CLOUDTWEAKS CONTRIBUTOR PROGRAM

Join the CloudTweaks thought leadership contributor program which includes a customized profile, branded identity page, newsletter marketing, social amplification and more...

The program is currently available to consultants, influencers or executive level contributors.

Jennifer Marsh

The Business of Security: Avoiding Risks

The Business of Security

Security is one of those IT concerns that aren’t problematic until disaster strikes. It might be tomorrow, it could be next week or next year. The fact is that poor security leaves businesses wide open for data loss and theft. News outlets just skim the surface, but hackers cost business up to $575 billion each year. What’s concerning for CIOs is that risk assessment is placed solely on the IT department, even if the breach stems from BYOD and other personal systems.

Encryption Isn’t Enough

security

The traditional school of thought – especially with SMBs – is to encrypt data and use SSL or TLS on public systems. While this protects from eavesdroppers, it doesn’t protect from creative cyber threats that often phish for legitimate credentials from employees or contractors.

The latest big-time hacks circumvented encryption defense. The recent OPM hack that gave cyber criminals access to data covering millions of government employees and contractors wouldn’t have helped. Encryption protects data from being seen by unauthorized users and eavesdroppers, but OPM hackers had valid security credentials. They mimicked real login attempts, which circumvent basic encryption.

Even following common standards isn’t enough as Target discovered in 2013. Target lost 40 million credit card numbers to hackers who penetrated their point-of-sale (PoS) systems. You might think that Target oversaw some security standard, but the company was PCI compliant. PCI compliance is the de facto in credit card processing security, and Target’s security followed all the requirements. Regardless of its security implementation, hackers were still able to find a hole in the system.

Both OPM and Target have two things in common – the security hole was created by their own employees and vendors who gave up security credentials to phishing malware.

Assessing Risks Across Internal Systems

CIOs are tasked with providing employees with more mobility and freedom across the network while still creating a secure environment that’s hacker-proof. It’s not an easy task when you’re limited to what you can lock down.

Bring-your-own-device (BYOD) policies are a good start. Mobility is one of the fastest trending benefits for employees. BYOD lets them use personal laptops, smartphones and tablets for business. It’s become a part of corporate culture, and it offers more flexibility for employees to work at the office or at home. Before CIOs can implement a policy, they need to know the risks.

Mobility offers flexibility for employees and hackers. Mobile devices are even more vulnerable to viruses than desktops since most people have antivirus software on a desktop but not a mobile device. This leaves mobile devices wide open as a vector for trojan or virus injection onto the network.

Mobility isn’t the only risk. Telecommuting also gives employees the ability to work from home and saves in office resource costs. VPN connections allow employees to connect to the corporate network from any personal device. Just like BYOD security risks, these desktops could house malware that then transfers to the internal network.

VPN and BYOD are two hot topics in corporate security, but there are numerous others. Before CIOs can assure protection from cyber threats, they first must document each mode of network connection and assess risks associated with them. Even if the internal machine is completely anonymous to outside traffic using a firewall, it can still house vulnerabilities. It’s a team effort to assess risk, but it’s also a prudent part of IT asset management.

Creating Security Policies

risk-management

With both VPN and mobility risks assessed, CIOs can craft security policies that focus on flexibility for teleworking while still protecting internal resources. MDM tools track the number of mobile devices. IDS software identifies rogue, suspicious network traffic. IPS software tests servers and software for any common security flaws. Find the right tools on the market that make risk management more efficient.

CIOs and security experts are still new to mobility, so the commonality between most businesses is piecing together a policy that works for the business. It’s tempting to lock down systems and remove mobility altogether, but this type of policy isn’t feasible in today’s mobile market.

Quarantining mobile hotspots from critical systems is one way to manage risk. Users can share and store data on a segmented part of the network away from sensitive data, servers, and workstations.

Your policy should implement granular authentication and authorization that matches users with data they need to know. Classify information, so then security roles can be assigned to authorized employees. While this won’t guarantee protection, it will limit the amount of damage in case of a breach.

Training Staff

One of the most important parts of risk assessment and IT security is training staff. Protecting data should be a unified effort between all employees, vendors, contractors, and outside visitors.

Training is an ongoing effort from IT security staff that should integrate well into the on-boarding staff process. It’s not a process that’s limited to just employees. All executives, managers and employees should understand the risks and work to protect data from cyber threats.

In conclusion, reining in assets and risks and then applying the right security management is a huge effort for any CIO. Whether the business is small and growing or large and revenue-generating, a security policy should be a line of business that strategically defends against cyber threats and hackers.

By Jennifer Marsh

This post is brought to you by The CIO Agenda.

KPMG LLP is a Delaware limited liability partnership and is the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. The KPMG name, logo and “cutting through complexity” are registered trademarks or trademarks of KPMG International. The views and opinions expressed herein are those of the authors and do not necessarily represent the views and opinions of KPMG LLP.

Jennifer Marsh

Jennifer is a software developer and technical writer. She's written technical content for IBM, Rackspace, Adobe, and Udemy and continues to write articles that help people understand the life of a coder.

The Lighter Side Of The Cloud - Security Overkill
The Lighter Side Of The Cloud – Cloud Theory
Cloud Computing: Risks vs Benefits
5 Data Security Tips Small Businesses Should Mimic

5 Data Security Tips Small Businesses Should Mimic

Data Security Tips As more and more companies begin to switch to the cloud, cyber attacks need to be a ...
The New Kids On The Block: Data Protection Officers

The New Kids On The Block: Data Protection Officers

Data Protection Officers The General Data Protection Regulation (GDPR) is officially here. Yet, organizations are still unaware, are ignoring, or ...
3 Ways to Protect Users From Ransomware With the Cloud

3 Ways to Protect Users From Ransomware With the Cloud

Protect Users From Ransomware The threat of ransomware came into sharp focus over the course of 2016. Cybersecurity trackers have ...
Built to Last: Choosing the Right Infrastructure Partner for Your Game

Built to Last: Choosing the Right Infrastructure Partner for Your Game

Choosing the Right Infrastructure Partner There are millions of gamers around the globe, and according to gaming market research firm ...
Four Cloud Security Mega Trends

Four Cloud Security Mega Trends

Cloud Security Trends Last year was a big year for the cloud. Cloud adoption continued to grow at a rapid ...
Cloud Communications Security: Whose Business Is It, Anyway?

Cloud Communications Security: Whose Business Is It, Anyway?

Cloud Communications Security Don’t count on cloud providers to provide all your UCaaS security It’s official: Unified Communications-as-a-Service (UCaaS) has ...
Backups And Disaster Recovery Are Not The Same Thing

Backups And Disaster Recovery Are Not The Same Thing

Backups And Disaster Recovery Most business owners are aware of the consequences of losing data. Much of the value of ...
Machine Learning Open-Source Tools

Do More With Machine Learning Thanks to These 6 Open-Source Tools

Machine Learning Open-Source Tools We are in the middle of a machine learning, AI and big data renaissance — at least, that’s what we’re calling it. Seemingly everyone is interested in this technology these days, and for a good reason ...
The Developer’s Guide to Azure

The Developer’s Guide to Azure

Develop on a cloud platform designed for you. In this update of the Developer’s Guide to Azure, see how the comprehensive set of Azure app platform services fits your needs. Use it to navigate the architectural approaches and most common ...
Technology Certification Courses

Top Five Technology Certification Courses To Choose From In 2018

Technology Certification Courses Gartner predicts that the global public cloud services market is projected to grow by 55 percent in the next three years and is expected to reach $383.3 billion by the end of 2020. Today, cloud computing helps enterprises ...
Leading Programming Languages - TIOBE Index for July 2018

Leading Programming Languages – TIOBE Index for July 2018

Last month we announced that TypeScript entered the TIOBE index top 100 for the first time. TypeScript appears to keep growing in popularity. This month it entered the top 50. TypeScript is slowly becoming the new and improved JavaScript. One ...
12 Promising Business Intelligence (BI) Services For Your Company

12 Promising Business Intelligence (BI) Services For Your Company

Business Intelligence (BI) Services Business Intelligence (BI) services have recently seen an explosion of innovation and choices for business owners and entrepreneurs. So many choices, in fact, that many companies aren’t sure which business intelligence company to use. To help ...
[Free White Paper] Global Mid-Year Threat Landscape Report > Dive into the three major threats of mid-2018

[Free White Paper] Global Mid-Year Threat Landscape Report > Dive into the three major threats of mid-2018

[Free WhiThe use of unknown or unpatched software vulnerabilities in advanced attacks is key to threat actors, as it allows them to infiltrate organizations or distribute malware en masse to vulnerable systems. Download the free white paper now to learn ...