Think you know how to keep your information safe? Think again.
Sep 23 2011
Copy Machines, a Security Risk
Sep 12 2011
Mobile Malware
By Mandira Srivastava
Do you think it is safe to access sensitive data on mobile phone? Do you know that malware can steal valuable information from your phone? As smartphone sales are growing, the development of mobile malware, viruses that penetrate the security system of mobile devices, also increases.
Mobile malware has been around for many years, it has been a problem for computers for a long time and now because of the evolution of the smart phone it has started to hit mobile handsets. Because the smart phones are becoming increasingly more sophisticated and their operating systems are becoming more similar to a computer, it is now possible for them to be infected with malware and it is important for all business owners to be aware of this.
Just like computer malware, mobile malware is installed on your smartphone and will attempt to steal information and data stored on your phone. The information that can be stolen includes documents, passwords, email login details and even credit card details just like on a PC. Mobile malware has increased rapidly during the last year and there is more and more stealth malware appearing. Stealth malware is when the malware is running in the background on the phone without the user being aware of it.
With wireless payment systems and mobile shopping apps becoming more popular it is also possible that the malware will be able to intercept credit card details. Also, text messaging that is sometimes used to send banking codes could be used by the criminals to get sensitive information. If you are considering using a mobile payment system for your business, make sure it is tested and secure.
Malware has been found on all of the current phones and operating systems, including the iPhone and the Android phones.
One of the main ways that the malware can access your phone is through the Wi-Fi networks and Bluetooth. Because the smartphone can easily be connected to wireless networks this can make it easier to download the malware. You can avoid this happening to your phone by only using secure and trusted Wi-Fi networks and by only accepting Bluetooth connections from people whom you know and keeping the Bluetooth switched off when you aren’t using it.
Email has always been a popular target for the hackers and with text messaging being so popular, they have also used this to spread the malware as well as phishing scams to try to steal your identity. It is a good idea to apply the same precautions you use before opening a strange email before opening a suspicious text.
Mobile security is becoming more and more important especially for businesses and it is a good idea to implement some security measures in order to avoid the malware spreading. You can, for example, always use a password for your phone so no one else can use it if it is stolen and only download apps from official sites and not third parties.
Sep 05 2011
Risk Assessment Critical for the Security of Information Assets
Information Security Risk Management for ISO27001 / ISO27002
Today, there is hardly any organisation that doesn’t recognise the critical role that information technology plays in supporting its business objectives.
September 01, 2011 /24-7PressRelease/ — Today, there is hardly any organisation that doesn’t recognise the critical role that information technology plays in supporting its business objectives. As a result, IT security has come to the forefront and the ISO 27001 information security standard has been embraced by numerous organisations worldwide as a best practice approach for implementing Information Security Management System (ISMS).
Risk assessment plays an important role in managing ISO 27001 controls. This is the part with which many project managers struggle when implementing an ISMS. Information security management decisions are entirely driven by specific decisions made as an outcome of a risk assessment in relation to identified risks and specific information assets. Therefore it is imperative that a thorough risk assessment is being undertaken and no risk is left unexplored. Risk assessment enables expenditure on controls to be balanced against the business harm likely to result from security failures.
IT Governance Ltd, the global leader in information security products and services, has developed a risk assessment tool, vsRisk, that automates and accelerates the risk assessment process. It enables project managers to monitor the day-to-day execution and management of the controls as well as generating reports for audit purposes.
Uniquely, vsRisk (www.itgovernance.co.uk/products/744) can assess the confidentiality, integrity and availability for each of the business, legal and contractual aspects of information assets, as required by the ISO 27001 standard. The tool can serve as a day-to-day operational tool, showing at a glance where an organisation stands in its progress towards ISO 27001 compliance. A free trial version can be requested here www.itgovernance.co.uk/iso27001-risk-assessment.aspx
Alan Calder, CEO of IT Governance, comments, “vsRisk reduces the time and cost of undertaking an ISO 27001-compliant risk assessment. It simplifies each step of an ISO 27001 risk assessment, allowing compliance project managers to capture their information security policy and objectives, plus the scope of their information security management system, and undertake a rapid appraisal of all key areas, including groups, assets and owners. ”
vsRisk (www.itgovernance.co.uk/products/744) offers an in-built audit trail, comparative history, comprehensive reporting and gap analysis that radically reduces the manual record keeping traditionally associated with risk assessments. The tool minimises the need for specialist knowledge and significantly undercuts the cost of generalist risk management tools, thus, making ISO27001 compliance achievable for a far wider range of organisations and professionals.
As well as supporting ISO/IEC 27001:2005 and ISO/IEC 27002, vsRisk v1.5 complies with BS7799-3:2006, ISO/IEC 27005, NIST SP 800-30 and the UK’s Risk Assessment Standard.
vsRisk is produced by Vigilant Software, the specialist software subsidiary of IT Governance and can be purchased online from www.itgovernance.co.uk/products/744.
Sep 01 2011
Information Security eBooks Download
information security eBooks download sites
Strategic-Information-Security
The-New-School-of-Information-Security
Insider’s Guide to Security Clearances
Information Security Risk Analysis by Thomas R. Peltier
Information Security Risk Analysis, 2 Ed. by Thomas R. Peltier
Information Security Risk Analysis By Tom Peltier shows you how to use cost-effective risk analysis techniques to identify and quantify the threats–both accidental and purposeful–that your organization faces. The book steps you through the qualitative risk analysis process using techniques such as PARA (Practical Application of Risk Analysis) and FRAP (Facilitated Risk Analysis Process) to:
Evaluate tangible and intangible risks
Use the qualitative risk analysis process
Identify elements that make up a strong Business Impact Analysis
Conduct risk analysis with confidence
Aug 27 2011
12 Steps to IT Security
This video outlines 12 steps to take to protect your business from the threat of e-Crime.
Aug 20 2011
ISO27002 Implementation Intro.m4v
Making the Implementation of ISO27001 easier for you to do within your organisation. This video is your introduction.
Aug 19 2011
If you See Something Say Something – DHS
“Dept Of Homeland Security Attempt To Induce A Permanent State Of Fear & Paranoia!”
DHS encourages floks in public to spy on others for the sake of security?
http://www.youtube.com/watch?v=gjeMCCQlCPA
Aug 12 2011
The End of Online Privacy? Fight the Internet Snooping Bill!
The End of Online Privacy? Fight the Internet Snooping Bill! (Must watch/share)
HR1981 would force the company you pay for Internet access to store a year’s worth of personal data and hand it over at the request of law enforcement. For sake of protecting childern from Pornographers does not mean that you start collecting everybody data “just in case” they may commit crime in future.
The New York Post noted that if legislators were required to assign bills honest names, this one would read: Forcing Your Internet Provider to Spy On You Just in Case You’re a Criminal Act of 2011.
CLICK HERE TO EMAIL YOUR LAWMAKERS: http://act.demandprogress.org/letter/snooping_bill/
Aug 08 2011
How to decide between ISO 27001 Cert and ISO 27002 Compliance
It is one of an important decision for your organization when you have to decide between ISO 27001 certification and ISO 27002 compliance. When continuous compliance with the standards may save you money in short run but ISO 27001(ISMS) certification outweighs benefits in long run. ISO compliance is a commitment for an organization when it has to be audited (internal) on regular basis to show to your vendors and partners. At the same time ISO certification has to be audited by independent external auditors.
Things that may affect your decision:
a) What will be the cost of achieving ISO compliance? Pick a scope and perform a gap analysis based on ISO 27002 to see where the gaps are. Find out the cost of treating the gaps for your organization including the cost of consultant, cost of tool, and cost of project management. These processes may vary from organization to organization.
b) Does ISO certification will benefit the organization because its competitors already have done it? (How much business an organization may lose or perhaps prospective new customers.)
c) Achieving certification may save money, time and efforts in long run by aiding your organization in compliance effort (PCI, HIPAA, SOX, NIST, GLBA). (Hey auditor we are already certified in specific controls, How much of the spending can be safe on other audits.)
d) Do enough customers will demand/require the certification in order to do business with them? Not having ISO certification may be a business disabler and organization may lose important customers which will affect company’s bottom line.
Risks of being non-compliant:
• No assurance to customers regarding InfoSec controls
• May lose customers in the long run
• May affect future business
Benefits of certification:
• Business enabler
• Align with the business goals
• Everyone is responsible for InfoSec
• De-facto InfoSec standards
• ISO 9000, ISO 14000, ISO 20000 compatible
• Commonly accepted best practice
• Capable of external certification
Aug 08 2011
Advanced persistent threats force IT to rethink security priorities
By Ellen Messmer
Network World – The biggest business challenge today, in the minds of many information security officers, is the stealthy online infiltration by attackers to steal valuable proprietary information. The reality, they say, is that these so-called “advanced persistent threats” are so rampant and unrelenting they are forcing IT to rethink network security.
“Tackling advanced persistent threats means giving up the idea that it’s possible to protect everything. This is no longer realistic,” states the Security for Business Innovation Council, the group of 16 security leaders from companies that include eBay, Coca-Cola Company, SAP, FedEx Corp., Johnson & Johnson and Northrop Grumman. The council today published a report — “When Advanced Persistent Threats Go Mainstream” — outlining the problems and challenges facing large organizations.
These advanced persistent threat (APT) infiltrations can emanate from nation-states and their hired-hand attackers as well as industrial competitors, or organized crime and “hactivists” like Anonymous. The term APT is thought to have originated within the U.S. military, primarily the Air Force, which used the phrase as shorthand to describe cyberattacks that seemed to originate from somewhere in mainland China.
The overall sense, according to the report, is that an APT is a “cyberattack that is highly targeted, thoroughly researched, amply funded, and tailored to a particular organization — employing multiple vectors and using ‘low and slow’ techniques to evade detection.”
This stealthy attack infiltration to steal important data has become widespread, with several companies and government agencies disclosing they’ve been targets, including Google, EMC’s security division RSA, Epsilon, Citigroup, The Washington Post and the Department of Energy research labs Oak Ridge National Laboratory and Pacific Northwest National Lab.
Timothy McKnight, chief information security officer at Northrop Grumman, who is a member of Security for Business Innovation Council, recently discussed how the aerospace and defense firm virtually every day has to defend itself against what it believes are a dozen separate groups of attackers trying to get into its network to steal sensitive data.
In the council report the 16 information security officers are advising security teams to work closely with their business managers to identity the “crown jewels” of the organization and protect these “core assets,” while “also moving away from a perimeter-centric view.”
“Focusing on fortifying the perimeter is a losing battle,” their report bluntly states. “Today’s organizations are inherently porous. Change the perspective to protecting data throughout the lifecycle across the enterprise and the entire supply chain.” And the report adds: “The definition of successful defense has to change from ‘keeping attacks out’ to ‘sometimes attackers are going to get in; detect them as early as possible and minimize the damage.’ Assume that your organization might already be compromised and go from there.”
To read the remaining article Advanced persistent threats force IT to rethink security priorities
Jul 27 2011
Tim O’Reilly: The Future of Business Intelligence is Now
When Tim O’Reilley talks, it’s better for all to listen very very carefully! This man is absolute visionary! I still remember how shocked I was at first, when he answered that the next big innovation(or change) is the off-line shopping! He is so damn right…
Jul 24 2011
Security as a Service and Office as a Service
The Windows Intune cloud service helps you centrally manage and secure your PCs through a simple web-based console, whether your IT staff or end users are in the main office, at a branch office, or on the road.
Click the fig below to see a video of Windows Intune benefits:
Windows Intune simplifies and helps businesses manage and secure PCs using Windows cloud services and Windows 7—so your computers and users can operate at peak performance, from virtually anywhere
Take an advantage of this free trial for a month to see if Windows Intune align with your business requirements, help you comply with industry standards and regulations, and if it’s cost effective for your business. To do that you may have to fnd out the total cost of existing infrastructure and support and maintenance fee. Also a gap analysis based on standard or regulation which apply to your business will help to find out how this security as a service can assist you in your compliance effort. We do need to manage and protect our PCs from malwares and it’s cost of doing business these days. For cost analysis, you should keep in mind that implementation of a control (Intune) should not be greater than the cost of the impact of the risk should a malware exploit your network.
Intune manage updates
Centrally manage the deployment of Microsoft updates and service packs that you choose to all your PCs from the Windows Intune console.
Intune protect PCs from malware
Help safeguard your PCs from the latest threats with centralized endpoint protection built on the award-winning Microsoft Malware Protection Engine and using the same trusted technologies as Microsoft Forefront Endpoint Protection and Security Essentials
Leverage location agnostic Security as a Service to Defend your information assets
** Windows Intune™ – Trial **
Try Windows Intune™ for 30 days to see how businesses can simplify PC management and security by using Windows® cloud services.
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Every business has needs and yours is no different. Your people need to stay connected and you need to maintain essential security and control. So why not have both? Make productivity easier by giving everyone endless ways to work and collaborate from anywhere at any time and on any device. In the cloud you make the rules.
Leverage access to e-mail, documents, contacts and calendars on nearly any device
** Office 365™ – Trial **
Office 365 trial for professional and small businesses
Office 365 trial for Kiosk worker plan
Office 365 trial for Enterprise level plan
Microsoft Exchange Online Archiving provides an enterprise-class service to assist organizations with their archiving, compliance, regulatory and e-discovery challenges while simplifying their on-premises infrastructure, enabling cost savings and easing the burden on IT.
** Exchange Online Archiving™ – Trial **
Exchange online archiving trial
Related article:
City and County of San Francisco Adopts Microsoft Cloud Solution
Jul 21 2011
Information Security Breaches: Avoidance and Treatment based on ISO27001
Information Security Breaches: Avoidance and Treatment based on ISO27001
If you are running a business, you learn to expect the unexpected. Even if you have taken all the right precautions, your company might still find itself confronted with an information security breach. How would your business cope then?
There are lots of books that will tell you what to do to prevent an information security breach. This book is different. It tells you what you have to do if a security breach occurs.
Security breaches sometimes occur because computers containing sensitive information are not returned to their owners. NATO laptops have been spotted in flea markets, and US government computers were put up for sale on Ebay. Security breaches may also be the result of data theft. A bad apple in your company may be tempted to sell your confidential data to a rival firm.
If something happens, your company needs to be ready to take prompt and decisive action to resolve the issue. This book tells you the plans and procedures you need to put in place to tackle an information security breach should it occur. In particular, the book gives you clear guidance on how to treat an information security breach in accordance with ISO27001.
If a breach occurs, the evidence needs to be secured professionally. You need to know the rules on evidence gathering, and you need to be capable of isolating the suspect laptops right from the start. If you want your company to respond rapidly to an information security breach, you need to make sure that the responsibilities and roles in your company are clearly defined.
Benefits to business include:
Recover faster
An information security breach can have crippling consequences. However, with the right emergency measures in place, you will be able to recover quickly from the incident and resume normal operations.
Preserve customer confidence
An information security breach can result in loss of records and disruption to service. This can do serious damage to your relationship with your customers. It is vital for you to be prepared for an information security breach, so that if it ever happens you can preserve customer confidence.
Assist the investigation
Uncovering the root causes of an information security breach requires detective work. If an information security breach occurs, the investigators will need to be able to identify the problem. You can help them to do that by keeping proper records.
Catch the criminals
In the event of data theft, you will want to be in a position to act promptly and decisively. So you should set up an incident management system. This will mean that in the event of data theft, the police will have a greater chance of getting hold of the incriminating evidence they need to secure a conviction.
As Michael Krausz warns, “It is the prudence of management that decides on a company’s fate once a serious incident occurs, not only the size.”
What others are saying about this book …
‘…I recommend this pocket guide to anyone implementing ISO27001, and indeed to anyone who is concerned about the risks of security breaches, and who wants to know how best to prepare their organization for the unpleasant events that are bound to happen from time to time…’
Willi Kraml, Global Information Security Officer
‘…The author thankfully narrows down some important vocabulary to a practical usage in real life situations. The book gives what it advertises: a quick pocket guide to avoidance and treatment of security breaches with references to ISO27001…’
Sascha-A Beyer, Senior Manager
‘…Michael Krausz has created a valuable tool for both professional as well as less knowledgeable persons in respect to the ISO27001 Standard… Written in plain English, this handbook is easy to follow even by a novice in the Information Technology Field. Therefore “Information Secuirty Breaches” is a must within the ‘tool box’ of anyone who deals with IT issues on an every-day basis…’
Werner Preining, Interpool Security Ltd
‘Michael Krauz did a good job. His pocket guide is small enough to be read in only a few minutes, yet is packed full of valuable information presented in a structured way. The case studies especially help to understand the topic. As former CIO of a large company I can recommend it.’
Christian H Leeb, Holistic Business Development
About the author: Michael Krausz is an IT expert and experienced professional investigator. He has investigated over a hundred cases of information security breaches. Many of these cases have concerned forms of white-collar crime. Michael Krausz studied physics, computer science and law at the University of Technology in Vienna, and at Vienna and Webster universities. He has delivered over 5000 hours of professional and academic training and has provided services in eleven countries to date.
Don’t let your organisation fall victim to a security incident … download your copy today!
Information Security Breaches: Avoidance and Treatment based on ISO27001
Jul 20 2011
8 tactics for mobile data privacy and security
By Mary Mosquera
With the sweeping use of mobile devices by healthcare providers, physicians and hospitals need to embrace best practices for protecting sensitive patient data, privacy experts say. For example, encrypt sensitive data when it is necessary to store on wireless devices.
Sixty-four percent of physicians own a smartphone and one third of them have an iPad, with another 28 percent planning to buy one within six months, according to research cited by ID Experts, which offers data protection and response services, in a July 20 announcement
Many of the current 10,000 mobile healthcare applications were designed to enable their users to access to electronic health records (EHRs). At the same time, in the past two years, the Office of Civil Rights has reported that 116 data breaches of 500 records or more were the direct result of the loss or theft of a mobile device and led to the exposure of the personal health information of 1.9 million patients, which started many consumers questioning the security of EHR systems and the data they house.
The Office of Civil Rights oversees health information privacy in the Health and Human Services Department and publishes on its website incidents involving the sensitive information of at least 500 individuals.
To more effectively protect patient data, Rick Kam, president of ID Experts recommended the following practices:
1. Don’t store sensitive data on wireless devices. If required, encrypt data.
2. Enable password protection on wireless devices and configure the lock screen to come on after a short period of inactivity.
3. Turn on the “remote wipe” feature of wireless devices.
4. Enable Wi-Fi network security. Do not use wired equivalent privacy (WEP). Wi-Fi protected access (WPA-1) with strong passphrases offers better security. Use WPA-2 if possible.
5. Change the default service set identifier (SSID) and administrative passwords.
6. Don’t transmit your wireless router’s SSID.
7. Only allow devices to connect by specifying their hardware media access control (MAC) address.
8. Establish a wireless intrusion prevention system.
“Many Wi-Fi networks in hospitals and doctor’s offices are not secure,” Kam cautioned, “and coupled with the increased mobile device usage, patient data is at risk.”
Jul 15 2011
Court Ruling on “Due Diligence” Online Banking Security
The ruling in the Patco Construction vs. People’s United Bank case set precedence, because the judge basically ruled that the bank’s below par security was sufficient for small business — and Patco (small business) was held liable for paying for the fraud that was a result of an average bank security. To know more details of the case, Brian Krebs has written a great post on this case.
http://krebsonsecurity.com/2011/06/court-passwords-secret-questions-reasonable-ebanking-security/
Brian Krebs also wrote about another high profile case (emi v comerica) which was decided in the favor of small business (EMI)
http://krebsonsecurity.com/2011/06/court-favors-small-business-in-ebanking-fraud-case/
Baed on these two cases it is hard to know how the next online banking fraud case will be decided and on which precedence. I guess the courts are still trying to figure out how to decide these complex cases and where to set the due diligence bar for the banks.
Jul 14 2011
The TickITplus Kick Start Guide has Been Launched
Following the release late last month of the Base Process Library, the Kick Start Guide – the essential guide for all organisations pursuing TickITplus certification – has been launched
/EIN Presswire/ — Following the release late last month of the Base Process Library (http://www.itgovernance.co.uk/products/3460), the Kick Start Guide – the essential guide for all organisations pursuing TickITplus certification – has been launched. The guide can be purchased here www.itgovernance.co.uk/products/3469 in a PDF format or hard copy.
The guide will provide organisations that need to achieve compliance with the TickITplus scheme with information about identifying and selecting the scope of certification and developing in-house resources. It contains guidance on identifying processes, mapping them to TickITplus processes and establishing the assessment strategy. The TickITplus Kick Start Guide also offers advice on preparing for, participating in and following up an assessment.
TickITplus (www.tickitplus.org) is the successor of TickIT and provides improved process modelling to facilitate more efficient business and quality systems planning and improvement. TickITplus gives entry level access to capability grading for small IT organisations and offers significant cost savings for those already pursuing both ISO9001 and Capability Maturity Measurements.
As an introductory guide, the TickITplus Kick Start Guide concentrates specifically on achieving the Foundation level of the scheme, either through initial entry or transition from the existing TickIT scheme.
The Kick Start Guide can be purchased today from www.itgovernance.co.uk/products/3469
Jul 13 2011
Do US companies do enough for their cyber security?
IT Governance Ltd, the ISO27001 and information security experts have reported that they are making a number of free resources available for download from their US website to help US companies meet the challenges of increased cyber crime.
July 12, 2011 /24-7PressRelease/ — IT Governance Ltd, the ISO27001 and information security experts have reported that they are making a number of free resources available for download from their US website (www.itgovernanceusa.com) to help US companies meet the challenges of increased cyber crime. This week the company has published a white paper on cyber security which can be downloaded from here http://www.itgovernanceusa.com/cyber-security.aspx
Cyber security has become an issue for every nation in the world. In the US over the last 3 months there have been data breaches against high-profile organizations including Fox, Sony, Gmail, the IMF (International Monetary Fund) and major government departments. Two weeks ago, the Arizona State Police again became the victim of a cyber attack. The hack was announced on Twitter less than a week after a previous attack from Lulz Security.
US companies need to do their utmost in order to defend themselves form hackers and protect their information assets. At present, key changes in the US legislation are being discussed, and sooner or later, it is likely that strict data security measures will be imposed on organizations, which they will need to comply with. Organizations who do not act now may face serious fines in the future or even become the subject of a class action lawsuit, if the loss of customer’s data is established. Such was the case with Sony in April when a Canadian Play Station Network (PSN) user claimed damages in excess of $1 billion. This followed another lawsuit filed by an American PNS user. The consequences for companies compromising customers’ data can be severe, leading to both big financial implications and reputation damage.
IT Governance, which specializes in cyber security and compliance solutions, has published a white paper on their US website that provides information on some of the key developments US companies and their directors or IT managers need to be aware of in order to protect their business from cyber attacks. The white paper can be downloaded for free here: http://www.itgovernanceusa.com/cyber-security.aspx
Alan Calder, CEO of IT Governance, comments, “There are a few essential steps that organizations should be following if they are to implement an effective security strategy. Most organizations would only take certain measures if they are given the reasons why they should be doing this and know that their investment of time and money is worth. What is a more convincing reason than the data breaches we all witness? At IT Governance, we not only advise customers what should be done, but also provide guidance and solutions to their problems. We have the most comprehensive range of resources across a number of areas, from books and toolkits through to e-learning and software tools.”
US companies can be doing more than taking partial measures to fight cyber crime. Implementing best practice in information security management has become the most popular approach to tackling cyber security; demonstrating to both customers and business partners that an organization is working to the highest standard. Accredited certification to ISO27001 gives an organization internationally recognized and accepted proof that its system for managing information security – its ISMS or cyber security readiness – is of an acceptable, independently audited and verified standard. Everything US companies need to know about ISO27001 is explained on this website: http://www.27001.com
« Previous Page — Next Page »
