|
BY JAMES PILCHER •
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
ERLANGER - So it's Halloween Eve, and I'm in a room full of IT pros at a network security conference, asking what scares them more than anything.
Turns out it's us, the people who actually use the networks. Sure, there are hackers making every effort to crack encrypted security, but they are increasingly turning to us clueless drones to open the door for them.
I know I'm one of "those guys." I'm on the phone with our crack IT department at least twice a month, trying to figure out how to get the latest device or service to work with our network. Just this month, I've struggled to get Windows 7 to hook up to our office wireless (turns out it was a connection issue and nothing with the software). And after two days of trying, I still can't get my tester version of the new Motorola/Verizon Droid that is powered by Google to work with my corporate e-mail.
Plus there is all my twittering, gadgets and widgets and time on Facebook, even though a to-remain-unnamed relative has burned through three company laptops and infected his company's network because of viruses picked up online. I even fell for my first phish (or fraudulent spam that looks legit) on Twitter this week, and it shut me down for a few days.
Given the explosion in social networking, it's no wonder that the pros are as scared as they might be watching the latest Saw movie. All I did was click on what appeared to be a legitimate link from a friend and former co-worker. And there are even more sophisticated attempts, such as a malware program that runs when you try and close a pop-up ad by clicking on the X in the corner.
According to a preliminary study released Friday by Northern Kentucky University's School of Informatics at the METS Center here, internal employees are the leading cause of security breaches, slightly edging hackers.
Overall, 492 national companies and organizations were surveyed. Of those willing to disclose a reason, employees caused 27.4 percent of security breaches, while hackers caused 27.2 percent. Viruses/malicious software was the breach mentioned most often, at 32.9 percent. Staff misuse of the system followed, at 21.5 percent.
In addition, the survey found that only 59 percent of respondents conducted an annual IT audit, or a survey of all the devices and software running on a network.
"It's not just about the technology, it's as much about the people and the processes in place," said Kevin Gallagher, the study's lead co-author, long-time IT professor and an assistant professor in NKU's business informatics department. Only 54 percent of companies had put in place security policies as well as acceptable use and privacy policies. This not only can cause great financial damage, but can harm a company's reputation as well as its relationship with vendors and even regulators.
So what are we the users to do - and how can we help our IT brethren? And how can they stop being the ones who only say NO to new advances, especially when social networking is turning into such a huge business opportunity for many firms?
Enter Patrick Gray, the principal security strategist for mega-tech firm Cisco Systems. A former Baltimore detective, FBI agent and National Security Council operative, Gray said it's all about "collaboration and mobility." End users do need protection from themselves, but more importantly, they need to be trained on what to avoid, he said.
Gray's biggest tip? The old saw that hangs in most newsrooms and is taught to almost all cub reporters - "trust but verify."
For him, it means that I should have Googled the link before clicking on it in that Twitter direct message. It means checking out whether your friend really did change his Facebook profile photo by going to the Facebook site.
In other words, don't just click on a link because someone sent it to you. If it doesn't pass the sniff test, check it out. With our medical histories and records about to go online to join our personal histories and financial information, the stakes are only going to get higher.
The bad guys and hackers "always want to take you somewhere else, and they are getting really, really good at it," Gray said.
And for those IT guys in the room?
"The biggest trend I'm seeing is that companies are still watching the fence, but not watching what is going on inside their own networks," Gray said. "So I say monitor, monitor, monitor. And train your workers to know what to look for, and create what I call a human firewall.
"We rely too much on technology to defeat this stuff, and in the end, it is still about eyeballs and common sense."
James Pilcher is the Enquirer's technology writer. He can be reached at
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
or on Twitter at @jamespilcher.
|
