I'm happy to announce the launch of Pratum's new online security awareness training portal. If you are looking for a quick and cost effective way to provide security awareness training to your employees, our new security awareness training portal is for you. We call it InTraining. The training course meets the needs to provide employee security awareness training for HIPAA, SOX, PCI and other compliance requirements. Our fully integrated training portal provides a company administrator with the ability to enroll employees on the fly, create compliance reports for auditors and send reminders to those who haven't completed their annual training.
The multi-media content is designed to provide a high level overview of common information security topics in a format that is easily understood by the average employee. No fancy techno-jargon, just practical information employees need to know in order to protect the confidentiality, integrity and availability of company data.
If you're looking for OWASP training for your application developers to satisfy your PCI compliance, our OWASP course will be launching next month as well.
The Catholic Diocese of Des Moines was involved in a computer security breach last month in which thieves were able to steal more than $600,000 from their automated clearing house (ACH) account at Bankers Trust. To the credit of Bankers Trust, they were able to detect the fraudulent activity and notify the Diocese within a matter of days. Unfortunately the funds were already gone by then.
According to the Diocese press release and other media reports, the FBI has seized several computers from the Diocese but no employees of the Diocese or Bankers Trust are suspected to be involved. This either means one of two things. Either law enforcement is trying to divert attention away from the true angles they are working or the systems themselves were to blame.
If the computers are part of the problem we can assume they were either not patched and vulnerable to attacks or end users allowed some sort of malware to be installed and siphon data. Either way, this points to a break down in very rudimentary security practices.
This should be a warning to all organizations. Patch your systems, scan them for malware and please, please, please...educate your users. There is no patch for the human factor.
In my last blog post, I discussed the increase in reported breaches caused by insiders. What I didn't tell you was that the loss from those breaches was primarily (49%) embezzlement and related fraud. Only 3% of the records breached were from inside attacks.
This is important to note. The controls you need in place to prevent embezzlement, skimming and other types of fraud may be different than those you need to protect static database records or file type data. Understanding where your attacks are coming from and the target of those attacks can be very useful in selecting and placing controls.
On the flip side, 98% of the records compromised (customer, patient, etc.) were from external sources. Of this, 85% of the records were attributed to organized crime. WOW! I knew the number was high but that was surprising to me.
Makes me second guess my career choice. Here I am tracking organized crime for a living and I don't even get to carry a gun. All kidding aside though. This too should be a wake up call. Knowing where our attacks are coming from is important. Organized crime has the resources, capital and manpower to do significant damage when they want to. The days of implementing simple security controls which are not interconnected and sharing information will come to an end. As the attacks get more complex so must our defenses.
Don't read too much into all of this though. As pointed out in the report, 96% of all breaches were unsophisticated. Start small and work you way into a robust risk management and security program. Like the old addage goes...you only have to be faster than the slowest gazelle. That's if there's only one lion.