Normal
0
false
false
false
EN-US
JA
X-NONE
Normal
0
false
false
false
EN-US
JA
X-NONE
While IT and security professionals are trying to piece together information about how the recently reported U.S. data breaches happened and how many customers are impacted, one thing is very clear: today’s cyber-attacks are very sophisticated, well planned, and expertly executed. Many media outlets report that more breaches could be disclosed in the near future—with as many as 20 additional retail breaches yet to be publicly reported.
In one reported account, not only did the hackers steal recently collected data, it’s believed they may have also stolen data from purchases many years back. This highlights dangers of another aspect of online storage: analytics! Storage is cheaper than ever. It is easy for corporations to store data for long period of times for the purpose of analytics and to use this data for a variety of reasons. However, this increases the likelihood of larger and more costly breaches down the road.
Recent reports show that hackers targeted data of as many as 16 million people in Germany, while almost half of South Korea is angry and calling banks to cancel credit cards due to a massive data breach in the country.
What can we learn from these massive data breaches? Here are few things to consider.
- Hope Is Not A Strategy – While executives may always think it is someone else’s problem, the fact is data breaches are real and can cause a significant disruption to business. Just hoping your business won’t be the target of a cyber-attack is not a sound strategy. It’s necessary to both actively monitor as well as prepare a response scenario.
- Nobody is Immune – As the Verizon Data Breach Investigations Report (DBIR) shows, nobody was immune to cyber-attacks given the sophistication of malware. Data breaches are impacting companies of all sizes—small and large—and have spread to all industry sectors, not just retail.
- Active Monitoring – Security professionals agree: the right strategy for protection must include the assumption that your network is already breached and hackers are already inside. With that in mind, all companies need to actively monitor internal traffic to identify any and all questionable data patterns or other activities so they nay recognize a potential problem before it happens.
- Employee Security Awareness – Humans are still the weakest link in information security. Simple things like reporting anomalies or not clicking on questionable email links can go a long way in protecting data.
- Preparing for Data Breach – A company can’t begin to prepare for a data breach once is has already occurred. Companies need to put processes in place that will help mitigate damage once a cyber-attack is identified. This includes developing a crisis management plan, testing breach response situations and establishing relationships with local law enforcement agencies.
Damage to brand name is not a myth as shown by YouGov’s sentiment survey, and cost of break-ins can go into hundreds of millions of dollars. The bottom line: closing your eyes to the prevailing situation or pretending your organization is immune is not a strategy. In the New Year it is time to make a resolution to do better in security monitoring, incident/crises management, and awareness programs. On top of that, having a good cyber insurance policy will go a long way in the time of need.
Resources
"Researchers Report Exact Timeline of Massive Target Breach", Forbes, January 2014
"Surprise! Target Data Breach Could Include Your Information from Purchases Made a Decade Ago", Forbes, January 2014
"Angry South Koreans Flood Banks After Massive Data Leak", Security Week, January 2014
"Target Perception Falls after Data Breach", You Gove BrandIndex, December 2013
