http://www.networkworld.com/news/2006/12706-finsec.html By Ellen Messmer Network World 12/07/06 Some of the top players in the financial services arena-- such as Visa, JPMorgan Chase and Experian International -- are expanding their tactics for preventing customer data loss. IT security managers convening at two interrelated conferences in New York this week said their firms are adopting both new network defenses and organizational structures to lower risk of a data breach. Some say the very survival of their businesses may be at stake, since news reports about incidents are leading to customer loss and million-dollar lawsuits. California was the first state to require public disclosure of a data breach, and now there are now about 30 other states and localities that do as well. When an event becomes public, the stock price tilts, theres brand damage and finally decreased revenues, said James Christiansen, chief information security officer at Experian International, speaking at the Summit on Preventing Data Leakage. Experian, a global company with over $3.1 billion in annual sales from consumer credit reports and other business data and analytics, was able to cite its rival, ChoicePoint, as the industrys bad boy poster child at present. ChoicePoint last year acknowledged a loss of 145,000 customer records and is still fighting lawsuits about it. In the hope of avoiding a similar fate, Christiansen acknowledged Experian has racketed up its defenses in several ways. For one thing, We just wont accept data that isnt encrypted anymore, said Christiansen. In addition to encouraging employees to report any suspicious events, about eight months ago Experian also started using a data-leak prevention appliance to monitor employee e-mail, file transfer and instant messaging. "The first time you use it, its like turning on a light in a kitchen at night and catching the cockroaches running, said Christiansen. Experian doesnt block suspicious network behavior but does investigate data transfers that may violate corporate policy, such as failure to use encryption. Most of the time these incidents are mistakes by employees that require training re-enforcement. According to Christiansen, cybercrime that targets sensitive customer financial data is lucrative and well-organized, something that hit home by working with the U.S. Secret Service on whats called the Project Harvest research online with others in the industry. He said he sees that thieves around the world are selling software financial-theft Trojan programs for $1,000 to $5,000, a credit card with PIN for $500, and change of billing data for $80 to $300, and $7 to $25 depending on volume for stolen credit card numbers with security codes. It costs $7 for a PayPal account logon and password, he added. With the stakes ever higher, card-services giant Visa International has begun an ambitious retooling of its network authentication process to combine physical and logical security information to deter potential network misuse. The project involves combining information taken from Visas physical-security badge readers worn by employees and cross-checking real-time physical location with network authentication information to make sure theres an acceptable match. Were taking the next step, said Phil Maier, vice president of information security in the emerging technology and network group at Visa USAs technical arm, Inovant, who spoke at the FinSec conference. The badge ID has to have a link to the domain ID [on the computer]." If the physical and logical thresholds dont match up say, activity is occurring at a restricted computer when the badge reading shows the employee is not physically there, or an employee is viewed as physically present but an authentication process is occurring remotely the session should not be allowed since it raises security questions. To do this, Inovant is working on a home-grown coding project that has the companys badge-reader system linked into the corporation security information management system from Intellitactics. To have this and probably any security monitoring work correctly, its necessary to time-synchronize all computers precisely using the Network Time Protocol based on the government-supported Atomic Clock, Maier added. The various data-breach disclosure laws that now mandate the public be informed about incidents is driving change not just in technology implementation but in how organizations work to communicate between IT departments and upper management. Anish Bhimani, managing director at JPMorgan Chase, who spoke at FinSec, said the desire to avoid becoming another data-loss news story has prompted some changes, including adding laptop encryption and possibly adopting tapeless data centers for the long term. We used to think more backups is better but thats not exactly the case, said Bhimani. Another process change involves automated scanning for 40,000 servers for penetration testing instead of having people do it manually. A chief concern involves making sure JPMorgan Chases 3,500 third-party providers also follow specific security practices, noting its difficult to define everything that can go wrong. One of JPMorgans outside service providers, as Bhimani refers to them, recently misplaced some data that was recovered. We looked at everything except what went wrong, said Bhimani. One major cultural change at JPMorgan Chase, a huge firm with 170,000 employees, has been to focus on security metrics by focusing on the results, not activity, he noted. Instead of just issuing data-filled reports to management, the focus is being refined to target concrete results. Weekly meetings are now required where IT staff discuss risks, exposures and compliance with unit CIOs, and unit CIOs huddle together on their own and with CEOs more frequently. The goal is to figure out how do you actually improve the risk posture of the organization with the data you have, said Bhimani. JPMorgan Chase is also trying organizational change that involves assigning more security experts into the business divisions instead of technology units. The CISO role will now be the deputy risk manager, said Bhimani, adding the IT department will be split from risk management so we can focus on maturing the discipline of IT risk. The business needs to be able to take risks to make money, and our job is to help them find a way to do that, said Bhimani. Another change for JPMorgan Chase will be a zero-based budget where you start each year with no specifically allotted spending for security and go up. You start to think about doing things differently. All contents copyright 1995-2006 Network World, Inc. _____________________________ Subscribe to InfoSec News http://www.infosecnews.org/mailman/listinfo/isn
This archive was generated by hypermail 2.1.3 : Thu Dec 07 2006 - 22:32:57 PST