OTA: over 90% of data breaches in the first half of 2014 “could have been avoided”

January 22, 2015 by Neil Ford  

The Online Trust Alliance (OTA), the global non-profit organisation “with the mission to enhance online trust and empower users, while promoting innovation and the vitality of the internet”, released its 2015 Security & Privacy Best Practices and Security & Privacy Risk Assessment guides yesterday.

According to its analysis of “nearly 500 breaches reported in the first half of 2014”, more than “90% could have been avoided had simple controls and security best practices been implemented.”

OTA recommends the following best practices:

-      Enforce effective password management policies.

-      Employ least privilege user access (LUA) to provide protection against malicious network behaviour and system faults.

-      Deploy multi-layered firewall protection; use up-to-date antivirus software; enable patch management for operating systems, apps and add-ons; disable auto-running of removable media; and employ whole-disk encryption.

-      Conduct regular penetration tests and vulnerability scans.

-      Require email authentication on all inbound and outbound mail streams to detect phishing and spoofed emails.

-      Implement a mobile device management programme.

-      Continuously monitor the organisation’s infrastructure security.

-      Deploy web application firewalls to mitigate common threats, as identified by OWASP.

-      Only permit authorised devices to connect wirelessly to the network and encrypt communications with wireless devices.

-      Implement Always On Secure Sockets Layer (AOSSL) for all servers requiring login authentication and data collection to prevent data sniffing.

-      Review server certificates for vulnerabilities and risks of domain hijacking.

-      Develop, test, and continually refine a data breach response plan.

Organisations that are concerned about information security and want to implement OTA’s recommendations will be pleased to learn that there is a single best-practice solution that can be employed to address all of the points listed above.

ISO 27001, the international information security standard, sets out the requirements of an enterprise-wide information security management system (ISMS) that encompasses people, processes and technology.

IT Governance ISO 27001 packaged solutions – Get A Little Help

IT Governance’s recently relaunched ISO 27001 packaged solutions provide ISMS implementation resources for all organisations concerned about information security. The ISO 27001 Get A Little Help Package contains three international standards, two training course places, two essential implementation guides, a comprehensive documentation toolkit, the ISO 27001-compliant risk assessment software tool vsRisk, and two hours’ Live Online consultancy support.

It is aimed at organisations that already have some management system expertise and an initial understanding of information security management, as well as the necessary available internal resources and a corporate culture of using best-in-class tools and skills to accelerate learning and implementation while still essentially following a do-it-yourself approach to project management.

Vodacom takes on Telkom | ITWeb

By Nicola Mawson, ITWeb senior journalist.

Johannesburg, 29 Jun 2010 Read in this storyBattle lines drawnBusiness solutionFail safeSmart moveSA's largest mobile company, Vodacom, is taking on its former parent, Telkom, as it launches an ADSL service into the corporate sector – with plans to eventually cut out Telkom's copper last mile.

The company could also try and usurp Telkom's dominant position in the residential market, but has yet to make an announcement as to whether it will launch fixed broadband to homeowners.

Vodacom's venture into fixed broadband could further unsettle Telkom, which has pinned some of its growth plans on launching a mobile offering sometime this year. Telkom has seen a steady decrease in the number of voice only fixed-lines, although its data penetration is growing.

Telkom reported flat revenue growth for the year to March, and outgoing CEO Rueben September emphasised the importance of mobile as a strategy to defend and grow its local market share. He said the company was aware of the risks of launching as SA's fourth mobile operator.

Battle lines drawn

Now Vodacom has taken the battle for market share onto Telkom's turf, in a move that could herald the first step towards fibre to the home.

Gary Hart, executive head of Managed Network Services at Vodacom Business, says the company will eventually be fighting Telkom for market share on Telkom's turf, but is currently reliant on the fixed-line operator for use of its last mile.

He explains that the offering will run on Telkom's copper access network for now, but will eventually move onto fibre, cutting Telkom out of the loop. Hart says, however, this will require economies of scale, which will be achieved as more fibre is rolled out to large corporations.

Vodacom has 11 metro Ethernet rings around the country, which it deployed for mobile backhaul. The company is now in the process of linking these rings to each other, and is using the infrastructure, which is already in the ground, to provide the ADSL backbone, explains Hart.

In addition, once the company moves its mobile network onto LTE, an upgrade to the current 3G offering, additional broadband offerings will become available, says Hart.

In future, Vodacom will expand its ADSL offerings to residential areas, although there are currently no specific dates or details available. “The launch of a residential ADSL service would be a logical response to Telkom's entrance into the mobile business,” says Richard Boorman, Vodacom executive head of corporate communications.

Business solution

Vodacom Business launched a premier business ADSL service, offering capped and uncapped offerings with speeds up to 10GB. Hart explains that the offering includes a voice over IP solution (VOIP), and businesses that buy the service are given a Vodacom 087 number.

Customers will also be able to port their landlines over to Vodacom once the company's application to the Independent Communications Authority of SA has been approved. In addition to voice calls and data, Vodacom will offer video services, says Hart.

The capped offering is available in monthly 1GB, 3GB, 5GB and 10GB packages, which are targeted at small and medium or home run businesses with a variety of options. Larger companies are offered uncapped broadband, with speeds of up to 4 096Kbps.

Both the capped and uncapped options come with a choice of being shaped or unshaped and come standard with an ADSL modem and a VOIP-enabled phone, which provides for landline-based IP calls to be made over ADSL, offering up to a 30% cost reduction on fixed-line calls.

Companies also have the option to bundle traditional voice, Internet access and VOIP into a single platform using Vodacom's private branch eXchange solution.

Fail safe

Vodacom Business uses a blend of SAFE, SAT3 and Seacom cables for international connectivity, which ensures built-in, automatic restore functions in the event of a break in any one of these cable systems.

In addition, should a Telkom cable break or be stolen, Vodacom's uncapped solution includes an optional 3G/HSPA failover.

If the line fails, the online business functions will automatically be rerouted on Vodacom's 3G and HSPA network, and put back onto ADSL once the service is restored.

Smart move

Chris Gilmour, Absa Investments analyst, says Vodacom is beating Telkom to the punch by launching ADSL before Telkom can offer businesses a mobile solution bundled with its current services.

“Telkom has been neglecting its own backyard, and other people like Vodacom have come in and are eating their lunch,” says Gilmour. He says Vodacom's strategy is “very clever” and is likely to make inroads into Telkom's most lucrative market, which is the corporate customer.

“At long last, we are starting to see the benefits of enhanced broadband availability. The more entrepreneurial companies like Vodacom are grasping the opportunity with both hands,” adds Gilmour.

Vodacom's ADSL offering;

Capped prices*
1GB at R59 p/m
3GB at R169 p/m
5GB at R279 p/m
10GB at R549 p/m

Uncapped pricing*
384kbps @ R1 132 p/m
512kbps @ R1 588 p/m
4096kbps @ R2 842 p/m

*Excluding ADSL line rental, see Web site for more details