April 2017 Digital Edition

Click Here

March 2017 Digital Edition

Click Here

Feb. 2017 Digital Edition

Click Here

January 2017 Digital Edition

Click Here

Nov/Dec 2016 Digital Edition

Click Here

Oct 2016 Digital Edition

Click Here

Technology Sectors

Market Sectors

2013 cyber security forecast

Alan Brill


By Alan Brill and Timothy P. Ryan 


Kroll Advisory Solutions has released its 2013 Cyber Security Forecast, highlighting the most unexpected cyber issues that organizations will confront in the year ahead, as well as best practices for addressing those issues:

1. Vampire data: Organizations get bitten by the data they never knew they had.

Data exists in myriad locations and in a multitude of formats within an organization, and we’ve seen too many instances where clients just didn’t know that the data existed until they experienced an attack. We call this “vampire data” -- basically, any data that can’t seem to be killed, but comes back to drain the life out of the organization.

Examples include backup tapes and archiving that go back decades (even though they were scheduled to be destroyed); emails that should be destroyed after 90 days, but exist indefinitely on employees’ desktops; and material that has been copied to portable or Cloud storage without the organization’s consent or knowledge. While it may not be a sanctioned copy of data, it may still be a discoverable one, and it can certainly be stolen or lost, causing a data breach that just shouldn’t have happened.

What organizations can do now to prepare: Take a data inventory, classify it by confidentiality or sensitivity level, and handle it accordingly. Only allow users to access the data they need and provide employees with regular data-handling training to avoid unnecessary data propagation or transmission. Investigating a breach of vampire data can put significant strain on internal resources, so it is a good idea to engage an outside consultant to help you determine what was lost.

2. Forgotten forensics: Organizations gain new appreciation for data forensics in the wake of a breach.

Like any applied science, forensics requires certain real-world tools and applications in order to be successful. During a forensics investigation, we sometimes have limited resources at our disposal because organizations aren’t properly logging or documenting their activities. As a result, organizations will spend more money to discover whether the breach occurred and what was lost, and may wind up sending notifications based on reasonable assumption, rather than concrete evidence of exposure. As organizations come to understand the reputational and financial importance of forensics investigations, we will see a shift.

What organizations can do now to prepare: Turn on your logs and make sure they are retained long enough to be useful. But it is also helpful to perform a security assessment and train key employees in the basics of immediate breach response. Those employees who are most likely to be first responders in a breach should know how to respond without wiping out vital evidence needed to understand the incident, or if applicable, meet the requirements set by the cyber insurance policy carrier.

3. Hackers Out for the kill: Hackers aren’t out to steal your data, They’re out to destroy your company.

It used to be that insider attacks were generally perceived as the most malicious -- if a breach was perpetrated by a malicious insider, especially one with an axe to grind and easy access to sensitive information, the results could be pretty nasty. But the latest batch of cyber attackers are delving deeper into the cyber warfare and cyber terrorism space. They have a rapidly evolving ideology and agenda -- namely, they are coming to destroy the secure network, erase pertinent data, wreak havoc with physical equipment, and ultimately take your company down. Kroll worked on a handful of very large engagements in 2012 that involved this type of attack, and in each case, the company was hit by an attack that destroyed data on a large number of machines throughout the global enterprise.

What organizations can do now to prepare: While this seems like a problem strictly for large enterprises, players are already beginning to develop and deploy these tactics on organizations of all sizes and in all industries. These groups may be looking for profit, perhaps holding your data for ransom, but the end result is still the same, and the stakes are high. Make sure you have a backup plan. Don’t assume that because you have backup tapes that you have a plan for restoration. If you are outsourcing IT functions, make sure your third parties understand their role in getting you back up-and-running -- and you’ll want to test their ability to do so.

4. The gift of gab: The luxury of nondisclosure is a thing of the past.

While the academic debate on this issue will continue in 2013, we’ll start to see more and more organizations speaking up -- even when the loss is not personally identifiable or protected health information (PII and PHI). In some cases, nondisclosure will simply not be an option. For instance, if you experience a data destruction attack, everyone will know once your systems are down. In other instances, the stakes will be too high; the threat will be insurmountable without help from security consultants and government entities. We’ve already seen an increase in the number of breaches where clients have been notified by a government entity or security firm that they’ve lost sensitive data. We expect to see that trend only accelerate in 2013.

What organizations can do now to prepare: It is becoming increasingly important to contract with outside resources -- an investigation and forensics partner, a privacy law firm, and/or a breach notification partner. When a security incident occurs, having providers in place to assist with the investigation, advise on current legal requirements, and prepare a response should it experience a breach of PII will save time and expense for the affected organization.

f we’ve learned one thing from the changing climate of data security in 2012, it is that 2013 will definitely not be a time to employ the same old tactics. Boards of directors are becoming more engaged on this subject, in part because it deals with corporate risk and also because the regulators are on the lookout. 2013 will require a review of information security governance, identification of information risk and controls, and preparation for the inevitable: a breach of sensitive data, a looming threat for every organization.

Alan Brill is a senior managing director for Kroll Advisory Solutions. Timothy P. Ryan is a managing director with Kroll Advisory Solutions.


Recent Videos

HID Global is opening the door to a new era of security and convenience.  Powered by Seos technology, the HID Mobile Access solution delivers a more secure and convenient way to open doors and gates, access networks and services, and make cashless payments using phones and other mobile devices. ...
Mobile device forensics can make a difference in many investigations, but you need training that teaches you how to get the most out of your mobile forensics hardware and software, and certifies you to testify in court. Read this white paper to learn how to evaluate mobile forensics training...
PureTech Systems is a software company that develops and markets PureActiv, its geospatial analytics solution designed to protect critical perimeters and infrastructure.  Its patented video analytics leverage thermal cameras, radars and other perimeter sensors to detect, geo-locate, classify, and...
PureTech Systems is a technology leader in the use of geospatial video, focusing on perimeter security.  When combining geospatial capabilities with video analytics and PTZ camera control, managers of critical facilities can benefit by allowing the video management system to aid them in the process...