[ISN] Why Technology Isn't The Answer To Better Security

http://www.cio.com/article/451092/Why_Technology_Isn_t_The_Answer_To_Better_Security

By Kim S. Nash
CIO.com
October 15, 2008

Not to be alarmist, but WAKE UP, PEOPLE! Our information security is, in 
many ways, failing.

Ask the 11 alleged hackers charged in August with breaking into TJX and 
other retailers by way of insecure Wi-Fi. Forty million credit and debit 
card numbers were stolen. Ask the Medicaid claims processor at the 
outsourcer EDS. In February she pleaded guilty to stealing Social 
Security numbers and dates of birth, and selling them for use on fake 
tax returns. Ask the courier hired by the University of Utah Hospital to 
take backup tapes to offsite storage. One day in June, he used his own 
car instead of his company's secured van. The tapes, containing billing 
data for 2.2 million patients, were stolen from his front seat.

Or you could, as we did, ask 7,097 business and technology executives 
worldwide about their security troubles. In this, our sixth year of 
conducting the "Global State of Information Security" survey with 
PricewaterhouseCoopers, we got an earful about the challenges, worries 
and wins in security technology, process and personnel.

Quantifying returns on information security projects can be a struggle, 
often because it's hard to put a dollar value on a crisis averted. This 
year, a bad economy forces decision makers to squint even harder at 
proposals. Even so, survey results show companies are buying and 
applying technology tools, including software for intrusion detection, 
encryption and identity management, at record levels. That's pretty good 
news.

However—and this is serious, folks—too many organizations still lack 
coherent, enforced and forward-thinking security processes, our survey 
shows. While 59 percent of respondents said they have an "overall 
information security strategy," that's up just two points from last year 
and it's not enough, says Mark Lobel, advisory services principal at 
PricewaterhouseCoopers. Two elements, Lobel says, correlate with lower 
numbers of security incidents: having a C-level security executive and 
developing the aforementioned security strategy. But disappointing 
numbers piled up this year. (For additional stats see "The Global State 
of Information Security.")

For instance, 56 percent of respondents employ a security executive at 
the C level, down 4 percent from last year. You comb network logs for 
fishy activity, but just 43 percent of you audit or monitor user 
compliance with your security policies (if you have them). This is up 6 
percent from 2007, but still "not where we need to be," Lobel says.

As a result, security is still largely reactive, not proactive. 
More-sophisticated organizations will funnel data from network logs and 
other monitoring tools into business-intelligence systems to predict and 
stop security breaches. So along with encryption fanatics and identity 
management experts, an infosec team needs statisticians and risk 
analysts to stay ahead of trouble and keep the company name off police 
blotters.

[...]


__________________________________________________      
Register now for HITBSecConf2008 - Malaysia! With 
a new triple-track conference featuring 4 keynote 
speakers and over 35 international experts, this 
is the largest network security event in Asia and 
the Middle East! 
http://conference.hackinthebox.org/hitbsecconf2008kl/