OTA: over 90% of data breaches in the first half of 2014 “could have been avoided”

January 22, 2015 by Neil Ford  

The Online Trust Alliance (OTA), the global non-profit organisation “with the mission to enhance online trust and empower users, while promoting innovation and the vitality of the internet”, released its 2015 Security & Privacy Best Practices and Security & Privacy Risk Assessment guides yesterday.

According to its analysis of “nearly 500 breaches reported in the first half of 2014”, more than “90% could have been avoided had simple controls and security best practices been implemented.”

OTA recommends the following best practices:

-      Enforce effective password management policies.

-      Employ least privilege user access (LUA) to provide protection against malicious network behaviour and system faults.

-      Deploy multi-layered firewall protection; use up-to-date antivirus software; enable patch management for operating systems, apps and add-ons; disable auto-running of removable media; and employ whole-disk encryption.

-      Conduct regular penetration tests and vulnerability scans.

-      Require email authentication on all inbound and outbound mail streams to detect phishing and spoofed emails.

-      Implement a mobile device management programme.

-      Continuously monitor the organisation’s infrastructure security.

-      Deploy web application firewalls to mitigate common threats, as identified by OWASP.

-      Only permit authorised devices to connect wirelessly to the network and encrypt communications with wireless devices.

-      Implement Always On Secure Sockets Layer (AOSSL) for all servers requiring login authentication and data collection to prevent data sniffing.

-      Review server certificates for vulnerabilities and risks of domain hijacking.

-      Develop, test, and continually refine a data breach response plan.

Organisations that are concerned about information security and want to implement OTA’s recommendations will be pleased to learn that there is a single best-practice solution that can be employed to address all of the points listed above.

ISO 27001, the international information security standard, sets out the requirements of an enterprise-wide information security management system (ISMS) that encompasses people, processes and technology.

IT Governance ISO 27001 packaged solutions – Get A Little Help

IT Governance’s recently relaunched ISO 27001 packaged solutions provide ISMS implementation resources for all organisations concerned about information security. The ISO 27001 Get A Little Help Package contains three international standards, two training course places, two essential implementation guides, a comprehensive documentation toolkit, the ISO 27001-compliant risk assessment software tool vsRisk, and two hours’ Live Online consultancy support.

It is aimed at organisations that already have some management system expertise and an initial understanding of information security management, as well as the necessary available internal resources and a corporate culture of using best-in-class tools and skills to accelerate learning and implementation while still essentially following a do-it-yourself approach to project management.

Case Study— Nashua Mobile tender to customer for VOIP services

Description of business need

You do not know what you do not know. Many VOIP service providers do not have an accurate picture of their customers [or potential customers] monthly call patterns.

For a service provider of VOIP services to put together a proposal on VOIP, the service provider must understand the customers business need 100%. This includes all TYPE’s of expenditure [Telkom/cell phones/inter branch] per branch, including

· Cost implications of inter branch calls
· Validating the business need for VOIP
· Monthly call patterns in Talktime, Billed Minutes and Rands.
· Number of concurrent calls per branch
· Effective Rates for Peak and Off Peak times

DataRoom provided Nashua Mobile and their customer with -

· A complete set of reports highlighting the precise business need across the group of companies and all its branches. The DataRoom “Telecoms Report Suite” was used.
· An accurate analysis of call pattern information that allowed
· the configuration of infrastructure per branch
· An understanding of call patterns per branch
· A detailed proposal to their customer for a nationwide VOIP solution over multiple companies and branches, over a large geographical area

Situation

In May 2007, Nashua Mobile approached DataRoom for assistance in tendering for a VOIP solution to an existing LCR client. The service provider was the incumbent supplier of LCR [least cost routing of cell phone calls] and cell phones.

Other service providers were offering their customer VOIP and Nashua Mobile wished to differentiate them against their competition, understand the business need accurately and ensure that they retained the customer. They ran a very real risk of losing their customer and the LCR revenue to a competitor if they did not address the VOIP requirement.

The service provider and their sales team did not have the capacity to perform the required call analysis and understood the importance of coming to grips with the customers business need. Furthermore, they did not have the skill set / tools to professionally analyse and understand the existing environment.

Solution

Using supplier billing and call detailed records, a thorough analysis of all call patterns by company, branch, region and all TYPE’s of expenditure was completed using DataRoom’s Telecom Report Suite.

Benefits

On completion of the analysis performed by DataRoom, the Nashua Mobile sales teams had a thorough understanding of the current call patterns for total voice and infrastructure requirements. The tender was put together based on the understanding of their customers business need.

There was no guess work involved in understanding the infrastructure requirements.

The sales team and the product manager understood exactly how many concurrent calls needed to be catered for each company, branch and TYPE of spend based on historical call patterns over the last 3 months.

Furthermore, by re-rating each call made over the last 3 months on the new VOIP rate, the service provider could accurately predict the RAND savings going forward and the resultant return on investment for his client.

Through the skills/tool set provided by the DataRoom reporting, this service provider was able to be viewed by the customer as specialist in voice communication [including VOIP] and no longer just a LCR / PBX supplier.

The customer knows uses Nashua Mobile for all their voice requirements and are expanding the initiative to other companies in the group.