Fear Hackers? First invest in an IT security culture change

January 14, 2015 / G C Network / Comments Off on Fear Hackers? First invest in an IT security culture change

Lynn DeCourcey Showcased in ExecutiveBiz

By G C Network | August 9, 2012

Kudos to my colleague Lynn DeCourcey for her recent interview on  ExecutiveBiz.com! Lynn is NJVC vice president and general manager, cyber security. She oversees all aspects of the company’s cyber…

BISNOW Data Center Event Highlight’s Cloud

By G C Network | July 28, 2012

A big thank you to BISNOW and my fellow panel members for an outstanding discussion and very informative event, last week’s Data Center Investment Conference and Expo. The federal marketplace…

GSA Seeks Cloud Brokerage Information

By G C Network | July 18, 2012

GSA is using the RFI process to collect information about alternative models and/or solutions for future cloud acquisition vehicles and processes that further these goals. One emerging concept in cloud…

DoD Cloud Computing Strategy

By G C Network | July 15, 2012

The DoD recently released the department’s formal cloud computing strategy. DoD Cloud Computing Strategy View more documents from Kevin Jackson. In the forward, DoD CIO Teresa Takai said that: “The…

FedRAMP PMO Releases First Set of 3PAOs

By G C Network | May 14, 2012

Late today the FedRAMP Program Management Office released the first list of certified Third Party Assessment Organizations (3PAOs). These companies are accredited to perform initial and periodic assessment of cloud…

FedRAMP Releases Updated Security Assessment Plan Templates

By G C Network | May 8, 2012

Last week the GSA FedRAMP Program Office released the latest version of the cloud computing Security Assessment Plan (SAR) template.  This document is the most recent step toward the Federal…

NJVC® and Gravitant® Announce New Strategic Alliance: Partnership to Benefit Federal Agencies with Powerful Provision and Management of Cloud Services that Unify Multiple Providers

By G C Network | April 4, 2012

Vienna, Va., April 4, 2012 — NJVC®, one of the largest information technology solutions providers supporting the U.S. Department of Defense, and Gravitant®, a provider of cloud brokerage and management…

NJVC® VP and GM, Cloud Services, Kevin L. Jackson to Speak on Cloud Security at 2012 Emerging Threats and Cyber Defense Symposium

By G C Network | March 18, 2012

Vienna, Va., March 15, 2012 — NJVC®, one of the largest information technology solutions (IT) providers supporting the U.S. Department of Defense, is pleased to announce that Kevin L. Jackson,…

NJVC’s Kevin L. Jackson Co-Authors INSA White Paper on Cloud Computing for the Intelligence Community

By G C Network | March 13, 2012

Findings Reflect Insight from More than 50 Cloud Thought Leaders   VIENNA, Va.–(BUSINESS WIRE)–NJVC®, one of the largest information technology solutions (IT) providers supporting the U.S. Department of Defense, announces…

INSA Study on Cloud Computing in the Intelligence Community: Rollout 13 March 2012 | SYS-CON MEDIA

By G C Network | March 10, 2012

(Originally posted by Bob Gourley at CTOvision)         Over the last year I’ve had the pleasure of serving with a team of volunteers from the Intelligence and National Security Alliance…

by
Kevin L.Jackson

 With all the news these days about cyberterrorism and hacking the cloud may seem like the last place you would want to put your precious information. Pew Research has even suggested that cyber-attacks are likely to increase. Some 61% of over 1600 security expert respondents to a recent survey said “yes” that a major attack causing widespread harm would occur by 2025,according to the Pew Research study. The cold hard fact, however, is that fear of the cyberterrorist and hackers, while definitely valid, is mostly misplaced.  I hold this contrarian view, because when you pull back the curtain on many of the recent breaches, you’ll likely see a mirror!

In a recent case, sensitive data including passwords seem to have been stored in the clear which is against all recommended best practices. There also may have been significant involvement from a company insider.  Focusing on application hacks, some of the most devastating have been due to a failure of the application developers to follow some basic best practices for application development.  Another important fact is that most of these breaches were not on cloud service providers.  These successful attacks were on enterprise built and managed IT infrastructures.

Our failure to protect our information and data is mostly due to our less than focused attitude towards cybersecurity.  Policies, procedures and processes play an important part in preventing security incidents but more is needed.  Every organizational employee must realize that they could be an entry point for hackers and be aware of their individual actions.  IT professionals must follow industry standard best practices for application development, network configuration, system configuration, etc. Many of which have gone through multiple iterations over the years. Everyone must also be proactive in their identification and response to cyber threats.  What I am describing is the need for a cultural change.

Creating a risk-conscious and security-aware culture is key to protecting an organization’s information infrastructure and data assets, risk management expert John P. Pironti wrote in 2012 ISACA Journal article. Business leaders must begin viewing information security as a benefit, rather than as an obstacle, and employ threat and vulnerability analysis – rather than fear and doubt – to drive adoption of points of view and controls

So let us first focus on changing our IT security culture. That will give us the edge we need in order to prevail over the cyber underworld.  We also must adopt a “trust-but-verify approach to monitoring and oversight of organizational and employee activities”. This would involve the adoption and expansion of automated security control point monitoring and reporting.  This, in fact, is a strength of any well designed and implemented cloud computing platform.

(This post was written as part of the Dell Insight Partners program, which provides news and analysis about the evolving world of tech. To learn more about tech news and analysis visit Tech Page One. Dell sponsored this article, but the opinions are our own and don’t necessarily represent Dell’s positions or strategies.)

Cloud Musings

( Thank you. If you enjoyed this article, get free updates by email or RSS – © Copyright Kevin L. Jackson 2012)

Follow me at https://Twitter.com/Kevin_Jackson
Posted in

G C Network

Cloud Computing

Cybersecurity