At the last ISSA meeting in Des Moines, we reviewed the 2010 Data Breach Investigations Report published by the Verison RISK Team in cooperation with the US Secret Service (USSS). This was the first year the USSS provided data for the report. The additional information expands the scope of the report and only helps to add credibility. Not that the report wasn't credible in the past, but Verizon's client base is going to favor those larger clients who can pay for their services. The USSS data helps to broaden the scope.
Two things caught my eye this year. The first was the 26% increase in breaches caused by insiders. The addition of USSS data helps reveal what we've known for a long time. Inside threats are very real and we must be prepared to prevent or detect them.
The second interesting fact was that 96% of all breaches were avoidable through simple or intermediate contols. This means it's not difficult or expensive to stop this epidemic. Why does it continue?
I believe the biggest reason is risk management. IT leaders are not proving their case well enough. When asking for budgets to mitigate risk we're not providing the detail or clearly communicating the risk. I'll bet if you asked every executive involved in that 96% of breaches if they would rather have paid for the controls up front you'd get a 100% affirmation rate.
This week make a concerted effort to ensure you are clearly communicating risk to the organization. Don't pull a "chicken little" routine but spend the time to have facts and numbers which show the entire picture to your management. You might be surprised how quickly they respond.
I'll add some additional thoughts on the report next week. If you are local to central Iowa and are interested in joining us at the next ISSA meeting, plesae check out our website at www.issa-desmoines.org
ISSA Des Moines Chapter Meeting
TIME: 11:30 (Please RSVP for a box lunch - cost $9.00)
LOCATION: BCSSI West Des Moines (www.issa-desmoines.org for directions)
TOPIC: "Oracle Security Risks" by Stephen Kost, CTO Integrigy Corporation
For most IT security professionals, the Oracle Database is a security challenge due to the complexity of the database and lack of database experience, especially as these databases often contain an organizations most critical data. This presentation will focus on a few of the highest risk and most difficult to solve security risks in an Oracle Database environment including security vulnerabilities, password weaknesses, and generic privileged access. To highlight the unrealized risk of security vulnerabilities in the database, a number of actual patched and un-patched security issues will be demonstrated. In order to mitigate these risks, resources and best practices for securing an organization's database will be discussed.
Stephen Kost is the Chief Technology Officer for Integrigy Corporation. He has been writing about and presenting on Oracle security and auditing for the past 11 years. He has worked with Oracle products since 1994 in many roles including database administrator, technical architect, IT security auditor, and applications administrator.
The Des Moines chapter of the Information Systems Security Association (ISSA) will be holding our monthly meeting on Monday January 25th from 11:30 to 1:00pm in West Des Moines. Jim Libersky from the Barrier Group will be presenting "Inspecting all 7 OSI layers simultaneously and putting it all together is more important today than ever".
The Barrier Group will also be sponsoring the meeting and providing lunch for all attendees. Please contact me to RSVP and get directions to the meeting location.
Presenter: Jim Libersky
Topic: "Inspecting all 7 OSI layers simultaneously and putting it all together is more important today than ever".
Time: 11:30 - 1:00