Mr. Goldmann

Security & Safety

How to Manage the Growing Threat to Confidential Information Security

By Peter Goldmann, President, FraudAware Hospitality

The news headlines are chock full of accounts of massive volumes of confidential corporate information being stolen, including customer credit card data, medical records, Social Security numbers, corporate trade secrets, trademarked and copyrighted intellectual property and more.

The results of these attacks, though hard to accurately measure in dollars and cents, are nonetheless devastating for both the victimized company and the customers, employees and contractors whose personal identifying data is stolen.

In the largest theft of confidential information ever, the apparel retailer, TJX Inc., had its databases attacked by outside hackers to the tune of over 45 million retail transaction records, involving countless numbers of credit and debit card files. The company may be counting its losses for years to come, as...

And then, of course, there is the innocent consumers whose stolen credit card information is used to commit identity fraud and are forced to endure the painstaking and often frustrating process of restoring the integrity of their credit histories.

What Can Be Done?

The TJX incident is just one of untold thousands of similar cyber-attacks hitting companies in all industries, including hospitality. While there is no silver bullet to unfailingly safeguard data sought by hackers-both outside and within the organization-there are some essential steps all companies should take to at least minimize their vulnerability to information theft.

For example, as Kevin Beaver, an information security consultant with Principle Logic LLC points out, it is essential that IT management continually assess information security risks so they know exactly what to protect,

Because high-tech crime is a fast-moving target, changing continuously as malicious hackers and fraudsters innovate new ways to penetrate security defenses, Beaver urges companies to reinforce their highest-value targets first. He recommends using the 80/20 rule to allocate security resources-optimizing the security of the organization's most critical information assets, rather than attempting to reduce risk for the entire organization's confidential data, including portions for which the risk of loss is very low.

Next Steps

Gideon Rasmussen a Charlotte, NC-based certified information security professional (CISP) recommends the following security "audit" steps after the organization's confidential data has been prioritized...

Step 1: Take a detailed "inventory" of who inside (and outside) the organization has access to sensitive data and determine whether all of those accesses are absolutely necessary.

If, for example, an employee with limited need for proprietary data has unlimited access to it, your IT department should implement immediate restriction-or outright denial of that individual's access.

As part of this process, companies should rigorously monitor systems and insiders to detect unauthorized activity involving confidential data. Specifics:

Step 2: Ensure that access privileges are systematically rescinded http://www.issa.org/cgi/issaopnpg.php?page=journals/2006_June/J0606011.pdf when employees leave the company, or when their responsibilities change.

Helpful: Obtain a list of current personnel from the human resources department and compare it to active system accounts, such as network accounts, remote access and local accounts on servers.

Stand-alone applications-including voice-mail, company directories, etc.-should be regularly checked as well.

Step 3: Review physical security access logs. Pay particular attention to employee visits to the office after regular business hours and on the weekends. If suspicious activity is detected, cross- reference video surveillance feeds and system audit trials.

Not a One-Shot Excercise

Rasmussen points out that too many organizations conduct these information security "audit steps" only once a year-or even less frequently.

The danger in this, he says, is that with employees constantly leaving and new ones being hired... access requirements shifting due to changing business priorities...and technological and regulatory standards constantly altering the procedural standards for optimizing information security, "one-shot" audits can turn out to be all but a waste of time.

To maximize data security, Rasmussen recommends conducting these steps at least quarterly. Ideally, information security activities should be conducted continuously, with much of the work being done by automated auditing software-in the same way that compliance experts recommend for financial auditing.

For practical guidance on continuous auditing, download a copy of the Institute of Internal Auditors' GTAG Continuous Auditing Guide at www.theiia.org

Focus on the Insider Threat

While the TJX breach has become the poster child for external attacks on confidential corporate data, information security experts agree that the threat of data theft by an organization's own personnel is at least equally serious.

Steven Branigan, a former police officer who now heads CyanLine LLC, a leading provider of computer forensics and network security services, aptly points out that "employees, ex-employees or contractors who were terminated, or didn't get the raise or promotion or contract they deserved often feel justified in exacting revenge on the 'unjust' organization. These hackers sometimes steal company trade secrets...confidential customer information, such as credit card numbers...or copyrighted material such as software, published content or other intellectual property."

Further insight into spotting potential insider info-thieves comes from Dr. Eric Cole, Chief Scientist for Lockheed Martin Information Technology. His research has found that most of these criminals share certain distinct behavioral and personality traits:

Reality: Most info-attackers are not high-tech whizzes. But--they don't have to be. Many companies simply aren't geared up to detect or prevent insider information crimes, so low-tech employees who understand the organization's vulnerabilities can all too easily commit costly information crimes without much technical know-how.

For example, says Cole "The easiest ways to steal, destroy or sabotage confidential information are by copying, E-mailing or deleting files from the server. Insider attackers need only a portable USB drive, a hotmail E-mail account or the E-mail address of a competitor to do serious criminal damage."

More likely: An internal information criminal is far more likely to be an employee with many years of service at the organization...who has worked in various jobs on his or her way up the hierarchy...and is viewed as a trusted, loyal team player.

The problem, says Cole, is that "Too often, these individuals become disgruntled or jaded at some point along the way. While they're not hardened criminals, or even bad people, they come to believe that they are "owed" something by the organization and when the opportunity to steal or destroy valuable information in order to "get back" at the organization comes along, they grab it."

Cole cautions, however, that if insider information crime is suspected, it is important not to let employees' job descriptions or appearance prejudice an investigation. "Analyze the facts of the case, " urges Cole, "and never discount the possibility that the guilty party may be someone you least expect to break the law."

If necessary, he suggests, bring in outside investigators to assist with the probe. You want to avoid accusing the wrong individual of an information crime-not only because it can have legal repercussions and undermine employee morale- but also because doing so means that the real perpetrator is still at large. Once it is known that you're investigating the attack, he or she will either stop or become even stealthier, thereby reducing the company's chances of ever catching the real perpetrator.

To bolster the company's information security policy, incorporate detailed information about the financial and non-financial seriousness of crimes related to proprietary information. Company E-mails, formal training or other communications are among the many ways to raise awareness of the potential consequences of information crimes.

To catch these violators, the company must have in place confidential, anonymous hotlines and clear policies prohibiting retaliation against whistleblowers. These factors, says Cole, are all part of a corporate culture in which people share responsibility for safeguarding the company's information assets.

Such a culture not only consistently and emphatically communicates the company's policies governing confidential information security, but also calls for thorough training of all employees in the practices and procedures for maximum information security and encourages employees at all levels to ask questions, seek guidance and report security deficiencies wherever they find them.

Peter Goldmann is the Developer of FraudAware/Hospitality, the first on-line fraud awareness training course for hospitality managers, supervisors and line employees. He is is the publisher of the monthly newsletters, White-Collar Crime Fighter and Cyber-Crime Fighter. His company, White-Collar Crime 101 LLC also is the developer of FraudAware/Hospitality, a customizable Web-based fraud awareness training course for managers, supervisors and line employees. He is a member of the Association of Certified Fraud Examiners, and The International Association of Financial Crimes Investigators. Mr. Goldmann can be contacted at 203-431-7657 or pgoldmann@wccfighter.com Extended Bio...

HotelExecutive.com retains the copyright to the articles published in the Hotel Business Review. Articles cannot be republished without prior written consent by HotelExecutive.com.