Security Risks in the New Economy

Increasing cases of identity and data theft are becoming a major cause for
concern across organizations and individuals alike. They're causing
financial loss, data loss, and not to mention loss of credibility and
reputation. We surveyed 80+ CIOs across India to find out how seriously they
tackle Information Security threats. We also believe that securing data is
everyone's responsibility and tell you how to go about doing it.

Before devising a plan to secure your information, you need to understand the
current security landscape and the risks it involves. So in order to understand
what's currently happening, we surveyed 80+ CIOs from across the country to find
out their understanding of the subject, and what they were doing about it. The
results we got were pretty interesting. Here's the first one:

The surprising element in the above is the 30% CIOs, who feel that security
threats are still a nuisance. Had that been the case, then cyber crime would not
have been a multi-billion dollar industry. Clearly, cyber crime is on the rise
because there are monetary gains involved. According to various research reports
from key security vendors, most cyber crimes today are targeted at stealing
critical data for financial gain. This trend is only expected to grow, and the
sooner we accept this fact, the better it will be as we would then be in a
better position to combat it.

The good thing though is that the level of seriousness amongst Indian CIOs
with respect to information security is pretty high. Even the top management in
most organizations understands the possible security risks and what kind of an
impact they can have on the organization. However, this doesn't directly
translate into allocating a significant part of the IT budget on information
security. The data on that suggests the following:

The rest of the CIOs didn't give a clear indication about their information
security budgets. There was another key trend that we observed from the survey,
which is even more interesting:

The above clearly indicates that anti-virus software is not completely
effective in combating security threats. Despite having it deployed, viruses
manage to creep in and cause havoc. It's important therefore, to understand how
viruses still manage to creep into the system, despite having so many solutions
in place.

So now, we'll focus on some of the key security risks that are heating up.

Entry Points for security threats

There are a larger number of channels through which malicious code can
enter.

Security threats can come from anywhere, be it outside or inside the network.
information can be stolen from anywhere, be it your network, desktops, servers,
Internet portal, wireless network. Therefore, you need to first identify the
possible channels from where information can be stolen-USB ports, remote access
to systems, wireless networks, VoIP, laptops, smartphones, etc. Information can
be stolen from most of these channels. Here's the state of affairs as far as
Indian enterprises are concerned:

The above graph is quite interesting. It shows that 61% organizations use
secure wireless networks. What this means is that the remaining 41% either don't
have wireless networks or use wireless networks that are not secure. Likewise,
if 40% organizations allow open usage of flash drives, then they are obviously
in danger of information theft. And if 56% of the CIOs provide remote access for
their organization's employees, there is a chance of information theft. The real
interesting ones are open access to public IMs and open usage of USB drives.
Free access to public IMs means employees can send whatever information they
want to anybody. Let's analyze this in more detail.

How vulnerable are USB ports?

USB ports have become the default interface for just about every device you
plug into a PC or laptop today. While they've increased the convenience, they've
also increased the security risk. USB flash drives for instance, are commonly
used to carry/share data. This has also made them the most common cause of
spreading virus infections. The Conficker worm, which has been in the limelight
for quite some time now, spreads itself through USB drives, among other channels
of course. The University of Utah recently reported that 800 machines on its
network were infected by the worm, all because somebody brought a USB drive
infected with Conficker, into the network. Even if you can prevent virus
infections on USB drives by keeping anti-virus software updated on all systems,
how will you prevent somebody from walking away with important information on a
USB drive?

Besides flash drives, USB ports can also be used to connect devices like
Internet data cards. While this makes it easy for your mobile workforce to
connect to the corporate network, or use the Internet when on the move to check
important mail, it also makes it easy to leak information. Given that the
current economic slowdown is causing a lot of employee lay-offs, USB ports could
be considered as a security threat.

Does this mean that you should block all USB ports on all machines in your
organization? There are solutions to do that, but before you do that, it's
important to understand the implications. While you prevent information theft or
virus infection, you're also taking away the convenience that most employees
have enjoyed. This could therefore reduce employee productivity.

So if you do plan to block all USB ports, first look for alternatives.
Revisit all access control rights and be more stringent on who has access to
what resources. Ensure that the common network location for file sharing amongst
employees is cleaned up more regularly than before.

Security incidents over past few years

Users are a key asset for every organization, but they're also the most
vulnerable point of entry. It's easier to cajole a user into delving important
information than breaking through a firewall. This makes educating users of
various security threats extremely important. However, it's not as easy as it
sounds. Have a look at the following result from our information security
survey:

You'll notice that laptop thefts are at the top of the security incidents
list. This obviously means that users have to be more careful and stronger focus
needs to be put in training users on how to protect their laptops. The second
one is about theft of confidential information. This could be caused by weak
passwords or authentication, but they could also be caused by disgruntled
employees walking away with confidential data on USB drives. The fourth one is
another direct link to users-identity theft.

Is User Training the Answer?

If educating your users could resolve the problem of incoming security
threats, then no organization would be combating so many security threats today
and facing major financial losses. It would be the end of security threats and
everyone would be sleeping peacefully at night. But unfortunately that's not the
case. The thing to observe here is how much to really expect from your users? Do
you seriously expect them to remember long, complicated passwords without
writing them down somewhere? Or do you expect them not to open an attachment
that pretends to come from their

boss? Or click on an email that comes from a bank where they don't have an
account?

Every single user today has dozens of passwords, and it's impossible for them
to keep track of all of them without writing them down somewhere. Using the same
password for all applications is anyways a bad idea, because if it gets hacked,
then the hacker gains entry into all of the user's apps. So obviously every user
today is expected to remember multiple passwords. Now, if you make the passwords
too complex so that they're difficult to hack, then you're also making them
difficult to remember. So a user would obviously have to write them down
somewhere. You could teach the user to store his/her passwords in a 'password
protected' document or implement other mechanisms like fingerprint scanning,
card scanners, etc.

Likewise, you can't expect every user in your organization to go through your
security policy every time they want to check an email or access a website on
the Internet. Nor can you expect the user to remember the dozens of points
you've written there. So you obviously need to strike a balance between user
expectations and your security policy. If there are too many mail attachments
floating around, which could be a potential security hazard, then implement a
software that removes them from all incoming emails, delete the obviously
suspicious ones like those with .exe extension, and then put the rest in a
folder on the network. The user could then get the email with a link to this
attachment or if it was a potentially dangerous one, then get the message
indicating so. This way, you've removed the hazard of leaving it to the user to
figure out whether the attachment is legitimate or not. Or should we say, you've
no longer left it to chance. In fact, long time ago, PCQuest had given the
prestigious Best IT Implementation award to ICICI Bank for implementing such a
mail attachment stripping solution.

Before you implement a security solution

The answer to this is of course to first identify what kinds of security
threats are you fighting the most? Where are you spending most of your time?
Only then, can you identify the right solutions to deploy.

So, as per the above, organizations are spending most of their time combating
virus attacks, despite having anti-virus software in place. This obviously
indicates the need to train users on how to identify suspicious activity that
could be linked to a virus attack. Likewise, they have to be trained to identify
spam, because that's the next biggest threat that CIOs spending most of their
time fighting.

Besides identifying the areas where most of the time is going, it's equally
important to identify the major security incidents that have happened in your
organization and their financial implications. For instance, this is what our
survey says:

As you can imagine, organizations are facing serious security breaches, which
require attention because they involve financial loss. This loss can be quite
severe. In fact, 8% of the CIOs admitted to having suffered losses to the tune
of several Lakhs of Rupees, while another 13% admitted to having faced loss of
reputation and credibility. However, the more unfortunate part was that 24% of
the respondents had no concrete method of measuring losses caused by security
incidents. This is obviously not an easy job. One way of doing it could be to
measure the amount of downtime you've experienced and the productivity lost as a
result of that. This could be equated with the salary of employees that have
been affected and then the total loss could be calculated. The way to measure
loss would be different in case data gets stolen. That would be more difficult
to calculate.

Importance of documentation and Standards

However, security solutions alone aren't enough. You also need
well-documented security policies, and moreover you need to conduct regular
formal assessments of your network. Our survey revealed the following facts
about the documentation of security policies:

Having a written policy is always a good idea and we can't stress enough on
its importance. But even more important than that is to visit it regularly and
keep updating the same. For instance, suppose that despite having a documented
policy, you keep getting recurring security threats. In such a case, you need to
find a solution to that threat, and update your security policy on how you
combated it. We already gave the example of email attachments when we discussed
the importance of user training.

Besides documentation, you also need to conduct regular assessments of the
security of your network. Since your IT infrastructure isn't static, how can
your security remain the same? Security threats are increasing, and so is your
IT infrastructure. Beyond a certain point, even policies and re-assessments may
not work. That's where you would need to start exploring security standards.
Today, two key security standards exist for information security. These are
BS7799 and ISO27000 series. There are quite a few organizations that haven't
deployed these standards. Amongst the two, the ISO standard seems to be more
popular.

Which Solutions to deploy?

There's a whole range of security solutions available, which you can deploy
to combat information security threats.

The current state of affairs amongst Indian enterprises is that 94% have
anti-virus software and firewalls. It's surprising that 13% of our survey's
respondents didn't have anti-spam solutions in place. Email security seems to be
surprisingly high at 79%, and same goes for Intrusion Prevention Solutions at
69%. The remaining information security solutions, which would become extremely
relevant in the times to come have low levels of deployment. Hard Disk
encryption for instance, is there only across 15% of the enterprises we
surveyed. This is extremely useful in preventing your data from getting mis-used
should your laptops get stolen.

An analysis of the CIOs' plans on what to deploy in information security gave
us hopes for the new solutions. 41% of the respondents were planning to deploy
hard disk encryption for instance, while another 49% were planning to implement
data loss prevention solutions. We've given a detailed overview of this new
technology elsewhere in this story. Here's the rest of the solutions that CIOs
are planning to deploy:

How to choose the right solution

Sometimes the solution may not lie in a fancy, expensive piece of security
solution at all. So before you go all out to deploy every new security product
or technology, wait and watch. Wait for some time to see whether the product or
solution has managed to withstand the test of time. During this period, watch
who all are deploying it. After that, ask the vendor to give you some customer
references, and then decide whether it's really worth deploying or not. It's
very easy to get taken away by fancy words that are published in research
reports of well-known agencies or get caught in the glossy brochures of vendors
who claim that their product or solution is the best thing that happened to
mankind since brown bread. While it's important to go through them, they should
not form your basis for purchase decision making. Before you decide to invest a
huge amount in a security solution, ask around. Find some experts with hands-on
experience. Determine what kinds of challenges did they face while deploying it,
and whether the experience was pleasant or otherwise.

Anil Chopra,Anindya Roy, Rakesh Sharma, Swapnil Aroa and Varun Jaitly