No CSO? Hire one now, advises security expert
- 22 June, 2011 12:12
- Comments
M86 Security vice-president, Jeremy Hulse
Enterprises without a chief security officer or a beefed up security department will be left wide open as hackers use new exploits to strike, warns a security industry expert.
M86 Security vice-president, Jeremy Hulse, told CSO Australia that the reason gaming companies, such as Sega, from which hackers stole personal data of 1.29 million customers over the weekend, had been hit was because of new exploits and malware on legitimate websites that security staff may not be aware of.
"Upwards of 80 to 90 per cent of good websites can host malware and that can be from a period of 20 minutes to 24 hours, but they [hackers] generally don't leave it up for a long period of time," Hulse said.
"All it takes is for someone from Sega or another company to access the website and download the exploit to their internal network."
"For Sony not to have a chief security officer [before the attacks occurred] is quite a startling revelation," Hulse said. He added that M86 had recently come across a large amount of malware that was not caught by signature databases. "From our own studies with customers, the traditional signature based security is not working and they have some exploit that may not have been discovered [by security staff] yet."
Read more about security in CIO’s 2011 Global State of Information Security Survey.
This meant the chief security officer had to be prepared to deal with unknown threats and invest in new security technologies. "People think they're safe but the hackers are saying, 'No, you're not safe' and they are proving it," said Hulse. "Every time someone in security closes a door the hackers are going to be looking for another."
He added that Cloud service providers also needed to "step up" and inform customers what security measures they could offer before data was hosted in a public or private Cloud.
"The message to Cloud providers is that there needs to be an extra level of diligence. You can't apply traditional security to Cloud services, it's a different game." He advised enterprises considering hosting data in the Cloud to quiz their provider about data encryption and find out if the data would be hosted onshore or offshore.
Got a security tip-off? Contact Hamish Barwick at hamish_barwick at idg.com.au
Follow Hamish Barwick on Twitter: @HamishBarwick
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Bookmark this page
- Share this article
- Got more on this story? Email CIO
- Follow CIO on twitter
- TestPro achieves visibility over software defect management - Reducing project risk and improving quality
- Rapid achievement of employee productivity gains in a modern workforce
- Why performance management? A guide for the midsize organisation
- Pathways Advanced ICT Leadership Development Program Brochure and Course Outline 2012
- Sample: Individual Stand Alone Core Competency Report
-
Google Jumps Into Social Bookmarks Game
-
NBN build gaining momentum daily: Quigley
-
Face Time - Interview with John Brennan and Robert DiStefano
-
Monday Grok: Will Siri crack the walls of GOOG?
-
Face Time - Interview with John Brennan and Robert DiStefano
-
Essar Group - Essar Group executives enjoy printing on the move
Essar Group’s senior management are constantly on the road. So it’s not surprising that the company has become a heavy user of mobile computing solutions to enable them to get their job done. The mobility and productivity of executives; enable them to easily print documents from any company location to any company printer using their smartphone. Read more. -
Lost USB keys have 66% chance of malware
Sophos studied 50 USB keys bought at RailCorp's 2011 Lost Property auction in Sydney. The study revealed that two-thirds were infected by malware, and quickly uncovered information about many of the former owners of the devices, their family, friends and colleagues. Disturbingly, none of the owners had used any sort of encryption to secure their files against unauthorised snoopers. -
HP ePrint Enterprise mobile printing solution
The merger of mobile devices and cloud services has become one of the most significant enablers of business productivity and innovation in the past decade. We now hold the power of communicating and computing in the palms of our hands, nearly anywhere business or life takes us. However, one key business process has eluded the mobility movement: printing. Even the most technically enabled business travelers find themselves hunting down print services while on the road and interrupting IT managers when visiting a branch office simply to print a document. But finally, a truly mobile print experience is available—helping enterprises to drive business productivity further. Read more.
Get exclusive access to Invitation only events CIO, reports & analysis. 
Comments
Post new comment