In a nutshell

Forget everything that you know about information security as what you are doing is not working, you need to completely change your mind-set. Data breaches were going to get worse, they going to cause more damage, and most of us simply are not aware of how little we are doing about it. “Data is the new oil,” “Because it’s just as valuable. The challenges in security we face are enormous,”

Why is data the new oil?

Because it can be monetized !!

A hacker can infiltrate data, extract it, refine it, redistribute it and use it for financial and/or political gain. Data integrity attacks have the power to bring down an entire company.
And the problem is only going to get worse as the Internet of Things (IoT) – the process whereby all products and processes are linked via the internet – proliferates.

“IoT is not your traditional tech,” “It has multiple personas: the manufacturer of the device, the consumer, the cloud provider, the 3rd parties, the APIs, there are five different environments, processes – thus many security risks and attack points for the bad guys While you may think that we are already in the age of data, we have barely crossed the start line. The explosion in data was yet to come, driven mostly by the Internet of Things.

“We create more sensitive data than you can imagine. Every time you click on your phone you’re creating data. “Since 2013, over 5 billion pieces of individual information have been compromised – but that’s only what has been reported. They occur on a daily basis and they are never published,” This mean more data for criminals to get their hands on. Passwords could easily be mined from the web, as could encryption keys as unless they are protected correctly, two of the major controls in use to prevent people accessing data. 15 years ago as an ethical hacker spending weeks to gain access to an organisation” (something at which, by the way, I was 100% successful at) “are gone,” “It now takes minutes, if not seconds.”

A simple google search allows you to gain full access to many business. However there is a solution, it lays in your own hands.

Situational Awareness

We all need to be a bit more like Jason Bourne.
Bourne, for the uninitiated, is the lead character in the eponymous series of films, who is forever eluding the authorities. He does this by always knowing and assessing what is going on around him – I call this “situational awareness”. We all need to be more like Bourne. The problem is that few understand the critical importance of knowing the impact of people, data and processes, and this was the weakness that cyber criminals were exploiting. There are those that were simply ignorant, who just weren’t looking or considering the impact of people, data and processes. And there are those that are arrogant and think they knew it all, thinking that massive investment in the latest security products will stop a breach. But it was that very arrogance that make them vulnerable. In both cases, there is a serious lack of situational awareness.

A new mindset

“These problems can all be solved overnight but we need to think differently, we have to know what the risks are that we are trying to mitigate. “We need a new mindset, we’re still in the world of breach prevention. You’re never going to prevent a breach, there are too many elements, data in too many places. “We need to change our attitude to one of breach acceptance. The key is knowing what it is that you are trying to protect. “Think like a bad guy – what do they want? They want data,” “Accept that breach is going to happen, but understand what types of data you have, where it is and what the processes are, and you’ll get a head start,” “It all comes back to the same thing; situational awareness.

“I see organisations around the world writing huge cheques for technology to solve the problem, but they don’t know what it is they are trying to protect. “Where is that data? What type of data is it? Personal? Credit card? Trade secrets? “You have to know where it is, what the process is, how people get to it. You have to understand what the risk is. Is it a confidentiality risk? Or an integrity risk? Depending on which, you can apply the appropriate action,”

“It’s really that simple. The world is all about data. Unless we face up to the problem and solve it, it’s only going to get worse.”

Do the basics

If you’ve been following the news recently, you’ll know that cybersecurity is becoming increasingly important. It’s crucial that company executives take the threat of a cyber-attack seriously, as a data breach has the potential to inflict long-lasting, perhaps irreversible, damage on an organization. Fortunately, as you’ll see in our brand new comic story, Gemalto’s Cyber Investigator Chronicles, enterprises can protect themselves if they take the threat seriously. To defeat your enemy, you must understand their motives and techniques.

Here’s a guide to the villains of our Cyber Investigators comic. While they may be fictional, there are many, many people exactly like them across the world, ready to attack your organization. That’s why you must be prepared.

And don’t worry, before you ask, there aren’t any spoilers.

The hacktivists

As you’ll find out in our comic, not all hackers are driven by money. Some seek to destabilize governments and organizations in pursuit of political ambitions. A recent example was the cyber-attack on the Democratic National Committee, which was probably politically motivated. Often these hackers seek to acquire emails or documents that could cause embarrassment for an organization or state institution. Alternatively, they might try to shut down a company’s networks, preventing the enterprise from functioning and inflicting long-term damage.

The mercenaries

A lot of hackers are just in it for the money. As our comic villain says, “we’re going to make a fortune”. Cyber-attackers who fall into this description use lots of devious techniques. Some use malware to exploit a vulnerability in security systems, accessing customer data, which they then sell on the dark web (if you’re unsure what we mean by ‘dark web’, check out our JustAskGemalto website). Others might block access to data on individual machines or servers, using malicious software called ransomware, and demand large sums of money to restore access. This type of attack has become increasingly common, affecting several hospitals in the United States.

The malicious insider

Sometimes hackers act in conjunction with a malicious insider at an organization or government body. These people can have different motivations – as we promised no spoilers, we won’t reveal anything here about our comic book villain’s intentions. These insiders might provide their username and password to a devious cyber-attacker, or deliberately leak confidential information to embarrass their employers, or give privileged access to an attacker through some other means.

There are other players in the cyber attacker landscape; anarchists after chaos and disorder, opportunists, egotists trying to demonstrate their cleverness and nation states or corporations engaging in (corporate) espionage.

As you can see, hackers can have a variety of motives, and can be extremely devious in achieving them. You may not think yourself a target, but if your customer is one, or you’re a supplier to another, you may fall into the crosshairs. By securing the breach, taking steps to deploy effective authentication, encryption and key management systems, it’s possible to reduce the impact of any cyber-attack.

To find out more about the different types of hackers – and, crucially, how to stop them – make sure you read our comic and follow the Cyber Investigators as they fight some dangerous enemies. Plus, you can join our CrowdChat, where I will be taking part in a discussion on issues raised in our story.

Data breaches aren’t going away, and the costs of a breach are becoming more tangible. By implementing a three-step approach, organizations can prepare for a data breach.

In my prior posts, I discussed both the changing face of data breaches and the reality distortion field surrounding today’s IT security professionals when they talk about effective ways to combat data breaches. Three things we know for certain, though, is that data breaches are not going away, our adversaries are continuing to innovate and attack, and the costs of a breach are becoming more tangible.

Just this month, Verizon claimed the massive hack on Yahoo caused irreparable harm to the tech company in terms of customer trust, possibly allowing the wireless provider to withdraw from or renegotiate the terms of its $4.83 billion acquisition agreement. Also, in October, the U.K. Information Commissioner’s Office hit TalkTalk with more than $400,000 in fines for its 2015 cyber attack.

Breaches are going to happen. Not only is there a need to move from a breach prevention to a breach acceptance mindset, but we need to invest security dollars into the technologies that help us prepare for these occurrences and protect our most sensitive information. To do this, each organization needs to address a number of key questions and issues, including the following:

1.  How do you define sensitive data?

More focus needs to be placed on understanding what constitutes sensitive data and setting parameters for defining it. For example, a company’s customer service and IT departments may have very different ideas on sensitive data. Every organization should have an enterprise-wide security policy that clearly lays out information classification guidelines (public, confidential, regulatory, etc.), what happens at each classification (public information can be shared by anyone, confidential information must be encrypted), as well as measures to ensure compliance with external regulations such as PCI-DSS and HIPAA, among others.

2. Who accesses your data?

Enterprise data lives in more places than ever before. Companies need to protect themselves not only from external threats, but the misuse of data and malicious attacks by insiders as well. After sensitive data has been defined, organizations need to regulate who has access to it and on which devices. Multi-factor authentication (MFA), also known as two-factor or strong authentication, can help by ensuring that users, no matter where they are, are whom they claim to be and are authorized to gain access. MFA also can enable role-based access, ensuring users have the appropriate level of entry for their position and function, and that the organization has a way to provision, manage and report on each group.

3.  Where is your data?

Whether it’s within physical networks, virtualized environments, the cloud or in motion, data is in more places than ever and enemies are not always obvious. In fact, a recent global study conducted by Gemalto and the Ponemon Institute found that half of all cloud services and data stored in the cloud are not controlled by the IT department.

• Companies need to first locate where sensitive data resides within their  organizations. Is it stored in databases, file servers, endpoint devices, storage networks? Is it located on premise, virtually or in the cloud? This is important to determine because encryption can be employed in multiple locations and cover both structured and unstructured data.

• Companies must understand what happens to data while it is being transmitted to another location. From the moment data is in transit, the company is no longer in control of it, and it can be easily and cheaply “tapped” by cyber-criminals for a variety of unauthorized reasons. In addition, human error and technical equipment failings are real risks that can manifest more often than you would think. However, these risks can be eliminated by automatically encrypting the data while it’s in motion.

4. How do you manage encryption and where are your keys?

Identifying and encrypting all of the sensitive data within an organization is just the first step to securing the breach. This requires encryption keys, and many times the management of these is imprudently overlooked. Without an enterprise-wide key manager, maintaining these disparate encryption systems becomes time consuming and unmanageable.

Since keys are being stored in a variety of places, often on the very systems containing sensitive data, they are vulnerable to theft and misuse. Backed up keys are also not being secured while in transit, leaving another area of exposure. Restricting access to these cryptographic keys is also a best practice. It’s also critical to ensure no single user has rights to everything.

3-step approach to data breach protection

By implementing a three-step approach—1) encrypting all sensitive data at rest and in motion, 2) securely managing and storing all keys, and 3) controlling access and authentication of users—organizations can effectively prepare for a data breach. This allows us to see through cybersecurity’s reality distortion field and transition from an approach optimized for “reality as it was”—breach prevention—to a strategy optimized for “reality as it is”—the secure breach strategy.

This post first appeared in Network World:

Link

“Since the internet was created, data has been at the heart of it. However, as our use of the internet and the value of this data has grown, so too has the risk of it being stolen or lost. In the last four years in the UK, over 74 million data records have been breached, with that number increasing every year. While businesses have focused on protecting their perimeters against data breaches, this has left data open and exposed. In the future, businesses won’t just have to protect against theft, but also manipulation of the data that is so valuable to them. As we celebrate Internet Day, we need to remember that GDPR is fast approaching and businesses operating with or within the EU, don’t have a lot of time to get their house in order before they have to announce any breaches that occur. The internet has created so many opportunities, but with it has also brought the potential for criminals to prosper. In order to stop this, we need to ensure that our focus is always on protecting the most valuable thing, data.”