Page 17 - Cyber Warnings

Can’t INFOSEC Actually Work to Thwart Threats and Protect

Information?

What are we doing to protect ourselves from people that want to steal our information? And if what
we are doing is working, then why are there so many breaches and loss of data (~900m records
stolen in the USA alone and those are only the published numbers – source:
www.privacyrights.org).

Not a day that goes by that you don’t hear another company was compromised and their
customers’ information was stolen. Some of the biggest in the past were Sony, Target, Anthem,
Home Depot, Lockheed Martin and every day more companies get added to the list. It is as normal
an occurrence as having a cup of coffee in the morning. What’s most interesting is that all of the
companies had passed some type of audit (ISO 27001, SSAE 16, SOX, NIST, FISMA, HIPAA, PCI-
DSS) to provide a supposedly high level of confidence that their information was safe. What
happened? If we passed all of the audits, then how did we get compromised?

Stealing PII is Like Taking Candy from a Baby

Compromising information today is not as difficult as you think. Attackers today are using very easy
techniques, they are focusing on the weakest part of any computer, the user. It’s funny to hear in
the news ‘it was a sophisticated attack’ yet when described, the attack methods usually end up
being a simple spear phishing attack with an attached Remote Access Trojan (RAT) or some other
form of malware designed to bypass today’s antivirus and firewalls. These types of tools are easily
purchased on the black market or even downloaded as freely available open source hacking
software for ‘educational purposes only.’

The investment in security tools is growing at a staggering pace, firewalls, Antivirus, Intrusion
Detections or Prevention systems (IDS/IPS), Network Access Control (NAC) and counting. Multiple
techniques are used to protect information; database encryption, encrypting hard drives, scan their
systems for vulnerabilities, patching solutions to close weaknesses, the list goes on and on and yet
data is stolen. What are we doing and what are we trying to protect?

Focus on the core: It’s all about the Data

Believe it or not, the sky will fall if we don’t take action. There are some things the security industry
is doing right but the focus needs to be more on the data. The weakest part of Data is the user who
creates and handles data.

17 Cyber Warnings E-Magazine – January 2016 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide