Ten Lessons CIOs Should Learn From The Biggest Data Breach Of All Times

Do all those news stories outlining the details of the record setting 130 million credit card numbers theft make you feel  glad it was someone else and not your company? That may be a natural reaction, but there are also some lessons to be learned that just might help you stay off the front pages when the next big theft is announced.  Here are ten security lessons to be learned from the theft allegedly masterminded by Albert Gonzalez, 28, of Miami.

1.    Protect the data before the system.  A theft of properly encrypted data is close to worthless. Rather than starting with the system and thinking of how you are going to harden it with password protected access, constantly changed hard to guess logins and virtual network transmission, start with the data. Encrypted data can be transmitted quickly, securely and quickly de-encrypted to provide fast access to business data. Start there.

Resource Library:

2.    Your system is only as secure as your weakest link. You need to constantly monitor and think about system access from the outside in. What do network sniffers tell you about your networks when you are sitting outside in your company’s parking lot? How much information is there about your point-of-sale system on the Internet? Is your guest log-in networks walled off from your vital corporate networks? You don’t have to go out and hire reformed hackers, but you do have to think like a hacker to test security.

3.    Employee access needs to be measured, monitored and maintained. You can trust your employees, but only so far. The fastest way to hack a network is still to get a disgruntled worker to provide access. Sorry, but that’s the truth. Concentrating on getting the employee access badge after they leave is not so important as making sure computer access is also denied.

4.    It is tough to beat the swarm. The bigger the prize, the more hackers will band together for theft. You need to think about securing your data first (see step one) or you will spend your career trying to patch holes as underground digital networks spend all their time discussing your system vulnerabilities.

5.    Data theft is a big business. And a worldwide business. The days of the lone, smart but crazed hacker are over. Stolen data is bought and sold on underground exchanges as sophisticated as any stock trading system. Don’t think that you won’t be a target.

6.    Compliance is a start, not an ending.  One of those unintended consequences of compliance is that companies try to absolve themselves of responsibility by trying to hit the minium compliance guidelines.  Compliance is not security. Security is your responsibility to your customers. Compliance is what a government agency says is the minium necessary.

7.    Cloud computing doesn’t make data theft easier or harder. Cloud computing just makes data security different.  You need to be absolutely clear in your understanding of what a Software as a Service vendor is offering and willing to put in a service agreement regarding security. The same attributes you would want in your company’s private network need to be part of the service agreement with any cloud computing vendor.

8.    You’ve got friends.  While no CIO is going to detail how they have approached security at their company, they will be willing to give you some advice and guidelines.  However, they won’t be providing those suggestions on a public, social network. Get to know CIOs in your industry, region and top CIOs everywhere.  There is still a great role for CIO face to face events, but the biggest value is often in the after dinner conversations.

9.    Technology is changing and you need to change also.  The solutions that might have been discarded a few years ago (encryption) have been upgraded and enhanced. You need a technology team at your company or at your systems integrator who are always evaluating new approaches and technologies.  You need to stay ahead of the tech curve or risk getting wiped-out.

10.  Your job is going to get harder. Social networks are great, but they are also potential security loopholes. You need to set some firm guidelines on what information, documents and access points are absolutely off limits to the social networks involving your company and employees.