Information Security
Information Week April 20th 2009
This article was interesting in discussing the results from a study completed for Verizon’s Business risk team. The study results were based on field findings from mostly banks and retail companies. Some of the results were surprising to me.
- 99% of breached records were accessed by servers and server applications, not by computers at the direction of a user. OK so this says that the data is mostly protected from a user asking for it, but if it’s an application located on another server, then the book is open. That is such a weakness because server applications are simple to write and if the data is not protected from servers, then a simple server application could copy any item of data that the server application wishes to know.
- 74% of breaches were from external sources. This is probably the most feared type of data security breach because the data is taken by an outsider and no one knows what they might do with the data and there is no reasonable explanation for the data being taken other than for illicit use. That being said, the study showed that the biggest breaches were internal where the average number of records breached were 100,000 per breach compared to 37,000 when the breach came from an external location.
- 69% of the breaches were discovered by 3rd parties. WOW OK so this means don’t rely on your IT department to discover that you’ve been compromised. This makes sense because most IT professionals in your department will do what they can to protect your network from any intrusions that they are aware of, however they can’t protect the network from accessibility issues that they do not know about.
This take away from this article is that it’s very critical to protect the data as well as to try protect and secure the systems from undesired intrusion.
Sunday, April 26, 2009
Chapter 8 - VA Case Study
Question #1 - List and describe the security weaknesses at the Department of Veterans Affairs.
The VA had two major security weaknesses in the way they protected their data. There were poor physical security measures and information security measures were both to blame for this incident.
Institutional guidelines for physical security should have not allowed the entire database to be copied to a laptop. There is seldom any need for a centrally managed database to be transferred to a laptop since any changed made to the data by working off site will not be incorporated into the main database. Synchronization of such a massive database would not be reliable and thus the need for the data to be transported would be minimal.
The information should have been encrypted and password protected if there truly was a need for this employee to carry this data with him.
Question #2 – What management, organization, and technology factors contributed to these weaknesses?
Management – While one may not think of it as a weakness, the management’s reluctance to report the stolen laptop and the contents of the hard drive contributed to the difficulty in finding the laptop before the data was compromised.
Organizations – VA operations should have limited the data accessible to the employees to only the data needed in order to effectively do this job. Lack of promoting the sensitivity of the data led to a careless attitude regarding the protection of the data.
Technological – At a minimum the data should have been encrypted and password protected. As a practical measure, the laptop should have been protected at the BIOS level if that sensitivity of data was contained.
Question #4 – What solutions would you suggest to prevent these security problems?
As stated before, I cannot envision a need when this data retains any value once it is removed from the main database. It quickly becomes outdated as maintenance is done to the main database. If after hours access is required to complete the work on such a regular basis, then the agency needs to consider hiring another individual to allow the work to be completed during regular business hours thus eliminating the need for the data to be removed from the facility. If access to the data is required remotely then I would recommend an online system with the most secure connection possible.
The VA had two major security weaknesses in the way they protected their data. There were poor physical security measures and information security measures were both to blame for this incident.
Institutional guidelines for physical security should have not allowed the entire database to be copied to a laptop. There is seldom any need for a centrally managed database to be transferred to a laptop since any changed made to the data by working off site will not be incorporated into the main database. Synchronization of such a massive database would not be reliable and thus the need for the data to be transported would be minimal.
The information should have been encrypted and password protected if there truly was a need for this employee to carry this data with him.
Question #2 – What management, organization, and technology factors contributed to these weaknesses?
Management – While one may not think of it as a weakness, the management’s reluctance to report the stolen laptop and the contents of the hard drive contributed to the difficulty in finding the laptop before the data was compromised.
Organizations – VA operations should have limited the data accessible to the employees to only the data needed in order to effectively do this job. Lack of promoting the sensitivity of the data led to a careless attitude regarding the protection of the data.
Technological – At a minimum the data should have been encrypted and password protected. As a practical measure, the laptop should have been protected at the BIOS level if that sensitivity of data was contained.
Question #4 – What solutions would you suggest to prevent these security problems?
As stated before, I cannot envision a need when this data retains any value once it is removed from the main database. It quickly becomes outdated as maintenance is done to the main database. If after hours access is required to complete the work on such a regular basis, then the agency needs to consider hiring another individual to allow the work to be completed during regular business hours thus eliminating the need for the data to be removed from the facility. If access to the data is required remotely then I would recommend an online system with the most secure connection possible.
Sunday, April 19, 2009
Time to believe in Private Clouds
Information Week April 13, 2009
This article takes us to the next step in emerging technologies as outlined in chapter 5 of the book. Cloud computing appears to be the next big advancement in technology integration. The focus of this article is how many companies are eager to utilize the cloud computing concept for their own business enhancement. Companies like Salesforce.com have shown that using cloud computing as an IT infrastructure can work so many companies are taking a look at how to adapt it to their business models.
The advantages of cloud computing are significant to a company. The fast increase in computing power and communications speed has allowed the concept to grow into a viable IT resource. The concern that companies have with the cloud concept is sharing the data storage with the many other clients of the cloud. Data security of any company is critical to the success of the company. Trusting data storage and security to another company as the primary caretaker of the data can be difficult, especially if the service is priced so low.
That being the case, many companies are looking into the concept of private clouds where they can have customized software operate in a cloud environment with their own servers and security systems in place. This seems to make the data managers of the company feel more comfortable with control of the data. While private clouds might make sense for the sharing of customized software, thinking that private clouds will enhance data security is a false sense of security. I say this because I suspect a company that is offering cloud computing resources will be much more diligent and have more resources to maintain security in a cloud environment. I believe this because they have a much more vested interest in maintaining their reputation in order to stay in business. This reputation is much more important to a company who’s business is cloud computing than to a company who just utilizes the capability therefore the motivation of the specialty company would be higher and more likely to focus resources on their security as a core business.
This article takes us to the next step in emerging technologies as outlined in chapter 5 of the book. Cloud computing appears to be the next big advancement in technology integration. The focus of this article is how many companies are eager to utilize the cloud computing concept for their own business enhancement. Companies like Salesforce.com have shown that using cloud computing as an IT infrastructure can work so many companies are taking a look at how to adapt it to their business models.
The advantages of cloud computing are significant to a company. The fast increase in computing power and communications speed has allowed the concept to grow into a viable IT resource. The concern that companies have with the cloud concept is sharing the data storage with the many other clients of the cloud. Data security of any company is critical to the success of the company. Trusting data storage and security to another company as the primary caretaker of the data can be difficult, especially if the service is priced so low.
That being the case, many companies are looking into the concept of private clouds where they can have customized software operate in a cloud environment with their own servers and security systems in place. This seems to make the data managers of the company feel more comfortable with control of the data. While private clouds might make sense for the sharing of customized software, thinking that private clouds will enhance data security is a false sense of security. I say this because I suspect a company that is offering cloud computing resources will be much more diligent and have more resources to maintain security in a cloud environment. I believe this because they have a much more vested interest in maintaining their reputation in order to stay in business. This reputation is much more important to a company who’s business is cloud computing than to a company who just utilizes the capability therefore the motivation of the specialty company would be higher and more likely to focus resources on their security as a core business.
Panasonic and It’s Data Problems
2. How did Panasonic’s information management problems affect it’s business performance and ability to execute it’s strategy. What management, organization, and technology factors were responsible for those problems.
Panasonic was too big for their IT system. This is often the case with older companies that have not updated business processes as the communication capabilities of the internet have increased. Because of this lack of maintenance and updating of processes, data was being poorly managed and not cross checked between corporate networks thus there were many inconsistencies from one database to another leading to incorrect and inconsistent information being shared with the business partners of Pansonic. The responsibility for this problem is due to legacy outdated inventory systems that different between the locations. These data and inventory management systems were probably state of the art when they were first installed, however, global communication has dropped in costs significantly and it appears that Panasonic did not use that fact in their data management, nor does it appear that they gave centralized data management guidance to the various business units. I don’t see that it was a technological factor that caused the problem, it was more of a management problem by not managing the corporate data and information in an uniform way across business units.
3. How did master data management address these problems? How effective was this solution?
Master Data Management software is designed to marry data which has discrepancies to try create a most accurate database and then modifies the processes to maintain that data as the authenticated source. This allowed Panasonic to better provide consistant data to their customers and distributors which reduced any conflicting information giving the impression of a well run company. Furthermore, this more accurate data allowed Panasonic to share this data with their retailers which allowed them to improve their inventory management and saved them money. According to the article, the implementation of the MDM software was a vast improvement over the previous inventory process. This improvement helped not only Panasonic give a much better public profile to the customer, but also enhanced the profits of it’s retail partners.
4. What challenges did Panasonic face in implementing this solution?
Panasonic faced not only the typical technical challenges of trying to merge inconsistent databases, but they also had to contend with the protectionism that is typical of database managers. Database managers typically know the value of the data that they control and (thankfully) are very careful with how the data is shared. Even within the company, data can be analyzed to see deeper within the organizational unit than many desire, especially by corporate parents. I think that the MDM software was the best option that Panasonic could have selected. Trying to optimized such a massive amount of data by hand would have been a Herculean effort to say the least. This is a perfect use of the data consulting services offered by an expert corporation such as IBM.
Panasonic was too big for their IT system. This is often the case with older companies that have not updated business processes as the communication capabilities of the internet have increased. Because of this lack of maintenance and updating of processes, data was being poorly managed and not cross checked between corporate networks thus there were many inconsistencies from one database to another leading to incorrect and inconsistent information being shared with the business partners of Pansonic. The responsibility for this problem is due to legacy outdated inventory systems that different between the locations. These data and inventory management systems were probably state of the art when they were first installed, however, global communication has dropped in costs significantly and it appears that Panasonic did not use that fact in their data management, nor does it appear that they gave centralized data management guidance to the various business units. I don’t see that it was a technological factor that caused the problem, it was more of a management problem by not managing the corporate data and information in an uniform way across business units.
3. How did master data management address these problems? How effective was this solution?
Master Data Management software is designed to marry data which has discrepancies to try create a most accurate database and then modifies the processes to maintain that data as the authenticated source. This allowed Panasonic to better provide consistant data to their customers and distributors which reduced any conflicting information giving the impression of a well run company. Furthermore, this more accurate data allowed Panasonic to share this data with their retailers which allowed them to improve their inventory management and saved them money. According to the article, the implementation of the MDM software was a vast improvement over the previous inventory process. This improvement helped not only Panasonic give a much better public profile to the customer, but also enhanced the profits of it’s retail partners.
4. What challenges did Panasonic face in implementing this solution?
Panasonic faced not only the typical technical challenges of trying to merge inconsistent databases, but they also had to contend with the protectionism that is typical of database managers. Database managers typically know the value of the data that they control and (thankfully) are very careful with how the data is shared. Even within the company, data can be analyzed to see deeper within the organizational unit than many desire, especially by corporate parents. I think that the MDM software was the best option that Panasonic could have selected. Trying to optimized such a massive amount of data by hand would have been a Herculean effort to say the least. This is a perfect use of the data consulting services offered by an expert corporation such as IBM.
Sunday, April 12, 2009
TTX TAKES CHARGE
In the summer of 2007 TTX decided that it was finally time to upgrade it’s IT infrastructure to save the company some money. The article was highlighted in baseline magazine (http://www.baselinemag.com/). The goal was to make the website more effective at gathering the information from the customers, and reduce the number of customer service staff.
The results were impressive according to the article (http://www.baselinemag.com/c/a/IT-Management/On-the-Right-Track-580119/1/) with a successful integration of new software and business processes they were able to reduce their service desk staff by 50% and have better customer experience.
This got me to thinking about many of the businesses that still have not adopted an appropriate modernized IT strategy, or any IT strategy for that matter. In some of my dealings with some medium sized businesses I have noticed that the software that they use is so antiquated. I would have to believe that the security systems protecting the data and information contained in the is antiquated as well, if there is any protection at all. Small business usually cuts corners where it can and one place that is not obvious to customers is behind the IT scenes. I remember back to when the Y2K problem was identified. Software was still in use that was written in the 1970’s which accounted for the massive effort to check and prepare software for the change in millennium. What I learned from that was good software can last a long time and be forgotten.
I got to rambling here, but sometimes that is what happens in a blog. I must be on an information kick today because my take away from these thoughts and this article is that so many businesses are so far behind the times in IT infrastructure and protection of the information that one must be ever-vigilant with the protection of what information is shared.
The results were impressive according to the article (http://www.baselinemag.com/c/a/IT-Management/On-the-Right-Track-580119/1/) with a successful integration of new software and business processes they were able to reduce their service desk staff by 50% and have better customer experience.
This got me to thinking about many of the businesses that still have not adopted an appropriate modernized IT strategy, or any IT strategy for that matter. In some of my dealings with some medium sized businesses I have noticed that the software that they use is so antiquated. I would have to believe that the security systems protecting the data and information contained in the is antiquated as well, if there is any protection at all. Small business usually cuts corners where it can and one place that is not obvious to customers is behind the IT scenes. I remember back to when the Y2K problem was identified. Software was still in use that was written in the 1970’s which accounted for the massive effort to check and prepare software for the change in millennium. What I learned from that was good software can last a long time and be forgotten.
I got to rambling here, but sometimes that is what happens in a blog. I must be on an information kick today because my take away from these thoughts and this article is that so many businesses are so far behind the times in IT infrastructure and protection of the information that one must be ever-vigilant with the protection of what information is shared.
Netflix Vs Blockbuster
Study Case Questions:
1. Blockbuster Entertainment set out to dominate the video rental world by having the largest selection of DVD rentals of any of their competitors. They were well funded and with a very influential CEO, they soon became the Goliath of the industry and life was good at the top. In many industries, particularly retail, a solid physical infrastructure with the best selection in a nearby location is a recipe for success and can give you a significant advantage to fend off new competition. This advantage is enhanced because of the impatience of today’s consumer. We are all products of the “I want it now” generation and I think that Blockbuster was focusing on meeting that demand. Most people didn’t plan ahead for their entertainment and Blockbuster felt comfort with that social norm.
2. Meanwhile, a new fad called the internet was changing how companies interacted with consumers. Blockbuster was caught off guard by a different business model based on changing technology. Most people would attribute the technology that beat Blockbuster was internet based ordering, however the real innovation that hurt them was the DVD. VHS tapes were much more difficult to ship, and more prone to damage while DVD’s were cheap and lightweight to ship and less prone to damage. In addition, Blockbuster misunderstood a small a segment of their consumer base who were frustrated by the late fees and who were willing to plan ahead in order to avoid them. The DVD allowed a new business model, adopted by Netflix, to try challenge the traditional way consumers watched movies at their leisure. Keying on the fact that most consumers overestimate the number of movies in a month that they will watch, Netflix slowly started capturing a some consumers from Blockbuster.
3. Both Blockbuster and Netflix will be challenged in the future to remain growing companies, and in the end, both will become historical footnotes. Just as the DVD opened new options, changing technology is again forcing business to modify to meet consumer demands. VOD (Video on Demand) is quickly becoming a reality and will soon be the preferred delivery of choice due to the convenience and reduced cost. No longer will there be a need for a physical warehouse to distribute rented items. Servers will be able to download the videos as desired to computers and DVR’s that are now becoming prominent in many homes. Both Blockbuster and Netflix have tried to convert and capture the market by offering video on demand to download requested video files to the customer, however, eventually, their current value of being a single site will be usurped by search engine technology eliminating them as a one stop video shop. The streaming technology will advance so that any company can stream video in massive quantities thus eliminating the two competing companies as distributors.
1. Blockbuster Entertainment set out to dominate the video rental world by having the largest selection of DVD rentals of any of their competitors. They were well funded and with a very influential CEO, they soon became the Goliath of the industry and life was good at the top. In many industries, particularly retail, a solid physical infrastructure with the best selection in a nearby location is a recipe for success and can give you a significant advantage to fend off new competition. This advantage is enhanced because of the impatience of today’s consumer. We are all products of the “I want it now” generation and I think that Blockbuster was focusing on meeting that demand. Most people didn’t plan ahead for their entertainment and Blockbuster felt comfort with that social norm.
2. Meanwhile, a new fad called the internet was changing how companies interacted with consumers. Blockbuster was caught off guard by a different business model based on changing technology. Most people would attribute the technology that beat Blockbuster was internet based ordering, however the real innovation that hurt them was the DVD. VHS tapes were much more difficult to ship, and more prone to damage while DVD’s were cheap and lightweight to ship and less prone to damage. In addition, Blockbuster misunderstood a small a segment of their consumer base who were frustrated by the late fees and who were willing to plan ahead in order to avoid them. The DVD allowed a new business model, adopted by Netflix, to try challenge the traditional way consumers watched movies at their leisure. Keying on the fact that most consumers overestimate the number of movies in a month that they will watch, Netflix slowly started capturing a some consumers from Blockbuster.
3. Both Blockbuster and Netflix will be challenged in the future to remain growing companies, and in the end, both will become historical footnotes. Just as the DVD opened new options, changing technology is again forcing business to modify to meet consumer demands. VOD (Video on Demand) is quickly becoming a reality and will soon be the preferred delivery of choice due to the convenience and reduced cost. No longer will there be a need for a physical warehouse to distribute rented items. Servers will be able to download the videos as desired to computers and DVR’s that are now becoming prominent in many homes. Both Blockbuster and Netflix have tried to convert and capture the market by offering video on demand to download requested video files to the customer, however, eventually, their current value of being a single site will be usurped by search engine technology eliminating them as a one stop video shop. The streaming technology will advance so that any company can stream video in massive quantities thus eliminating the two competing companies as distributors.
Subscribe to:
Posts (Atom)