Jaime Chanaga, CISSP, CISA

Cybersecurity: Three trends for 2009

I wrote this report and just published it on my consulting firm's website. This executive report examines three important trends of cybersecurity importance for business. We are facing difficult economic times. Organizations who proactively plan and manage cybersecurity risks will be better positioned to succeed in the global business environment.

To download this report go to:

http://www.csoboard.com/Publications

SC Magazine 2009 Awards - Winners

During the week that the RSA Conference is held in San Francisco, another event takes place that is always the highlight of the week.  That event is the SC Magazine Awards Gala industry awards.  This is one of those events I look forward to every year and I'm sure many IT security industry companies also look forward to having their solutions honored by an award.

The SC Magazine 2009 Awards Gala event was held last night at the Hilton Hotel were the best awards that I've attended in recent years.  Despite the economic news we hear every day, you could tell from observing the companies attending, nominated, and honored are growing and providing solutions that customers are demanding.  This leads me to believe that the IT industry in general has at least one very large bright spot and that is IT security.

I won't pontificate on the merits of IT security solutions or the value of purchasing those solutions.  I'll let you be the judge of those solutions.  Here is the link for a the list of winners of the SC Magazine Awards 2009 -- http://www.scmagazineus.com/pages/section/945/

Thanks to SC Magazine, the judges, nominees, winners, and most importantly thanks to the customers and clients we in the IT security industry serve.  You, our customers in many industries have allowed us the privilege and honor of serving you with IT security solutions that protect your organizations from risks both on-line and offline.  Thank you for aallowing us to serve you, our customers.

AT&T Wirless Network Outage - Dallas/Ft. Worth Area

Normally I don't complain about anything on-line.  However, today I will make an exception.  My AT&T Wireless cell phone service started to have issues this morning.  I have just spent the last 30 minutes on the phone with Customer Service, only to be told there is a potential network outage (voice/data) on the AT&T Wireless network in Texas, affecting the Dallas area.

The only information I have at this time are two technical support trouble ticket numbers TT000009764939 and TT000009768806.  As soon as I find out more information I will post it here.

I have been a loyal premier business customer of AT&T Wireless for a very long time and hope they can find a resolution to this network outage.  I have posted this on twitter under #ATTWireless if you would like to follow any further updates to my experience on this issue affecting users of AT&T Wireless services.

Information Security Challenges for 2009

As the new year begins, I'm hopeful that despite the negative forecasts for the U.S. economy, there will be areas of business and technology growth driven by increasing regulatory and compliance mandates for organizations across many industries. Organizations should begin to look at ways they can leverage and optimize their use of information security management programs and technologies to enhance the operational and financial efficiency of their information technology services portfolios. Regulatory compliance as a stand alone business function does not add value to the financial bottom line of any organization.

It is up to those responsible for information technology and security management to find ways to add operational and financial value to their organization. To my fellow information technology and security colleagues, I urge you to make 2009 a year in which you actively brainstorm and produce tangiable added value to your organization. Let's do our part to help the economy grow--every action of added value can help! One thing I'm confident about is the ingenuity and resourcefulness of information technology and security professionals.

If you have an idea on how information technology and security can bring added value in 2009 to any organization, please share it with me or the readers of this blog.

Best wishes for success in 2009!

Data Breaches Caused By Negligent Insiders 75%, External Hackers 1%

A study just released by Compuware, the 2008 Study on the Uncertainty of Data Breach Detection, shows that among surveyed companies the leading cause at 75% for data breaches is negligence on the part of company insiders.  Malicious intent by insiders only accounted for 26% of detected data breaches.  Not surprisingly 1% of all data breaches are attributed to external hackers.   Although 1% of data breaches being attributed to external hackers may be underreported as organizations are careful to avoid the perception of being vulnerable. 

For more information on the 2008 Study on the Uncertainty of Data Breach Detection, please visit Compuware at: www.compuware.com/databreach

Healthcare Industry and Business Leaders Advancing Health Information Security

The Health Information Trust Alliance or HITRUST (http://www.hitrustalliance.org) is an independent organization working with leaders and leading organizations in healthcare, business, technology and information security to help advance the quality improvement and cost effectiveness of the protection of electronic information within the healthcare system in the United States.

In working towards this goal, HITRUST is currently developing a Common Security Framework (CSF) Program to enable healthcare related organizations to gain better understanding and adoption of the various industry regulations and international standards for information security such as:  ISO 27001, ISO 27002, PCI DSS, CoBIT, HIPAA, and others.

"The HITRUST Common Security Framework Program, through the collaboration of HITRUST and organizations that represent the full spectrum of the healthcare, professional services, information technology, information systems and information security, is establishing the HITRUST Common Security Framework (CSF), a comprehensive, certifiable set of tools to aid organizations in protecting their information assets and managing related risks, costs and complexities." (http://www.hitrustalliance.org/programs/)

As a former CISO in the healthcare industry with an understanding of the challenges faced by healthcare organizations I welcome the efforts of HITRUST.

Thousands Of Credit And Debit Cards Compromised By Hackers At Dave & Buster's Inc. Restaurants

Three people have been indicted of hacking into cash register terminals at Dave & Buster's Inc. restaurants.  The U.S. Department of Justice has confirmed in a 27 page indictment against the three individuals who allegedly installed a "packet sniffer", software designed to intercept network communications between computers to capture credit card details while being transmitted from the cash registers to the credit card processors and banks.

With so much emphasis being placed on protecting credit card holder information, why don't companies invest in more stringent network access controls and data centric security measures?

Three accused of hacking Dave & Buster's computers
http://www.reuters.com/article/domesticNews/idUSN1230887420080512

International Hackers Indicted for Sniffing Credit Cards from Dave & Busters
http://blog.wired.com/27bstroke6/2008/05/international-h.html

Tenet Healthcare Corp (NYSE: THC) Identity Theft By Ex-Employee May Affect 40,000 Patients

Tenet Healthcare Corporation (NYSE: THC) has mailed letters to 40,000 patients at 54 hospitals nationwide that their personal information including social security numbers may have been stolen by an ex-employee, Terrance Brooks, at Tenet's billing center in Frisco, Texas. 

Terrance Brooks, convicted of this identity theft crime had access to Tenet's billing systems which stored patient's personal data including birth data and social security numbers.  According to some news reports, the Brooks was arrested on November 25 after attempting to open a credit card account at a Costco store.  In his possession were data records on 90 patients.  Tenet called those patients immediately and has taken the precautionary step of informing the 40,000 patients who's data could have been accessed by Brooks during his employment.

No company can prevent 100% of insider attacks on their information systems or data by employees.  However, companies can do more and increase their employee education, monitoring, and implement stronger policies and controls to ensure that these types of incidents are minimized.

South Florida Sun-Sentinel
http://www.sun-sentinel.com/news/local/palmbeach/sfl-flpfraud0214sbfeb14,0,42801.story

Darkreading
http://www.darkreading.com/document.asp?doc_id=146095

Google, Inc. (NASDAQ: GOOG) Launches E-mail Security Services For Business

Google, Inc. (NASDAQ: GOOG) announced (http://www.google.com/intl/en/press/pressrel/20080205_securityservices.html) several new security services for e-mail powered by Postini™. The new services provide inbound and outbound message filtering, encryption, and message archiving capabilities for business.

Services start at $3 per user per year.  Providing enterprise level security products at affordable prices for small businesses is a major benefit of these service offerings by Google. 

For more information see: http://www.google.com/a/security

ChoicePoint Inc. (NYSE: CPS) Pays $10M to Settle Data Breach Lawsuit

ChoicePoint Inc. (NYSE: CPS) is paying $10 million to settle a class-action lawsuit related to a data breach incident from 2005.   In the related data breach, the personal information of 160,000 consumers was put at risk. 

The $10 million payment if approved by the U.S. District Court in Georgia, would settle the lawsuit brought by shareholders against named defendants ChoicePoint and certain of its officers.  As part of the settlement, ChoicePoint will admit no liability in the data breach incident.

Score one for big business and shareholders.  However, consumers today still don't have comprehensive federal legislation to protect their data privacy allow impose stiff financial penalties on companies that put their personal information at risk.

Computerworld
http://computerworld.com/action/article.do?command=printArticleBasic&articleId=9059659