Fear Hackers? First invest in an IT security culture change

Animoto = Automated Imagery PED

By G C Network | December 3, 2008

Over the past two days, I’ve spent quite a bit of time with Stevie Clifton, Co-founder & CTO of Animoto. Besides being one of the coolest things I’ve seen in…

World Summit of Cloud Computing 2008

By G C Network | December 1, 2008

Video by Animoto using cloud computing technology. (Done in 20 minutes for free)!! Follow me at https://Twitter.com/Kevin_Jackson

2008 World Summit of Cloud Computing

By G C Network | November 30, 2008

After a uneventful trip , I’m now in Israel for the World Summit. With over 500 people expected to attend, it promises to be an exciting time. Unfortunately, I arrived…

CloudCamp Federal ’08

By G C Network | November 28, 2008

| Get your Presentation Pack Follow me at https://Twitter.com/Kevin_Jackson

NCOIC Cloud Working Group

By G C Network | November 26, 2008

The NCOIC will be holding a cloud computing working group on December 10th during plenary session in Costa Mesa, CA. The session focus will be “Requirements for Enterprise Cloud Computing”.…

IBM Rating Clouds

By G C Network | November 25, 2008

According to Cloud Computing Journal, and Red Herring, IBM will now rate other cloud providers. Using the “Resilient Cloud Validation” program, IBM will validate their facilities, applications, data, staff, processes…

Cloud Computing vs. Cloud Services

By G C Network | November 24, 2008

In September, Frank Gens provided an excellent overview of the the new “Cloud Computing Era”. In preparing for an upcoming talk, I re-read the post and found myself appreciating it…

Inaugural “Inside the Cloud” Survey

By G C Network | November 21, 2008

Appistry and CloudCamp recently released results from the first “Inside the Cloud” survey. Key takeaways were: Amazon perceived as cloud leader, with twice as many votes as Google Infrastructure providers…

FIAC Presentation Mentions Cloud Computing

By G C Network | November 20, 2008

At the recent Federal Information Assurance Conference, Bob Gourley, CTO Crucial Point LLC, and former Defense Intelligence Agency CTO, recently provided his views on the state of Federal IT. His cloud…

Sun Cloud Czar

By G C Network | November 19, 2008

Earlier this week it was announced that, Sun, Senior Vice President, Dave Douglas, was appointed to lead the Company’s cloud computing efforts. A JDJ Article also stated that, in addition to becoming Sun’s…

by
Kevin L.Jackson

 With all the news these days about cyberterrorism and hacking the cloud may seem like the last place you would want to put your precious information. Pew Research has even suggested that cyber-attacks are likely to increase. Some 61% of over 1600 security expert respondents to a recent survey said “yes” that a major attack causing widespread harm would occur by 2025,according to the Pew Research study. The cold hard fact, however, is that fear of the cyberterrorist and hackers, while definitely valid, is mostly misplaced.  I hold this contrarian view, because when you pull back the curtain on many of the recent breaches, you’ll likely see a mirror!

In a recent case, sensitive data including passwords seem to have been stored in the clear which is against all recommended best practices. There also may have been significant involvement from a company insider.  Focusing on application hacks, some of the most devastating have been due to a failure of the application developers to follow some basic best practices for application development.  Another important fact is that most of these breaches were not on cloud service providers.  These successful attacks were on enterprise built and managed IT infrastructures.

Our failure to protect our information and data is mostly due to our less than focused attitude towards cybersecurity.  Policies, procedures and processes play an important part in preventing security incidents but more is needed.  Every organizational employee must realize that they could be an entry point for hackers and be aware of their individual actions.  IT professionals must follow industry standard best practices for application development, network configuration, system configuration, etc. Many of which have gone through multiple iterations over the years. Everyone must also be proactive in their identification and response to cyber threats.  What I am describing is the need for a cultural change.

Creating a risk-conscious and security-aware culture is key to protecting an organization’s information infrastructure and data assets, risk management expert John P. Pironti wrote in 2012 ISACA Journal article. Business leaders must begin viewing information security as a benefit, rather than as an obstacle, and employ threat and vulnerability analysis – rather than fear and doubt – to drive adoption of points of view and controls

So let us first focus on changing our IT security culture. That will give us the edge we need in order to prevail over the cyber underworld.  We also must adopt a “trust-but-verify approach to monitoring and oversight of organizational and employee activities”. This would involve the adoption and expansion of automated security control point monitoring and reporting.  This, in fact, is a strength of any well designed and implemented cloud computing platform.

(This post was written as part of the Dell Insight Partners program, which provides news and analysis about the evolving world of tech. To learn more about tech news and analysis visit Tech Page One. Dell sponsored this article, but the opinions are our own and don’t necessarily represent Dell’s positions or strategies.)

Cloud Musings

( Thank you. If you enjoyed this article, get free updates by email or RSS – © Copyright Kevin L. Jackson 2012)

Follow me at https://Twitter.com/Kevin_Jackson
Posted in

G C Network