DISCUSSION

NRF: Must-Do's for Guarding Against Security Breaches

January 15, 2009Written by Rick Moss

Most tech solutions providers on the exhibit floor at NRF this week appeared, shall we say, stubbornly upbeat about 2009 business. One company principal said he saw no reason at this point in the year for dire pessimism and half-joked that "if everyone acts like it's going to be a bad year, they'll most certainly have one." No one was denying, however, the increased pressure to provide proof of ROI for tech products in such a tough economic climate. That may be a rather simple math equation for vendors that focus on labor efficiencies or optimizing business processes, but in the area of network security - specifically, the safeguarding of customer credit card information and other critical data - potential buyers are dealing with a murkier cost/risk analysis. So with purse strings tightened, CIOs and department heads may be looking at their security situation and trying to figure out how to plug the biggest holes at the lowest cost.

Verizon Business, in their 2008 Data Breach Investigations Report, looked at incidents spanning four years and more than 500 forensic investigations. The breaches they examined included three of the five largest ever reported, and compromised, in total, approximately 230 million records. Retail represented 35 percent of the cases, the largest portion by industry. Eric Brohm, Senior Consultant, Investigative Response, said attention should be drawn to two security targets: involvement in secure systems by third parties, such as suppliers and maintenance companies, and the use of eCommerce applications, which are notoriously vulnerable to hackers. In the first case, Mr. Brohm said vendors are prone to sloppiness in following simple security procedures, often "forgetting to close the door on their way out" once their work with a retailer is done. IT managers could reduce risks tremendously, he said, by simply tightening control of these partners.

Manav Khurana, head of industry marketing for Aruba Networks, described how "unauthorized or accidental devices" (i.e. workers bringing in their own equipment) can bring risks to a wireless network environment, opening a back door to data. In high profile cases, roving hackers with laptops have been known to sit in the parking lots of malls searching for WiFi networks within that aren't properly safeguarded.

PCI standards call for auditing the physical environment of the store or office at least once a quarter to find any wireless devices in use, explained Mr. Khurana. Of course, companies can dispatch a tech with a handheld device to monitor offices, stores and distributions centers, but that can be prohibitively expensive. Aruba offers its AirWave Wireless Management Suite 6.2 (newly released) that works with sensing devices that can automatically check enterprise locations and provide detailed reporting to data center admins. Users can view all enterprise locations on a world map and then, by drilling down, display a floor plan of each location, pinpointing all the wireless devices that exist and revealing which are posing security risks. Further, a PCI Compliance Report feature gives an executive-level summary of all issues across the enterprise in a one-screen report.

Configuresoft products similarly look at workstations and servers in a physical or virtual environment and assess them for various configuration aspects, including security. Again, the cost-savings, according to Dave Shackleford, Director, Center for Policy & Compliance, comes from "giving one administrator the ability, from a single console, to do a lot of different things with all of their systems." Configuresoft designs templates that are updated monthly to make it much easier for admins to keep systems in PCI compliance and do routine chores, such as patch management.

When asked where the biggest holes are in systems, Mr. Shackleford said, "It would amaze you, actually." Rather than sophisticated, complex attacks, "it's really simple things that people lost track of," for example, forgotten old test systems that stayed online, multiple users sharing a common password, or workers storing passwords in plain text files. (Sound familiar?)

Discussion Questions: Do you expect that large retail companies will fall behind in their security procedures and safeguards during the economic downturn? For your IT dollar, where do you think efforts should be concentrated to plug security holes?

Discussion Thread0