IT Security and compliance: twin challenges call for unified response

Today, business is digital. Data of all kinds is speeding across worldwide networks to and from data centers and cloud services, even as data quantities steadily increase, fueled by low-cost storage and a burgeoning array of Internet-of-Things (IoT) devices. But as digital business opportunities expand, companies face a number of daunting challenges. Foremost among them is the growing number of cyber attacks, as threat actors proliferate across a variety of attack vectors. In addition, the interdependence of business and data has spawned new regulatory guidelines that span industries and geographic regions. To survive and thrive, businesses must meet the twin challenges of IT security and compliance.

IT Security Challenges: Threat Actors

Today’s IT security threats come from a wide array of perpetrators who are responsible for ever-more dangerous attacks.
NATION-STATES: Perhaps the most capable and therefore the most difficult to defend against, nation-state-backed threat actors’ goals are espionage and disruption, supported by the resources and protection of a government. Compounding the challenge, rogue information brokers such as WikiLeaks have made toolkits developed by nation-states available to many others.

CYBERCRIMINALS: To achieve financial gain, cyber criminals’ traditional aim is to steal credit card numbers. Personal health information (PHI), is also a recurrent target, with the goal of perpetrating insurance fraud. However, the advent of ransomware, such as the huge WannaCry ransomware hit that happened all over the world in early May, has opened up a new front.

Phishing attacks and accompanying ransom demands have brought cyber criminals millions of dollars in ransom
payments. Many victims have decided it is faster and cheaper to pay the ransom rather than resist.
HACKTIVISTS: With the goal of disruption to write, or draw attention to a perceived source of social injustice, hacktivists, many under the Anonymous umbrella, launch denial-of-service attacks or steal and disclose information. While not as prevalent as in previous years, hacktivists remain a threat.
TERRORISTS: While generally lacking the sophistication of other threat actors, terrorists’ goals are to spread fear and encourage unrest. The risk is present and growing.
INSIDERS: Employees, contractors, and third parties with knowledge of a company’s data and systems wreak a considerable amount of havoc, driven by the motivations of revenge or greed.

Attack Vectors

Businesses are the targets of attacks from many directions, both traditional and new.
EMAIL: Phishing attacks through email continue to be highly effective. By using malicious attachments and URLs, actors trick victims into clicks that trigger compromise. These attacks are difficult to defend against because email is used for such a large amount of business purposes and the sheer quantity of phishing attempts leads to the likelihood of one of them succeeding through a negligent employee. In recent spear phishing attacks, actors have posed as corporate officials, requesting and obtaining the W-2 information of all employees, enabling tax refund fraud and identity theft.
WEB BROWSERS: Web browsers have been a prevalent interface for business users for over two decades. Browsers must be updated regularly in order to protect against the latest threats. Plugins also must be updated frequently with versions containing the latest security fixes. Out-of-date browsers and plug-ins are targets that never go out of style for attackers.

INTERNET OF THINGS: The IoT has attracted much attention because of its potentially game-changing benefits to businesses. But many organizations are leaping into IoT without taking into consideration risks from the software that runs the IoT devices. In many cases, that code, or significant components in the build is not written by the IoT vendor and may be of dubious quality. IoT devices are not always architected with security in mind and they may not be patchable and upgradable. The result is a proliferation of security vulnerabilities across a myriad of devices.

CLOUD AND MOBILE: Although their use is widespread, the fact that both may be chosen by end users without the involvement of IT introduces risk and limits an organization’s ability to manage that risk. For example, a user may employ his or her own BYOD smartphone and perform an unauthorized upload or download of files from a cloud-based collaboration service.

This behavior is hard for IT to prohibit, and could expose an organization to threats without IT being aware. In addition, smart phones, laptops, tablets, and USB devices all can store large amounts of data, which can fall into the wrong hands should a device be lost or stolen. Contents sponsored by Sponsor: QTS Data Centers. Contact Musato Technologies today to learn more about our ICT services.- IT Security and Compliance

Author: Gideon E. M

Gideon Ebonde M. is the CEO and Chief Software Architect at Musato Technologies. He is experienced Software developer with a demonstrated history of working in the information technology and services industry. He has a strong engineering professional skilled in Mobile Application Development, Enterprise Software, AI, Robotics, IoT, Servers, Cloud and business application. He is an accomplished DevOps software engineer and a visionary computer scientist and engineer.