Identity theft a growing concern
"The days when hackers would find back doors into corporate networks and Web sites merely to deface them, or to introduce a virus in order to gain status among peers are long past. Today, cyber intruders and confidence tricksters approach their victims – which may be large enterprises or individuals — with criminal intent," says Fred Mitchell, security division manager at distributor Drive Control Corporation (DCC).
Identity theft is the first step to the creation of ‘bot networks’ from which denial of service attacks can be launched, for example. There are also cases where online businesses have been held to ransom by individuals that have gained illegal access to a network’s core and threaten to shut them down.
More commonly, however, stolen identities are being used to fraudulently open accounts, conduct business and access confidential business data with the intent of monetary gain or to obtain competitive advantage.
"Regardless of how good your security is, if you do not know who is on your network your organisational data, reputation and competitiveness may be compromised," says Mitchell. "Where previously companies could ensure the identity of staff through their physical presence on their business premises, users can now simply activate a wireless or Bluetooth device to gain access to a corporate network."
While larger companies have broad security policies in place, ignorance is still a large factor among users. Smaller companies, for example, may install a wireless network because it is easier and a less costly investment, yet through a lack of technical knowledge they may fail to ensure their network is secure.
"Many smaller companies think that they are safe because their data is relatively inconsequential to anyone but themselves," says Mitchell. "However, the moment you have a database that contains ID numbers, names and addresses, you are at risk, and so are your customers. Would you want to have dealings with a business whose network is not secure?
"Identity management has to be addressed on three levels: technology, policies and people. At a technology level, companies need to know at all times who is on their network, why, when and for how long. An audit trail should also be able to detail what information and applications were accessed by which user."
With regard to security policies, he notes that companies should ensure that privacy protection rules are in place; that sensitive information is identified, secured and encrypted when retrieved or sent over the network; and that users of differing levels of authority are given express authorisation and authentication mechanisms to access to specific information. There is huge potential for privacy abuse and identity theft where error and carelessness are unchecked.
"People remain the greatest security risk though," Mitchell notes. "Employees need to be made aware of security policies and be informed of potential hazards and threats they expose themselves and the organisation to when they fail to adhere to security policies.
"This extends beyond protecting passwords and ensuring anti-virus solutions are up to date. Employees should be made aware of new technical and legal issues, as well as the organisation’s responsibility to maintaining the confidentiality of customer information."
Loading ...