Loss of confidential data doubles

“The nature of security threats is what’s changing,” says Renee Lalonde, vice-president of CA Canada.

In the past we saw a lot of malware, phishing and keylogging attacks.
Now we’re seeing an increase in internal breaches, mainly from
employees and ex-employees. Five years ago, less than five per cent of
survey respondents identified internal breaches as a key security
challenge ”“ this jumped to 30 per cent in 2006 and 33 per cent in 2008.
Eighty-six per cent of large Canadian organizations said they suffered
an identified security attack in the past 12 months, and of those, 17
per cent reported lost revenue, customers or other tangible assets as a
result.

“The adoption of an enterprise security strategy is very complex,” says
Lalonde. “It’s a maturing market and it’s an evolving market.”
Organizations are now focusing on where a breach is going to come from
”“ how to address it and how to keep their security strategy evolving.
And this is where an Identity Access and Management (IAM) strategy fits
in. I

AM solutions are a key area of investment, according to the
survey, and 50 per cent of Canadian organizations not currently using
an IAM solution plan to roll one out within the next 12 to 18 months.
What that does, said Lalonde, is automate employee access privileges.
If an employee working in HR moves over to the marketing department,
for example, those HR access privileges need to be revoked and new ones
”“ based on the new role ”“ activated.

“It increases controls, it reduces
risk and makes them more secure in terms of protecting their corporate
data,” she says.

But IAM is not problem-free. Sixty per cent of survey
respondents, for example, felt that central management and enforcement
of policies that ensure audit and legal requirements was a problem for
their organization, while 59 per cent felt that the creation,
enforcement and certification of role-based access was problematic.

Securing the right budget is also paramount to an organization’s
success; 40 per cent felt that their security budget was too low, and
only 36 per cent felt confident they could protect their corporate
data.

“There’s a lot of good work going on out there,” says Lalonde.
“We just need to continue with augmenting the strategies they’ve put in
place.”

According to the survey, 70 per cent of companies have already
adopted some form of a security strategy. “We’ve seen that companies
who invest more certainly suffer less,” she says.

Despite this, the
amount of data breaches that involve sensitive and confidential user
information is staggering, said James Quin, senior research analyst
with Info-Tech Research Group. And, in a lot of cases, it’s something
that could very easily be avoided.

“When you look at the nature of most
of the breaches, the vast majority of them would have been really easy
to avoid because the vast majority are still loss of backup tapes and
loss of laptop computers,” he says.

To protect against that,
organizations should be using encryption ”“ that way, when tapes go
missing, or when laptops are stolen, the data on them is inaccessible.
In most cases the problem has to do with human error, rather than
security systems being set up insecurely, although that was the case
with TJX (owner of Winners/Homesense), which suffered a major data
breach last year.

“But TJX was aware of that — they’re on record as
knowing that their security was insufficient and hoping that they just
wouldn’t get caught,” says Quin. “Even then it can be chalked up to
human error in that they knew there was a problem and they did nothing
about it.”

Organizations should also have more rigorous internal
processes in place, and that comes down to separation of duties. “It’s
a pretty fundamental principle in security in that by separating a job,
it becomes significantly more secure, because if a user makes an error,
the second person is likely going to check it,” he says. So it’s that
much harder to steal information or accidentally lose it. But there’s
still a big sense of apathy out there and an unwillingness to spend
more money.

Some managers, for example, would rather cram many jobs
into one than have to hire more staff in order to have a segregation of
duties.

“That’s a very short-term outlook because ultimately the cost
of a breach is way more than the cost of the security solution,” says
Quin.

It’s estimated the TJX breach, for example, could cost up to $1 billion
by the time everything is said and done. The answer, he said, could
come down to legislation. “

Businesses have shown for the most part if
you’re not going to force me to spend the money, I’m not going to spend
it,” he says. “We need to move toward mandatory breach notification and
back it up with significant penalties so not reporting a breach costs
you more than reporting it.”