Most Companies Admit Their Data Is At Risk 60
Weblver1 writes "A recent survey of IT professionals published by web security firm Finjan shows that data-theft should be a good reason for concern. Based on answers from 1,387 professionals, 25% acknowledged that their organization has been breached. What's worse, 42% did not know and could not exclude a breach, reflecting on the number of organizations that could potentially be breached without anyone knowing after the fact. Other findings we should be concerned about include 82% of Healthcare IT respondents admitting that medical records are at risk of data-theft, and 68% of all sectors admitting sensitive corporate information can be compromised by cyber-criminals. Finjan's report is available here (PDF, registration required). This survey comes a week after Forrester Research found in their survey that IT security spending is expected to rise (or at least remain the same) — with the current level of data breaches and sensitive data that is not protected well enough, there is a good reason for it.
surprised? (Score:5, Interesting)
I really don't think this will surprise anyone in the IT industry. It's not even really news. Most data remains secure/not-stolen simply by accident.
That is just how things are. To secure data, it will not be pretty, comfortable, or cheap. In the current economic environment nobody is all set to start spending with an increase in IT budge of 250% and so insecure it will remain.
Re:surprised? (Score:5, Interesting)
Bingo. When I was doing the SOX audits for my last Fortune 100 corporation I worked for. I highlighted all the problems and found solutions.
The CTO and all other executives said, The costs are too high to fix it, we'll just report we are out of compliance.. the Fines are cheaper.
I left that company 3 weeks later.
Re: (Score:1)
besides fines, they need pmita prison for executives making these decisions. they are not only putting their company at risk, they are putting their customers at risk as well.
Re: (Score:2)
Sarbanes-Oxley has nothing to do with customers.
Re:surprised? (Score:4, Informative)
Like everything else, it takes external pressures to get companies to spend where they haven't had to before.
In the case of retail stores, it's the Payment Card Industry's Data Security Standard (PCI DSS) that requires merchants to submit to security audits in order for them to continue accepting credit cards. In the case of pharmacies, it's the threat of HIPPA/Privacy suits that encourages them to protect their data. For publicly traded firms, it's the Sarbanes-Oxley Act (SOX). For banks, it's the Graham-Leach-Bliley Act (GLBA).
For industries that aren't feeling those pressures, sometimes breaches of security will motivate them. For the rest, nothing will likely happen until something else changes.
Re: (Score:3, Interesting)
I don't fully agree with this. Sometimes standards are just for making auditors money and managers and regulators feel good.
The large retailer I work for is technically not compliant with PCI-DSS standards.
The reality of our current credit processing solution is that it would have to be done at the acquirer/processor for a system-wide data breach, and to breach a single retail location, the credit card data would have to be captured on the fly across the internal, no-gateway, wired point-of-sale LAN.
It woul
Re: (Score:2)
Re: (Score:2)
I know all about tcpdump. I have a customized version of Ethereal that we use to decode the POS data stream.
It wouldn't be that hard to place a rogue piece of hardware in a single store - you'd probably just need to act like you were supposed to - but I repeat, there is NO centralized location aside from the A/P where every store's data stream can be seen.
And, as another poster commented, there are no network printers on our POS network. Parallel or serially attached to the registers.
And no wireless network
Would they even know? (Score:4, Insightful)
From TFA:
I'd be more interested in those who DID believe they could spot a cracker after the fact.
I'm not talking "what's this daemon running on my server" or "why are all these warez on my server".
I'm talking someone cracking your server and copying your data last year. Without installing anything that could be traced.
There are very few people who really know that their systems have not been cracked. And those people would be the ones who would be instantly aware if they were cracked tomorrow.
I'm fighting with our programmers right now about how they should put confidential information on our website. They want to link from the website in our DMZ to the database server behind our firewall. So anyone who can crack the webserver has a direct line to our database server.
But all of the other approaches are "too hard" or "too time consuming".
Re: (Score:2)
Exactly. Surely the choice is between "could not exclude the possibility of a breach" and "deluded about their own security"?
If someone outsmarted them to get access to the data, why do these other x% believe that they would somehow find out about it?
Re: (Score:2)
Most data remains secure/not-stolen simply by accident.
Actually, this is how most of my own security is done, e.g. figuring the odds. I lock my door at night, but is that going to stop someone determined to break in to my house? I play the odds that if criminals are randomly selecting houses to break in to that, just like the lottery, my number wont come up. It's not to say that more shouldn't be done, but like you said, it involves trade offs with other things that are also important (profits, ease, etc.)
Re: (Score:3, Interesting)
Not surprised at all (Score:2)
I use to be a programmer for a local state mental hospital. They had me make a report that would print each patient's name, physical description, SSN, DOB, and last known address.
I have no idea why they needed the report, but I SURE hope they did a fine job of shredding it when they were done with it.
So our data was as secure as an orderly could make a printed report secure.
An interesting note: Out of every 100 people, 58 knew if they've been breached or not, 25 knew they have been. That's just over 43%.
Could not exclude a breach (Score:2, Insightful)
Wouldn't a completely honest answer to this question be "yes" 100% of the time for even the best security.
I like that kind of paranoia in security people. I'm glad 42% answered yes and hope to get those numbers even higher in future.
Re: (Score:1)
I agree. I constantly worry about every avenue of data theft where I work. From external network breaches, to USB keys and laptops leaving the building with data on them. The problem is the avenue that you don't expect! That's the one that bites you in the ass in the end. Everyone at our company expects data loss to happen at some point. We lie awake at night worrying about it, and as a result the time, effort, and money is spent to protect the data the best we can.
Paranoia in IT is a good thing!
Wrong... (Score:1)
2. According the TFS, Most IT Professionals say their data is at risk, not most companies. That's not the safe as companies saying it.
If companies admitted th
Do you trust me? (Score:4, Insightful)
Do you trust the people you work with? Any individual in any business can access all sorts of material information.
Maybe it will be leaked to someone outside. Maybe it will be inadvertently passed in an email reply. Maybe someone will break in and steal an unguarded laptop.
There is no way to protect any data. The medical records everyone cries over is already shared with your doctors. Do you trust their secretaries? Do you trust the software makers and the maintenance/service engineers who come to diagnose software problems?
There is no privacy, and there is no secret information. There is only information which has not yet been leaked. And your only hope is that any information that is leaked is already moot by the time it becomes public.
Huge Bias in samplling method (Score:5, Informative)
-The anonymous survey was open to all respondents independent of geographical location, job title, company size or industry.
-The survey was web-based and aimed at respondents interested in or worried about web security threats in general and aimed at their organization. In other news, when we polled members before entering a porn site, 98% said they plan on taking measures to protect their web anonymity within the next hour. The other 2% have a very strange fetish.
Re: (Score:3, Funny)
unless a DRM that can't be broken is invented
I'm actually working on something like that now in my lab. I just want to finish my perpetual motion machine first, as it is a necessary component of my time-travel device.
Re: (Score:2)
unless a DRM that can't be broken is invented
I'm actually working on something like that now in my lab. I just want to finish my perpetual motion machine first, as it is a necessary component of my time-travel device.
Hmm. Yes. I think a time-travel device would actually make unbreakable DRM possible. It would only require exchange of information with the future -- essentially, the key to decode the DRM would be kept in the future, but the future would refuse to send a copy back if it detected that the co
Re: (Score:1)
unless a DRM that can't be broken is invented.
It already exists. It denies the "Digital Rights" referred to as "Read-Only" and "Read-Write". It's commonly referred to in the vernacular as "access denied". It requires the pre-condition of "no read access".
Haven't you ever seen that commercial where the girl keeps trying to pull down her picture off the bulletin board but a copy of it remains?
Well, there is another way of controlling information post-read-access, but it's considered illegal and unethical in most nations (timely murder and brain
Sample? (Score:2)
It'd say they sample is based on 42% of IT professionals and 58% of PR people.
Its them morons (Score:2)
as long as executives, officials, non i.t. people are TOO stupid as to use security systems, breaches will continue to be easy.
And 33% think they are immune? (Score:5, Insightful)
Personally I'd be more worried about the other 33% who seem to think they could not possibly have had their security breached.
This one's going +5 insightful (Score:1)
If people really understood about information security and countermeasures they'd probably close all their accounts, burn all their personal papers and do all their business under a randomly rotated set of deniable assumed names, in cash. That's pretty much how corporations and political figures do it -- they never do business in their own name without a layer of paper corporations or expendable underlings between themselves and an actual decision. In the current climate that's the only way to reliably bu
Well, duh. (Score:4, Insightful)
25% acknowledged that their organization has been breached. What's worse, 42% did not know and could not exclude a breach
No, that's not worse. That's _better_. Those 42% are being realistic. Realistically, unless you're one of a tiny percentage of people who either (a) receives so little traffic they can audit it all or (b) can be 100% certain of the security of all the software they're running, you should be in one of those two categories: breached, or don't know whether you've been breached but can't exclude it.
What's _actually_ worrying is that 33% of respondents think they are in one of these two categories, when in actual fact I'd suspect the figure is less than 1%.
(FTR: my company is in the 'breached' category. We had a worm infect one of our servers via a BIND bug back in 2000 or so, although the infection was apparently unsuccessful... it seemed to rely on there being a line feed on the end of the last line of /etc/inetd.conf, and our file didn't have one. I can't, obviously, rule out any breaches since then, but am reasonably confident there haven't been any.)
Why "Most" and not "All"? (Score:3, Interesting)
Depending how you look at the question, shouldn't those numbers be closer to 100%?
We're talking about IT people, here, a group whose job it is to believe in risk (whether that be from intruders or just hardware failure) and try to mitigate it. They also tend to think in absolutes, and are likely to interpret the question that way (i.e. view it as "no" risk instead of "low" risk). To believe that your data are absolutely safe and that it would be impossible for something bad to happen would seem to me like a sign of incompetence.
Moreover, if there were no perceived risk, many of them would have no jobs. So I'm surprised the number is not higher.
My guess is this survey tells us mostly about how people interpreted the question.
Re: (Score:2)
We're talking about IT people, here, a group whose job it is to believe in risk (whether that be from intruders or just hardware failure) and try to mitigate it.
You actually believe IT people believe in risk? You'll be surprised at the "who would hack us, we're too small" mentality that abounds. Unfortunately these are the same people who think just adding a firewall to a server will protect them from all the nasties. Ignore the fact it's swiss cheese to allow connectivity in and out as mandated by the clueless managerbot.
I think the number of IT n00bs who pass themselves off as experts who are capable of spotting a breach, let-alone protecting from it is 0%. T
the possible and the probable (Score:3, Insightful)
Until someone can quantify these risks, the whole survey is pointless. Although it does make a nice, juicy headline for the innumerate masses.
Re: (Score:1)
Silly Survey, Medical Data is pretty bad though (Score:3, Informative)
I will say that some medical records are probably the easiest things in the world to get a hold of. Small private practices generally don't have the knowledge or resource to properly secure their data. A lot of them leave patients in exam rooms alone with a computer, often connected to the internet, for extended periods of time. Not necessarily bad if decent security practices are in place but again, small practices generally don't have the knowledge to have them or just don't feel the need to enforce them.
I know a guy who did some IT work for several small practices and he still contends that MAC Authentication is about as good as security gets for wireless networks and his clients have all the faith in the world in his judgment. Until those networks get breached and someone leaves enough evidence behind to prove him wrong, its likely those networks will be open to the world.
Re: (Score:2)
But then again, who really cares about their medical records or any records for that matter.
1) People don't care. I work in a University related to a hospital. There have been breaches and people affected are invited to take up an offer of 1 year free privacy protection. How many do you think actually accept that offer? Minimal amount.
2) Yes, it would be easy to hack into such a systems (or any general medical facilities system) but what would be the benefit. The risk is too great and the rewards too little
Re: (Score:1)
1. A list of people, addresses, phone numbers, last exam dates, and current conditions would be extremely useful in some directed marketin
Are (Score:2)
Re: (Score:2)
Is.
"Data" is used in this context as a collective noun.
In related news, (Score:1, Offtopic)
No one can ever be sure (Score:2)
> What's worse, 42% did not know and could not exclude a breach, reflecting on the number
> of organizations that could potentially be breached without anyone knowing after the
> fact.
Perhaps that merely indicates that 42% know that it is impossible to exclude the possibility of an undetected breach with absolute certainty.
Tacit admission (Score:2)
It's a tacit admission that's one step away: We don't really care about it.
When it comes to customer data, though, it's nothing a few well-placed convictions for willful negligence won't solve.
The more worrying statistic... (Score:1)
Re: (Score:2)
Is anyone else concerned about the 18% of healthcare IT respondents who DON'T think that medical records are at risk? I mean seriously - that's nearly a fifth of the people questioned in charge of IT for the healthcare industry who think that their systems are actually invulnerable to attack. So far as I'm concerned, that kind of attitude is the biggest threat to IT security there is.
Based on my experience with medical institutions, it wouldn't surprise me to find that 18% of them were so conservative that
what is the definition of a "security breach" (Score:1)
Fixing it as we speak (Score:1)
As I sit here reading this, I am waiting on deployment scripts to finish running for our monthly production deployment. This month is "PCI Compliance" month - lots of security & permissions changes, auditing, etc. going into prod tonight. Should be done in about three hours... :-( ZZZZZzzzzzzzzzzzz...............
Off site backups (Score:1)
The reality of off site backups alone might make a lot of hosting/managed server customers cringe. How many companies go to the expense of security to deliver the off site backups to a safety deposit box in a bank or somewhere similarly secure? How many have the backups sitting for free in the trunk of an employee's car?
No kidding (Score:2)
It's a mess out there kids and not getting any better.
cjacobs001 (Score:1)