Cyber & Risk

Understanding cyber security has never been as critical as it is today.

The importance of having cyber security and risk mitigation strategies is now well-embedded in the corporate conscience, with more and more senior executives required to know their exact security posture and how to respond in the event of an incident.

In a complex world where new threat vectors appear almost daily, organisations must be ready. How well prepared are you?

IBRS can help organisations understand how resilient their systems are, develop incident response plans and get the right policies in place to ensure compliance with the most rigorous of security standards.

Conclusion: The field of biometrics still has many challenges to overcome and is still on a steep developmental curve. As biometric authentication technology improves over the coming years, there may be a role for it in encouraging users to take responsibility for their actions. The belief that their actions on corporate networks are physically linked to them through multiple factors of authentication will help extinguish the lack of accountability which continues to undermine many organisations. This linking of action to identity will help increase the risk of detection in the mind of individuals contemplating fraud – as they will struggle to argue that someone else used their biometric credentials (and password and token) without their knowledge and/or consent. But it must be understood by CIOs that the value from biometric authentication comes from the “security theatre” that it creates in the minds of users; as the technology itself currently offers questionable additional value to existing strong authentication systems.

Details: James Turner; 28 May 2008

Security Readiness

Conclusion: Biometric authentication can be an effective inclusion for organisations to reduce the risk of unauthorised access. However, as the general public becomes more informed on privacy issues, their tolerance for data breaches involving biometric data will plummet. Organisations that are named and shamed for failing to protect biometric data will suffer the consequences of excruciating scrutiny, as well as increased legislative and regulatory conditions. For the majority of Australasian organisations the cost and complexity of deploying biometric authentication correctly are prohibitive, and the costs of deploying it incorrectly are unacceptable.

Details: James Turner; 28 April 2008

Security Readiness

Conclusion: Analysing the challenges of portable electronic devices (PEDs) through the PED trilemma model breaks down the problem into three addressable aspects which can more easily be tackled, often by non-technical means. IT departments can manage the inundation of PEDs into corporate networks; but only with unambiguous commitment from senior business managers. IT can get commitment from these managers by using charge-back models.

If we put a dollar sign in the middle of the trilemma, we can show that expansion on any of the three sides results in a total increase in support costs (represented by the area in the middle). IT should use charge-back models for PED support to the business units. An appropriate charge-back mechanism forces business units to carefully consider their choices. The days of gluing up USB ports are long gone.

Details: James Turner; 28 March 2008

Security Policy and Frameworks

IGNORING the use of personally owned portable electronic devices in the corporate network is a trap IT departments must avoid, a study shows.

Users of personally owned PEDs are increasingly expecting full functionality and interaction with corporate resources, according to analyst IBRS.

A briefing paper, titled Portable electronic devices (PEDs): a frog close to the boil, warns that Apple's iPhone and Google's Android will exacerbate the situation in the short term. It says IT managers must focus their response to PEDs on the corporate network or face a gradual but substantial drain on IT resources.

Original article here...

Details: James Turner; 28 March 2008

Security Readiness

Conclusion: Personally owned Portable Electronic Devices (PEDs) are being introduced into the corporate network and users are increasingly expecting full functionality and interaction with corporate resources. Apple’s iPhone, and Google’s Android will exacerbate the situation in the short term. Looking at the problem using the perspective of the PED trilemma - ubiquity, multiformity and capability – presents an opportunity for IT departments to work on a strategy for control. Just like the fire triangle (heat, fuel, oxygen) if you can control one aspect, then the situation becomes manageable. IT managers must use the three aspects of the PED trilemma to focus their response to PEDs on the corporate network, or face a gradual though significant drain on IT resources

Details: James Turner; 28 February 2008

Security Readiness

At AusCERT 2007, a software programmer from Australia’s Defence Signals Directorate delivered a fascinating presentation on a simple strategy they had developed to help manage the influx of malware, browser exploits and malicious web content. The strategy was designed around risk transference through personal accountability, rather than threat mitigation^¹.

Details: James Turner; 28 January 2008

Security Readiness

Talk to an IBRS Advisor

Conclusion: Both black lists and white lists are effective security measures, but these two approaches are opposites and therefore, have different issues and applications. If only a few items need to be forbidden, then a black list is adequate. But if only a few items need to be permitted, then a white list is the efficient way to enforce policy.

When used in conjunction with business policy and procedures for acceptable content, white lists can be a very powerful mechanism creating a culture of individual responsibility that enables users to access necessary business information while holding individuals to account for the information they access.

Details: James Turner; 28 January 2008

Security Readiness

Conclusion: In 20-30 years time Generation Y will be running not only IT departments (in whatever form that takes) but they will also be running other business units, and in fact entire organisations. How we engage with them, train them, empower them, and become mentors to them; will sculpt their ability to make decisions. It is vital that the hard-earned knowledge of the last 50 years of IT is not lost from lack of mentoring and succession planning by the retiring Baby Boomers. This research note looks past the immediate skills shortage and into the area of lost industry knowledge.

Details: James Turner; 28 December 2007

Security Readiness

Conclusion: Data leakage prevention (DLP) it is an information management tool, not a threat mitigation tool like anti-virus or intrusion prevention. The DLP market is still very immature, and the products are not integrated with other related technologies, such as: enterprise content management (ECM), enterprise rights management (ERM), and identity management systems. When the vendors who specialise in information management have integrated DLP into their existing suites, then the story will be compelling. We’re not there yet.

Details: James Turner; 28 November 2007

Security Readiness

Conclusion: Rather than resist selective sourcing, IT organisations should accept that many IT tasks are either highly repetitive or commoditised; and are not unique to your organisation. These tasks do not need to be done in-house and by IT professionals whose value is high because they know how to deliver quality while respecting organisational idiosyncrasies. Managed Service Providers (MSPs) could be an excellent ally in augmenting internal IT resources. Once freed from the routine tasks, internal IT staff can be assigned to high value tasks or implementing innovative solutions: these help organisations to become better at what they do.

Details: James Turner; 28 October 2007

Security Readiness

Conclusion: Privacy is now a public issue. Consequently, many of the recommendations for the Australian Privacy Act will likely be accepted because they reflect good practice, and are in harmony with international data privacy trends. However, these amendments to the Privacy Act will introduce added complexity and expense to the management of personal data.

The danger right now is that organisations may try to dodge the cost of compliance by doing as little preparation as possible. Widespread, legally mandated, disclosures of data breaches would wreak havoc with consumer confidence in online transactions. Australian organisations, both large and small, cannot afford that loss of faith.

Details: James Turner; 28 September 2007

Security Readiness

Talk to an IBRS Advisor

Conclusion: The combination of new requirements for quality control in software development and the looming skills crisis in Asia will drive multiple initiatives in the software industry. These initiatives include: vendor consolidation (particularly in platforms); a fundamental shift in the role of internal IT organisations; and an explosion of innovative and pragmatic mini-applications that are developed and owned by the business unit rather than traditional IT departments. Because these mini-apps are driven and owned by the business unit, they are more aligned to business needs than the current wave of mismatched ‘collaborative Web 2.0’ applications.

Details: James Turner; 28 August 2007

Security Readiness

Conclusion: At the start of the year a resurgence of interest in Identity Management was heralded as one of a series of IBRS technology predictions for 2007. Subsequent vendor activity^¹ has borne this out and more market activity is likely to follow.

Details: Rob Mackinnon; 28 July 2007

Security Policy and Frameworks

Conclusion: The securing of online banking through one time passwords delivered via SMS: provides two factors of authentication, is cheaper to deploy than tokens, increases the customers’ sense of security, and introduces online banking customers to the idea of secure banking on their mobile phones.

However, introducing a widely adopted, variable-cost, service like one time password via SMS is not sustainable because it is inevitable that the cost of the SMS service will exceed the cost of online fraud, which is already at very low levels^¹. Until mobile banking and EMV smartcards become more commonplace, banks should choose the better strategy of using SMS authentication, as it supports the product roadmap for online and mobile banking.

Details: James Turner; 28 July 2007

Security Policy and Frameworks

Conclusion: Easy venture capital money and a highly fragmented market are driving consolidation in the Managed Service Provider (MSP) industry.

Whether your MSP is the target or the buyer, the M&A activity will be accompanied by organisational changes and strong pressure from the VCs to maximise returns. In the low margin MSP industry, this could have implications on the MSPs’ willingness to retain the resources which provide the resiliency that you need. In any outsourced relationship, it is advisable to clearly define the service being sourced, the service level expectations and to perform due diligence on the capabilities of the service provider that enable them to deliver this. In a consolidating market, IT organisations need to pay even greater attention to these activities.

Commoditising your infrastructure and technology achieves two important outcomes: standardised skills, which are easier to find; and easier transition to (and between) MSPs as they also have resource constraints.

Details: James Turner; 28 June 2007

Security Readiness

Conclusions: Microsoft’s new BitLocker feature, available in select versions of Vista, offers easy access to ‘whole disk’ encryption, which benefits several areas including; identity management, data security, and asset management.

While BitLocker is a workable and well-integrated security feature, it is not a complete solution to data protection requirements. Whole disk encryption products have limitations and must be viewed as a part of a wider security initiative.

BitLocker’s benefits and limitations must be evaluated and factored into Vista migration plans, especially for organisations looking towards virtualisation and mobility.

Details: James Turner; 28 May 2007

Security Readiness

Talk to an IBRS Advisor

Conclusion: Dedicated IT security people are too expensive for SMB organisations. The market trend is towards outsourcing security tasks, and the SMB market must embrace this. Large organisations (500+ people) should make internal security people the managers of internal security programs, and managers of the relationship with managed security service providers (MSSPs) and outsourcers. Security is an operational responsibility which should be shared by everybody in an organisation.

Details: James Turner; 28 April 2007

Security Readiness

Conclusion: Effective and responsible management of IT security should concern executives at the highest levels of management. Leading practice suggests, but does not mandate, separation of the IT security function from the IT management function. One of the ways that this can be achieved is with the appointment of a Chief Information Security Officer (CISO) with total accountability for all IT security matters within the organisation. A pro forma Position Description for the CISO role is provided herein.

Details: Rob Mackinnon; 28 January 2007

Conclusion: Last month I wrote advising IT practitioners to learn the language of risk management, particularly in the context of ANZ/NZS 4360:2004. The article also contained advice to ensure that IT has a place at the decision-making table when considering the implementation of corporate risk management software.

An assumption was made in the article that in your organisation some corporate risk management initiatives were already under consideration. However, suppose this is not the case. How can the IT practitioner pitch a case for an Enterprise Risk Management (ERM) project as a strategic system? This article provides a guide for doing so, allowing the IT practitioner to assert leadership in a burgeoning area of corporate practice.

Details: Rob Mackinnon; 28 March 2005

IS organisations attack increasing client systems support costs by implementing a desktop "lockdown" or Standard Operating Environment (SOE). However, if they do not give enough attention to the process and planning that is required to lock down their desktops their project will fail because of political and cultural problems, and because lockdown may prevent users from doing their jobs efficiently.

Details: Kevin McIsaac; 28 February 2005

Conclusion: In business and government, the subject of risk continues to be a hot topic. It’s covered regularly by the commerce and technology-oriented sections of the media and is increasingly being discussed and actioned at Board and executive levels. Because of the corporate appetite for risk methodologies and tools, a burgeoning IT industry has developed providing risk management software.

Details: Rob Mackinnon; 28 February 2005

Security Policy and Frameworks

Talk to an IBRS Advisor

Conclusion: Organisations that do not treat information security risks seriously could pay a heavy price if a major incident occurs and they are unprepared to deal with it.

Details: Alan Hansell; 28 July 2004

In April new Federal anti-spam legislation will ban local spammers from operating; otherwise they could face penalties of over a million Australian dollars a day. According to the Coalition Against Unsolicited Bulk E-mail, the purpose of putting this legislation in place is to stop spammers, and make Australia appear credible when looking to other countries to adopt the same type of law.

Details: Guy Cranswick; 29 March 2004

Security Policy and Frameworks

Changing business processes and systems to comply with legislative requirements is a major hidden cost in the public and private sector. Ironically, it is also one of the least referenced in the research literature.

Details: Nobody; 30 January 2004

SPAM is a terrible problem, from cutting productivity, threatening security, offending the morals of millions, planting doubt in the most macho man, and just irritating anyone with email. 2003 has seen many headlines about SPAM and how companies and governments are going to tackle it head on.

Details: Nobody; 31 December 2003

We touched briefly last month on our approach to security and its role in protecting the network from external attack. It is equally essential that clearly stated network policies and procedures, both for internal users and other external stakeholders on projects who require network access, be rigorously applied. Our policies are, visibly endorsed by the Chief Executive Officer and published on the company Intranet. They are designed to protect the enterprise by ensuring that the data on the network is appropriate to the business, network performance is not compromised in any way and the possibilities of virus infection are minimised.

Details: Brian Bowman; 28 March 2003

Talk to an IBRS Advisor

Page 7 of 7

Start
Prev
1
2
3
4
5
6
7
Next
End

info@ibrs.com.au

© IBRS. All Rights Reserved. 2021