ABSTRACT FROM AUTHOR]

Information security is significantly down the list of investment priorities for small and medium enterprises (SMEs). However, the Information Commissioner in the UK said, in a recent address, that businesses of all sizes need to learn to respect data and deal with it in an appropriate way. Yet this requires an appreciation by SMEs of the risk and repercussions of data leakage – and in a way that is meaningful to them. How can this be approached? [ABSTRACT FROM AUTHOR]

When PFC Bradley Manning was arrested on suspicion of leaking highly sensitive documents, some were surprised at the information available to a low-level analyst. However, his opportunity came about because he was authorised to use the intranet known as Secret Internet Protocol Router Network, or SIPRNet, which gave him access to huge amounts of data. [Copyright &y& Elsevier]

Businesses, especially in the enterprise realm, suffer data losses, mainly from laptops which are often out and about on trips of varying duration. This represents a serious problem that not only may have repercussions on a company''s reputation, but also in terms of legal compliance. [Copyright &y& Elsevier]

In the last couple of years I have been pleased, as has my financial director, by the growing investment in programmes designed to bring information security out of the IT department and onto the desks of every member of the organisational team. [Copyright &y& Elsevier]

Companies are getting more competent at involving business executives in their security practice, but security is now underfunded. That''s just one finding of Deloitte''s annual security report. It also found that firms were more concerned about internal breaches than external ones, and that they needed to get a firm handle on security audits. [Copyright &y& Elsevier]

Security — It’s the bugbear of every company because so many threats to business integrity exist. Most organizations focus on external threats to their operations, spending time — and extensive budgets — building firewalls, fighting viruses, etc, owing to widely held beliefs that the external threats are rife. [ABSTRACT FROM AUTHOR]

Security firm McAfee claims to have uncovered a major cyber-espionage operation targeting many countries and a broad range of commercial and government targets. As many as 70 organisations have come under sustained assault over five years at the hands of a single attacker, says the firm. [ABSTRACT FROM AUTHOR]

It has become almost impossible to keep track of just how many times Sony has been hacked in the past couple of months. And it seems that many of the compromises of the firm''s servers involve the same weaknesses that the organisation seems unable or unwilling to fix. [Copyright &y& Elsevier]

A group of researchers is studying how people understand and react to online privacy issues. The team hopes that the £2 million project will provide new insights into how organisations can disclose online privacy policies and practices. [Copyright &y& Elsevier]