Security News, Vulnerabilities, Data Breaches, Website Security
Posts tagged Identity theft
Vanguard Security Conference – Supplier Security
Jun 2nd
I spoke yesterday at the Vanguard Security Conference (http://www.go2vanguard.com) Vanguard has been doing this conference for a number of years. The focus is on Mainframe security. Most security professionals these days have never worked on MF security. I am proud to say I have back in the mid-90’s. We perhaps I shouldnt be do happy, it was over a decade ago.
The point being, that there are so many areas of security out there that most of us will never touch yet there is a dire need for professionals. The conference was less attended, as are most conferences this year, but I found the folks here are REALLY interested in learning and excited about the classes.
My topic was on Supplier Risk Management processe. You are asking yourself, what is that? I asked myself that same question in coming up with some good processes to target Supplier security. We have to go way beyond a SAS70 if you want real security over the hundreds or thousands of vendors that a large company may work with.
The Problem:
- No framework for managing vendor risk
- Inconsistent processes for tracking vendors
- Lack of enforcement capabilities
The Opportunity:
- Provide practical steps to manage vendor access/management
- Provide cost effective solution for risk mitigation
- Provide numerical risk analysis of vendor/partner security issues
- Risk reduction or risk acceptance
- Documented exposure
- Iterative process for risk management
- Happy CIO
So a Supplier Security assessment follow 4 main steps:
- Analyze current vendor database, catageorize each
- determine risk of each supplier, determine threats posed by each supplier
- Perform assessment tests of each supplier, their processes of interaction, and data access
- develop risk mitigation plan, update processed, monitoring processes
Gary Bahadur
http://twitter.com/kraasecurity
*Managed Security Services
*Vulnerability Management
*Compliance & Policy Development
*PGP Security
*FREE Website Security Test
Healthcare Security- Identity Theft and Hacker ransom
May 7th
I hope no one is actually shocked by this story. Records are stolen everyday. Typically, the hackers will sell the information in the underground somewhere is Eastern Europe or Asia. The fact that someone is asking for ransom, and so publicly it actually a good thing in my opinion. Why is it good you ask? (I assume you are asking that, vulcan mind meld and all that..) Maybe the industry (meaning all industries) need a sensational story to get real change in their IT Security environments.
When the Heartland data breach happened, it was interesting but the general public didnt find it sexy enough. A ransom note, publicly done makes for good drama. Equate it to the Somali pirates. They really broke in the news because of the weapons they captured. This might be the “weapons” story that gets the general public asking about security of the places they use on the Internet.
Identity theft is on the rise. Most companies never do a web application security assessment. They almost never do a database security review. If the hacker can break in through your web portal but your database of customer data is encrypted, well your last line of defense can save your hide.
So what are some things you can do to protect your website?
1) Conduct a web application security assessment. You should probably do this twice a year or anytime you make any significant changes to the application.
2) Conduct an architecture review. If your network architecture has holes in it, a hacker can find away around the application and perhaps get to the data through a different port.
3) Conduct a host security diagnostic review. If the hacker can get on the system and take advantage of an operating system weakness, you will still be compromised
4) Conduct a database security review. Your last line of defense, make sure the data in encrypted, access is completely authenticated and IDS on the database to flag and stop inappropriate access
5) Hire someone smart to do your security assessment.
Gary Bahadur
http://twitter.com/kraasecurity
*Managed Security Services
*Vulnerability Management
*Compliance & Policy Development
*PGP Security
*FREE Website Security Test
+++++++++++++++++++++++++++++++++++++++++++++++
The Channel Wire
May 06, 2009
Recent Comments