2015 has played host to some significant cyber breaches. Experian, TalkTalk and Ashley Madison all fell foul of malicious attacks, and they weren’t the only ones. In 2016, businesses need to resolve to do better -- but the question is, how?
What bad security habits need to be given up to ensure a safer, more secure experience next year? What lengths could, and indeed should have businesses gone to this year in order to prevent some of the data breaches that occurred?
Industry experts elaborate on what they believe needs to be done better in 2016, and how to leave those bad habits behind.
Jeremiah Grossman, Founder of WhiteHat Security:
2016 is the year companies must resolve to get better at Web security. A lot better. Let’s look at just one of the past year’s major breaches -- TalkTalk. TalkTalk, a major UK telecoms operation, was arguably one of the most widely reported breaches of the year with reputable media reports suggesting the attack was carried out through SQL injection. SQLi gives a remote attacker the ability to run commands against the backend database, including potentially stealing all the data contained in it. This sounds bad because it is.
The more we learn about incidents like TalkTalk, the more we see that these breaches are preventable. We know how to write code that’s attack-resilient and we know multiple methods for fixing vulnerabilities and defending against incoming attacks. All it takes to stop these breaches from happening is doing the things we already know how to do. Doing the things we already know work. Let’s make 2016 the year we take web security seriously.
Perry Correll, Principal Technologist, Xirrus Networks:
Xirrus recently polled Wi-Fi users and found that 76 percent connect to Wi-Fi outside of their home. Public Wi-Fi offers the convenience of accessibility, but typically doesn’t encrypt data, which leaves passwords exposed and sensitive data vulnerable to the possibility of capture by those with malicious intentions.
It’s bad enough worrying that while sipping a latte, cyber criminals might be trying to steal your credit card data and bank account numbers, but even more daunting to know that corporate espionage is on the rise. Hotel Wi-Fi networks, which are notoriously easy to breach, offer hackers little challenge when it comes to intercepting private or classified information accessed by executives who stay in hotels on business. Now more than ever, large and small enterprises -- from coffee houses to airports and hotels -- must upgrade their networks to provide better security for their customers.
David Juitt, Chief Security Architect, Ipswitch:
Given we’re spending a whopping $70 billion on security per year, it’s not surprising it ranks high among IT concerns. The harsh reality is we are not doing a good enough job keeping pace with the adversaries. Despite the high levels of security investment, we can’t say with any degree of certainty whether we are safer than we were a year ago or five years ago.
Accepting some level of risk is part of doing business. Managing that risk in 2016 by recognizing and shoring up points of vulnerability is the difference between using data as a competitive advantage and being the victim of a catastrophic data loss.
Wieland Alge, VP & GM EMEA, Barracuda:
All IT Security experts should try to give up SEP -- the concept of Somebody Else’s Problem. As The Hitchhiker’s Guide to the Galaxy’s Ford Prefect described it: 'An SEP is something we can’t see, or don’t see, or our brain doesn’t let us see, because we think that it’s somebody else’s problem'.
SEP behavior exists right across the IT security community because we’ve often been treated as nerds, techies and obstacles to business.
If the Business IT team move some web applications into the Cloud without telling the IT Security team, then -- despite it being Business IT’s problem -- we know that the apps no longer have the protection of a proper Firewall/WAF and we should really help resolve it. Likewise, we can’t continue to say 'Cool, no attacks coming!' whenever the Internet goes down.
A good New Year’s Resolution would be to actively search for SEPs and fix them.
Mark Edge, UK Country Manager, Brainloop:
The General Data Protection Regulation (GDPR) arrives in 2017, so CISOs should spend this year resolving bad data protection practices.
The regulation will address the changing way businesses operate in the modern world, with a focus on protecting data stored and transferred in and out of Europe. It may be surprising to hear that malicious, or, more likely, careless employee behaviour is the number one threat to data security. Email, especially personal email, is simply not secure enough to communicate highly sensitive information, whilst consumer-grade file sharing solutions have little in-built security and no audit trail. USB drives, Instant Messaging and hard copies of confidential documentation also present a clear data protection problem.
CISOs must break bad habits with a positive change, so instead of placing cumbersome restrictions upon employees, they should implement intuitive and highly-secure collaboration tools that form positive habits and an easy transition ahead of the GDPR.
Thomas Fischer, Principal Threat Researcher, Digital Guardian:
Hundreds of thousands of customer details were leaked as a result of corporate data breaches in 2015. This data is most valuable to hackers before the leak is discovered and made public, as it then becomes much harder to sell off or act without attracting attention. However, even after the breach is discovered this information is still out there, still accessible, and is often used in a second wave of attacks targeting the victims themselves many months later.
Hackers will often bombard breached email addresses with phishing attacks in an attempt to gain access to more of their victims’ details. By impersonating banks, retail companies and government agencies the attacker will try to trick users into sending them money or personal information. These imitations are becoming more convincing, with hackers explaining to users that they are vulnerable to an attack and must change their details immediately by handing them over in some way.
Businesses shouldn’t be fooled twice, 2016 must be the year organizations combat phishing attacks. Educate your employees on social engineering, including how to identify suspicious messages and phishing sites, outline a clear policy on emails that seem out of place and ensure that everyone remains vigilant with regular security awareness training.
Chris Hurst, Director UK Sales, RedSocks:
There is no doubt that cyber security attacks will continue in terms of frequency and severity. Too many organizations rely on traditional security protection such as anti-virus, endpoint protection and firewalls, which is clearly not enough.
As cyber security threats become more sophisticated, measures to detect intrusions that we know will inevitably make their way onto a company’s network are as important as those designed to prevent them. 2016 should be the year in which companies resolve to monitor traffic as it leaves the network.
This will enable suspicious behaviors and destinations to be identified and will help ensure that any incidents can be assessed and remediated in as timely a manner as possible.
Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.
Photo Credit: Javier Brosch/Shutterstock
