Category Archives: Technology Risk

Игроки всегда ценят удобный и стабильный доступ к играм. Для этого идеально подходит зеркало Вавады, которое позволяет обходить любые ограничения, обеспечивая доступ ко всем бонусам и слотам.

Ernst & Young’s Global Information Security Survey

Posted on by

Last week, I attended the Ernst & Young media roundtable to hear the results of its 2010 Global Information Security Survey (GISS). The survey includes responses from participants in 1,598 organizations in 56 countries across all major industries.

With the increase in the use of external service providers and the adoption of new technologies such as cloud computing, social networking and Web 2.0, companies are increasingly exposed to data breach threats. In fact, 60% of respondents perceived an increase in the level of risk they face due to the use of social networking, cloud computing and personal devices in the enterprise. And according to the survey, companies are taking a proactive stance as 46% indicated that their annual investment in information security is increasing. Though IT professionals are trying, not all are succeeding in keeping up with new tech threats.

“I’ve never seen this kind of shift in IT before,” said Jose Granado, the America’s practice leader for information security services within Ernst & Young. “Security professionals are trying to keep up with the pace, but aren’t really doing a great job. The have limited resources and a limited budget.”

A concern for IT professionals is mobile computing. Demands of the mobile workforce are driving changes to the way organizations support and protect the flow of information. In fact, 53% of respondents indicated that increased workforce mobility is a significant or considerable challenge to effectively delivering their information security initiatives. Aside from investing more on data loss prevention technologies, 39% of respondents are making policy adjustments to address the potential new or increased risks.

“You have to implement realistic policies,” said Chip Tsantes, principal within the financial services division of Ernst & Young. “They need to be liveable and workable, or else people will go around them. You can’t simply ban things.”

Another major concern for IT pros is the gaining popularity of cloud computing. Both Granado and Tsantes were shocked to learn that 45% of respondents (primarily those on the non-financial services side) are currently using, evaluating or are planning to use cloud computing services within the next 12 months.

“From the standpoint of a traditional IT security professional, endorsing or supporting a cloud environment is counter-intuitive,” said Granado. “How do I know where my data is and how do I know it is protected?”

So how do companies increase their confidence in cloud computing? According to the survey, 85% say that external certification would increase their trust.

So I asked Granado and Tsantes if they could tell me when they believed there would be a universal set of standards for cloud computing providers. Granado feels there is a two-to-three year timeline in regards to having something solidified. He says businesses are going to drive it; If businesses continue to push, “cloud providers would have to follow.” With more and more sensitive data calling the cloud home, let’s hope Granada is being conservative with his estimate.

cloud computing2

October: A Busy Month for Data Breaches

Posted on by

Every company, no matter what industry it is aligned with or what country it is based in, is vulnerable to losing sensitive data, either accidentally or by malicious endeavors. The Ponemon Institute has found that the average cost of a data breach in 2009 was an incredible $3.4 million. And, unfortunately, the frequency with which these breaches occurs appears to be increasing. Let’s take a look at some of North America’s more notorious breaches for October 2010:

October 14: In Lake County, Florida, a credit union employee stole customer’s credit information to take out loans — money which was used to help finance the attorney fees of her son, who is on death row for murder. The employee, Nazreen Mohammed, was accused of attempting to take $430,000 from banks such as RBC and Fairwinds Credit Union.

October 14: An employee of Accomac, Virginia had his laptop computer stolen while on vacation in Las Vegas. The computer held the names and Social Security numbers of approximately 35,000 county residents. The employee took the laptop on a personal vacation without permission from his superiors.

October 14: Though the incident occurred in August, it wasn’t recognized until October when the Veterans Benefit Administration Office in Boston realized they sent 6,299 benefit letters to the wrong address. All nine digits of Social Security numbers were on 3,936 of the letters. A Veteran’s Affairs report blamed the incident on programming error.

October 15: On this date, the University of North Florida reported that more than 100,000 people could be affected by a security breach. UNF stated that a file containing personal information on prospective students was possibly accessed by someone outside the United States. The university is working with the FBI “to determine the cause and intent of the breach.”

October 20: The personal information of 280,000 Medicaid members in Pennsylvania was compromised when a portable hard drive belonging to Keystone Mercy Health Plan and AmeriHealth Mercy Health Plan was lost. “The insurers said they have beefed up security practices and will provide free credit-monitoring assistance to the people whose Social Security numbers, either in whole or in part, were on the missing hard drive.”

October 21: The Thames Valley District School Board in Ontario, Canada shut down its online student portal after it realized that the internet passwords of more than 27,000 high school students were compromised. The culprit in this incident posted a link on Facebook that directed users to a site that listed the names and passwords of students.

This, however, is only a partial list. More incidents can be found at DataLossDB.org.

Does your company have a solid cybersecurity strategy? If not, check out the article, The 5 Steps of a Cybersecurity Risk Assessment, by Peyton Engel, a data security expert at CDW.

keyboard

The Risks of Social Media — Now Available in Risk Management Magazine

Posted on by

Our campaign to provide in-depth coverage of the risks of social media started almost exactly one year ago.

I wrote a long, sweeping cover story on the issue, trying to highlight as many of the perils as possible. And while that provided a pretty good introduction to the topic for an audience that is, let’s just be nice and say, a little less familiar with social media than your average teenager, it was somewhat of a shallow exploration of a very serious threat.

Thus, we have used this here blog to continue the coverage ever since with our Risks of Social Media post series. This has allowed us to take different aspects of social media and break it down clearly with some real-world examples from the news.

Those more devoted readers among you, however, may have noticed that there has not been a lot of new posts in the series of late. Our apologies. But the good news is that this slow down has run parallel with an effort to cover the topic again, in a much more in-depth way, in our magazine, Risk Management.

So here, I present to you, our October cover story, “More Media, More Opportunity, More Risk”

It is a six-part examination of the legal liability, reputation damage, employee monitoring/pre-employment screening fallout and other risks associated with social media. You can also read about how IBM excels at handling social media, the top 5 ways that insurance companies can use social media and 15 tips to help anyone manage social media risks.

I’m clearly biased, but I thought the whole thing turned out rather good — almost as good as the issue cover below that our designer Karen Arbasetti crafted. (If you liked this, feel free to subscribe to the print edition.)

Please let us know what you think in the comments below. And stay tuned to the blog for even more coverage in the future.

Lastly, in other social media news, you can follow me on Twitter, “like” us on Facebook and join our LinkedIn group.

risk management

The Risks of Social Media: Decreased Worker Productivity

Posted on by

To me, the biggest concerns companies should have about social media revolve around reputation damage, legal liability and workplace issues (cyber-stalking, sexual harassment, etc.). These are the issues that can hurt the most, with some other things to watch for being improper disclosure of confidential/financial information, data breaches, viruses/malware and any other general network security concerns.

We have been covering such concerns throughout the year in our Risks of Social Media series (something we will be bringing to print in Risk Management magazine in our October issue. Look for that next week. And see the pretty cover our designer created for the story here.)

Another issue that comes up constantly whenever I discuss social media risks with executives is decreased worker productivity.

To many, this seems to be the largest drawback to social media. In their eyes, workers who previously toiled away for the duration of their eight-hour shift are now so enthralled by Facebook and Twitter that they simply cannot help but peruse the sites constantly throughout the day. While they are doing that, of course, they aren’t getting any work done. Less work equals less production, which equals lower profits.

The way they see it, that is the grand downside of Facebook: it compels people to not work while they are at work.

The way I see it … that’s a crock.

Sure. It happens. Some people do spend a lot of time on social networks. They chat with friends, they look at family vacation photos and play Farmville. They waste a lot of time.

But this is really nothing new.

The internet is full of distractions, and if someone doesn’t want to work, they will find a way to not work. Facebook and Twitter did not create a new wave of malaise and boredom among those with dull jobs. People trapped in boring jobs — or just poor workers employed in good jobs — have been finding ways to be unproductive at work since well before the internet was even used at most companies.

Cigarette breaks and the water cooler have existed for a long time. Watch Mad Men and you will see how even the high-powered execs of the 1950s and 60s wasted time boozing and socializing at the office. The Super Bowl, March Madness, fantasy football, Survivor, American Idol, the Oscars and a seemingly limitless amount of other distractions may take up a substantial part of any given employee’s attention while at work.

Or take this fictional exchange between “efficiency expert” Bob Porter and data processor Peter Gibbons in Office Space, a cinematic lampoon of the modern workplace:

Bob Porter: We’re trying to get a feel for how people spend their day at work … So, if you would, would you walk us through a typical day, for you?

Peter Gibbons: Yeah. I generally come in at least fifteen minutes late, ah, I use the side door – that way Lumbergh can’t see me, heh heh – and, uh, after that I just sorta space out for about an hour.

Bob Porter: Da-uh? Space out?

Peter Gibbons: Yeah, I just stare at my desk; but it looks like I’m working. I do that for probably another hour after lunch, too. I’d say in a given week I probably only do about fifteen minutes of real, actual work.

The point here is that if your workers don’t like their jobs, they can find many ways to not get any work done. And if they do like there jobs, the allure of Facebook — despite all the buzz you hear about its unprecedented ability to connect millions — is not nearly great enough to force quality employees to ignore their responsibilities.

Facebook Productivity

(The comical part about this whole post is that I myself was on Facebook prior to writing it — and then Facebook had a major, extended service interruption, which prompted me to actually do some work and write down my thoughts on the matter after seeing the satirical tweet above from @OPB. Yes, I’m a hypocrite. I know.)

This isn’t to say that companies should not explain to employees in a social media policy that they are not to waste time on Facebook all day. They should do exactly that.

But it’s not some new-age problem. Workers should not be wasting time doing anything. That’s the message. Rolling out some draconian policy that applies to the employee’s social media usage, however, is more likely to be alienating and de-motivational than it is to make employees want to do more work. At least that’s how I see it.

Besides, most people today who use Facebook and Twitter extensively can do it on their smartphone anyway. So if you implement controls on their desktop computer, they can just sit in their cubical and twiddle away on their iPhones and Blackberrys. Or, ya know, just sorta space out for about an hour after lunch.

For more on the topic, Gini Dietrich of the excellent blog Spin Sucks seems to share my view, calling worker productivity a “management issue” not a social media issue.