Cyber criminals are winning the security war
"I believe some battles are being won by network administrators, yet I strongly believe that the war is at present being won by cyber criminals. Without a shadow of a doubt insiders pose the major risk to companies." I-Tech knew that the interview with...
"I believe some battles are being won by network administrators, yet I strongly believe that the war is at present being won by cyber criminals. Without a shadow of a doubt insiders pose the major risk to companies." I-Tech knew that the interview with a top IT executive in the field of network security would include warnings on the ever-increasing need for tighter security in computers networks, but Andre Muscat, director of network security products at GFI, exceeded our expectations.
"Despite the extensive arsenal of security solutions that administrators have at their disposal, cyber criminals are still successfully attacking systems and stealing valuable data which they can use for credit card fraud, identity theft and other malicious activity and which is only limited to the imagination of the cyber criminal himself," he told i-Tech in an exclusive interview from his San Gwann office.
From a man who admits that "IT security is a passion and you never know enough and thus you must keep yourself updated", this sounds like a deadly serious warning.
It seems the adoption of the internet as a core business requirement, coupled with the uptake of convenience technologies such as Plug & Play, USB devices, wireless devices, and mobile phones, have only led to an increase in the number of attack vectors that can be used by cyber criminals to achieve their target.
That's not all. Threats come not only from the outside but they can also originate from within the organisation. It is really easy for a trusted employee to plug in his lifestyle device such as an iPod and steal data in a matter of seconds. What is even worse is that iPods can be used to introduce malware, such as viruses and Trojans, pornography, part-time work material and more to the office. Security naive employees may open an executable which arrived in their e-mail inbox to look at a joke without stopping to think that a virus may be embedded within that joke.
"The human factor carries a lot of weight in the network security equation," explained the GFI senior executive. "In a large majority of cases, security breaches caused by employees are often the result of either negligence or a lack of knowledge rather than malicious intent. Businesses lose millions because employees stick passwords on sticky notes on their monitors, forget laptops or hand-held devices in public places, keep computers unlocked during lunch-breaks, overnight or over the weekend, leave USB sticks with sensitive company information unattended or surf the internet from home while connected to their companies' networks.
"Enforcing network security is as much about human nature as it is about technology. The challenge is to understand and manage both."
These, coupled with the ever-popular web-based threats such as phishing sites and e-mail scams, pose an equal risk to companies and individuals.
So what's the cost of having an organisation's computer network down for a couple of hours?
"It all depends on how crucial the IT infrastructure is to the company's operations and to what extent the company's 'survival' depends on those systems being active when required," replied Mr Muscat. "One aspect I would like to point out here is that cost does not necessarily always mean money. A network that is down can cost a company a lot in terms of credibility and business continuity."
As an example he mentions the case of TJ Maxx, a major US retailer which earlier this year suffered a hacker attack and whole databases of client information were stolen. Following this incident, surveys indicated that people were refraining from shopping at TJ Maxx because they feared their data would be stolen again. Notwithstanding the fact that TJ Maxx quickly upgraded its systems so that it effectively became impregnable, the damage was already done. Customers are lost, business is lost and profits suffer.
It is also a matter of time when a network will come under a security attack.
"A network is as strong as its strongest link and as weak as its weakest link. Experience shows that malicious individuals will go to great lengths to gain malicious access to networks, using all forms of subversion and attacks.
You have to make sure that all loopholes are covered, all systems are patched, all unutilised system accounts are disabled and last but not least, make sure that company insiders are aware of the threats and are trained to counter these threats.
Finally, you have to set up an effective corporate security policy made known to all corporate insiders and subsequently don't rely on the goodwill of your insiders to abide to this policy as well as implement technological barriers which protect you against malicious activity. Remember, if you have a chink in your armour it will be exploited. It is not a matter of "if", it's a matter of "when".
"Unless network administrators make better use of the tools that are available to them, and senior management starts looking at security as an investment instead of an overhead, these companies will remain easy targets for cyber criminals who will continue winning the war," he warned.
Network efficiency is not just a matter of security but also of having machines running properly and reliably.
"The biggest challenge network administrators face today is network growth. As time goes by, networks grow larger and become more complex. This creates problems for systems administrators because they need to keep track and control of what they have on their network and what use is being made of it. In a medium-sized network, it is impossible to audit all the network resources manually. Help exists in the form of resource monitoring and auditing company's success which started in Malta in 1992 and today has offices in Malta, London, Raleigh, Hong Kong, Adelaide, Hamburg and Cyprus.
"Our products have won several awards because they address the needs of administrators in small and medium sized enterprises, providing them with added functionality and benefits that are usually only found in enterprise-level solutions, yet at a price that won't break the bank," concluded Mr Muscat.
"Despite the extensive arsenal of security solutions that administrators have at their disposal, cyber criminals are still successfully attacking systems and stealing valuable data which they can use for credit card fraud, identity theft and other malicious activity and which is only limited to the imagination of the cyber criminal himself," he told i-Tech in an exclusive interview from his San Gwann office.
From a man who admits that "IT security is a passion and you never know enough and thus you must keep yourself updated", this sounds like a deadly serious warning.
It seems the adoption of the internet as a core business requirement, coupled with the uptake of convenience technologies such as Plug & Play, USB devices, wireless devices, and mobile phones, have only led to an increase in the number of attack vectors that can be used by cyber criminals to achieve their target.
That's not all. Threats come not only from the outside but they can also originate from within the organisation. It is really easy for a trusted employee to plug in his lifestyle device such as an iPod and steal data in a matter of seconds. What is even worse is that iPods can be used to introduce malware, such as viruses and Trojans, pornography, part-time work material and more to the office. Security naive employees may open an executable which arrived in their e-mail inbox to look at a joke without stopping to think that a virus may be embedded within that joke.
"The human factor carries a lot of weight in the network security equation," explained the GFI senior executive. "In a large majority of cases, security breaches caused by employees are often the result of either negligence or a lack of knowledge rather than malicious intent. Businesses lose millions because employees stick passwords on sticky notes on their monitors, forget laptops or hand-held devices in public places, keep computers unlocked during lunch-breaks, overnight or over the weekend, leave USB sticks with sensitive company information unattended or surf the internet from home while connected to their companies' networks.
"Enforcing network security is as much about human nature as it is about technology. The challenge is to understand and manage both."
These, coupled with the ever-popular web-based threats such as phishing sites and e-mail scams, pose an equal risk to companies and individuals.
So what's the cost of having an organisation's computer network down for a couple of hours?
"It all depends on how crucial the IT infrastructure is to the company's operations and to what extent the company's 'survival' depends on those systems being active when required," replied Mr Muscat. "One aspect I would like to point out here is that cost does not necessarily always mean money. A network that is down can cost a company a lot in terms of credibility and business continuity."
As an example he mentions the case of TJ Maxx, a major US retailer which earlier this year suffered a hacker attack and whole databases of client information were stolen. Following this incident, surveys indicated that people were refraining from shopping at TJ Maxx because they feared their data would be stolen again. Notwithstanding the fact that TJ Maxx quickly upgraded its systems so that it effectively became impregnable, the damage was already done. Customers are lost, business is lost and profits suffer.
It is also a matter of time when a network will come under a security attack.
"A network is as strong as its strongest link and as weak as its weakest link. Experience shows that malicious individuals will go to great lengths to gain malicious access to networks, using all forms of subversion and attacks.
You have to make sure that all loopholes are covered, all systems are patched, all unutilised system accounts are disabled and last but not least, make sure that company insiders are aware of the threats and are trained to counter these threats.
Finally, you have to set up an effective corporate security policy made known to all corporate insiders and subsequently don't rely on the goodwill of your insiders to abide to this policy as well as implement technological barriers which protect you against malicious activity. Remember, if you have a chink in your armour it will be exploited. It is not a matter of "if", it's a matter of "when".
"Unless network administrators make better use of the tools that are available to them, and senior management starts looking at security as an investment instead of an overhead, these companies will remain easy targets for cyber criminals who will continue winning the war," he warned.
Network efficiency is not just a matter of security but also of having machines running properly and reliably.
"The biggest challenge network administrators face today is network growth. As time goes by, networks grow larger and become more complex. This creates problems for systems administrators because they need to keep track and control of what they have on their network and what use is being made of it. In a medium-sized network, it is impossible to audit all the network resources manually. Help exists in the form of resource monitoring and auditing company's success which started in Malta in 1992 and today has offices in Malta, London, Raleigh, Hong Kong, Adelaide, Hamburg and Cyprus.
"Our products have won several awards because they address the needs of administrators in small and medium sized enterprises, providing them with added functionality and benefits that are usually only found in enterprise-level solutions, yet at a price that won't break the bank," concluded Mr Muscat.