WHO ARE YOU PREACHING TO ANYWAY?...

Google

I recently was privileged enough to be asked to present at a merchant forum in London. Interestingly, the intended recipients had been very much in the driving seat since they had selected the topics themselves. After my previous posts (Part 1 and Part 2) on connecting the dots between information security, risk and fraud, you can imagine my pleasure that I, alongside my fellow speakers, were asked to do just that... A delightfully interactive audience, some very interesting chats at the breaks and the recent buzz about the value of security conferences prompted me to share some thoughts on how actively to engage with your stakeholders and get the results you need...

5 STEPS TO A SUCCESSFUL SOCIAL ATTACK - What's Your Threshold?...

Google

In a previous post, I highlighted that mass marketing fraud against individuals cost the UK economy £3.5 billion in 2011, that is ten time more than the cost of plastic card fraud in the same year, or equivalent to the total fraud losses incurred by the financial services sector in the same period! Sobering perpective, don't you think? We all know that mass marketing fraud is where criminals aim to defraud multiple individuals to maximise revenue by persuading victims to transfer monies in advance in exchange for promised goods, services or benefits. And we all know that this is usually done via mass-communications media (such as telephone calls, letters, emails and text messages) and ranges from foreign lottery/ sweepstake frauds through to ponzi schemes and romance frauds or any other abuse of trust... So, we all know better, don't we?... 

FROM FRAUD TO INFOSEC and vice versa... Part 2

Google

In my previous post, I summarised the UK National Fraud Authority latest Annual Fraud Indicator and how it relates to information security. In this post, I delve further on this connection by further refining the key fraud enablers used to defraud victims of all types. These cut across the fraud landscape and often overlap which poses further challenges for quantifying their impact, but the classification is nonetheless helpful and recognisable.

FROM FRAUD TO INFOSEC and vice versa... Part 1

Google

In my last post, I attempted to give some real business metrics to help secure information security investment. One of those metrics set related to our ability to link infosec to fraud and in this post I’d like to examine the connection a bit further. Lucky for me, the UK National Fraud Authority have just released their 2012 Annual Fraud Indicator (readers beware, it’s 58 pages...), so with my infosec lens, I’ll take you through the report and hopefully give you some more KPIs to think about...

VERIZON DBIR 2012 - some context...

Google

The Verizon DBIR 2012 was released last week and I am sure you have seen a lot of blog posts, articles and tweets on the subject... So let me try and put a different perspective on it: many of you will have heard me say that the DBIR is the “gift that keeps on giving”, and yes, it is! But as with every report, statistics and opinions always have to be put into the right context... The conclusions are not surprising, but there are quite a few little nuggets in the report that are worth examining...

To start with, I am glad to see that the analysis now offers some separate insights in relation to SMEs and larger organisations, as some of the issues can be different depending on size. The case load is also bigger this year (855 incidents compared to 761 in 2010) and known compromised records studied were also greater (3.8 million in 2010 compared to 174 million in 2011 - mostly due to the return of the “mega breaches” in 2011 after a relatively quiet 2010).

THE INFOSEC INVESTMENT EQUATION: CAN YOU SOLVE IT?...

Google

I can’t believe my last post was on 4^th March! I am positively thrilled that my most popular entry so far is the one about incident response... This means that we must be coming to terms with the fact that data breaches are a statistical certainty and how we handle them is what matters. Good news: this means we’ve got the attention we need. Now we need to convert this attention into the investment it requires. External statistics may give you the hook but, as abundant as they are, do not however make it relevant to your business when trying to secure the infosec investment you require...

MANAGE RISK BEFORE IT DAMAGES YOU: PART TWO...

Google

In the previous post, I spoke about the importance of having an asset register and how crucial asset classification is. After all, not many of us have unlimited resources, therefore focusing investment where it matters most is the way to go. Whilst I was thinking about this, the link between changing the CISO traditional attitude and the necessity for risk management became even more apparent and I would like to expand on the trinity of “Asset, Technical Services and Business Need”...

MANAGE RISK BEFORE IT DAMAGES YOU: PART ONE...

Neira Jones on Google+

After my part 1 and part 2 posts on incident response and the last post on cloud computing security, a number of you requested I talk about risk assessments. Since it’s currently my favourite topic, I am more than happy to oblige... First, a few facts:

• Epsilon was breached in the first quarter of 2011. At the time, they built and hosted customer databases for 2,500 well-known brands and sent more than 40 billion emails a year on their behalf.
• Not long after, the Sony breach ended up compromising personally identifiable information for more than 100 million of its customers.

Obviously, for both organisations, customer information is a key asset...