& cplSiteName &

Verizon: Security Compliance Coming Up Short

Carol Wilson
2/7/2014
50%
50%

If recent, highly publicized data breaches weren't proof enough, a report that Verizon Enterprise Solutions will issue next week shows businesses aren't doing an adequate job of maintaining compliance with security standards by constantly testing their systems.

Verizon issues two annual reports per year, one tracking data breaches and another detailing compliance with the Payment Card Industry (PCI) Data Security Standard. The PCI report, due out next Tuesday, shows that businesses are treating PCI DSS compliance a bit too casually. While a growing number (82%) of businesses meet overall PCI standards, less than one-quarter are doing the required regular security testing and even fewer (17%) the security monitoring that would detect breaches and enable a fast response. (See Verizon Finds Credit Card Security Iffy, Verizon Breaks Down Security Threats by Industry Segment, and Verizon: Hackers Still Using Old Tricks.)

While Verizon isn't commenting on the specific breaches at Target and Nieman-Marcus, that lack of ongoing testing and monitoring would explain why data breaches persisted for weeks or even months before being detected and stopped. "We can see an improvement overall across all industries in PCI compliance, but we also see that security testing is not performing well," says Ciske Van Oosten, an architect of the upcoming report and part of Verizon's PCI Security Practice, which does security assessments, program and project management, and risk assessments for businesses. "We know there is now increased awareness of data breaches but whether that leads to doing right things in terms of internal and external integration testing, we will have to see." (See Verizon Ventures into Risk Management.)

Because attacks are growing both in size and sophistication, and because newer attacks don't yet have signatures to make them detectable by malware prevention programs, it's important that businesses do daily testing and monitoring to maintain PCI compliance, Van Oosten says. Generally following a breach, a review of the invaded company's data logs show red flags indicating suspicious activity that could have been detected earlier and addressed, he adds. But even small companies handle such a volume of data that only automated daily monitoring would be effective.

"The PCI standard requires you to remain up to date -- on a daily basis with log monitoring, and that process needs to be automated, even if you have only a single server," Van Oosten comments. "Compliance in not just reducing the chance of being breached, it can help you respond sooner to it and contain the cost of a breach. But that means ongoing testing."

Most breaches today are detected by law enforcement or third parties, not by the businesses themselves, which catch less than 10% of the breaches.

Companies can also improve their chances against data breaches by using up-to-date software systems, by encrypting information at its point of entry into a company's network, and by maintaining separate secure status for the encryption keys. The latter approach would prevent most data captured in a breach from being used in a criminal way, unless those who steal the data are able to steal the encryption keys separately, he adds.

— Carol Wilson, Editor-at-Large, Light Reading

(15)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
Page 1 / 2   >   >>
mendyk
50%
50%
mendyk,
User Rank: Light Sabre
2/11/2014 | 8:52:17 AM
Re: It's all about the Benjamins
Seven -- Agreed -- we should be less concerned about individual dumb users than about people on the inside, whether dumb or corrupt. As your examples point out, internal stupidity and criminality are potentially orders of magnitude more damaging than someone hacking one external user's weak password. I've been hacked twice on credit card accounts, and both times it was obvious that the hacking was an inside job. And of course, there's Mr. Snowden.
MKassner
50%
50%
MKassner,
User Rank: Light Beer
2/11/2014 | 7:50:55 AM
What would constant review have accomplished?
Monday morning quarterbacking is always easy. I dare say that when humans are involved, the bad guys will always have the upper hand. To say that more monitoring would help is a cheap shot by Verizon. What happened to Target would have happened to any company in the retail business. 

Quite simply the bad guys have the money to hire creative pen-testers, and all it takes is one crack to get in. Whereas, the good guys have to do battle against EVERY possible crack. 

 

 
pdonegan67
50%
50%
pdonegan67,
User Rank: Light Sabre
2/11/2014 | 5:00:33 AM
Re: It's all about the Benjamins
I guess it all depends what you call "a lot".

ESET is a credible outfit and they have presented evidence below of some subscribers becoming more self-conscious about their on-line behaviour and hesitating to follow through on impulses where before they wouldn't have.

http://www.welivesecurity.com/podcasts/is-nsa-surveillance-affecting-online-behavior/

As you say, it's perhaps not "a lot" thus far. But the industry has got used to such a ferocious pace of consumption by consumers that even the prospect of a slight slowing in the rate of acceleration hasn't tended to figure much in people plans up until now.


Definitely something to watch verrrry closely I would think.

 
brookseven
50%
50%
brookseven,
User Rank: Light Sabre
2/10/2014 | 6:39:11 PM
Re: It's all about the Benjamins
 

Ladies and Gentlemen,

 

I am providing a link here:

http://gcn.com/articles/2011/06/30/dhs-test-found-thumb-drives-disks-network.aspx?s=gcndaily_010711

To demonstrate that this is actually a lot harder than it may seem.  The biggest single issue in corporate security is users.  They do stupid things.  How many of you don't mouse over links in e-mails before clicking?  One example.  

In the case listed (from a couple of years ago), a number of usb flash drives were left in parking lots of DoD offices and contractors.  60% were plugged in.  Yes 6 0 not 6 not .6 but 6 out of 10.

If somebody wants into your network, they will get in.  That is a given.  It is not a question of IF they can get in it is HOW MUCH it will cost and HOW LONG it will take.  Let's use Target.  Imagine giving an IT security guy $1M as a bribe to let a hacker in.  Think you might be able to find someone in your organization disaffected enough to take a substantial bribe?

Then we get to the electronic bits of this.  Networks and systems are probed constantly.  You couldn't actually investigate every attempt as you probably have thousands per second at a major institution.  Most are simple enough to defeat, but the volume of stupid attacks makes finding that needle (aka the one sophisticated hack) a real hard bit to locate.

Security is imperfect in the non-electronic world.  Why do we expect that there is perfection in the electronic version?

 

seven

 
mendyk
50%
50%
mendyk,
User Rank: Light Sabre
2/10/2014 | 6:07:28 PM
Re: It's all about the Benjamins
I'm supposed to be the cynical curmudgeon. You're forcing me out of my comfort zone. Yes, in many ways we are the dull-witted sheeple that some outside observers make us out to be. But even Target has said publicly that the data breach has cost it business.
Mitch Wagner
50%
50%
Mitch Wagner,
User Rank: Lightning
2/10/2014 | 5:59:08 PM
Re: It's all about the Benjamins
Americans have a remarkably short attention span. 
Mitch Wagner
50%
50%
Mitch Wagner,
User Rank: Lightning
2/10/2014 | 5:50:00 PM
Re: It's all about the Benjamins
I am cynical on this subject. I don't see a lot of evidence that businesses and consumers are changing their behavior as a result of data breaches. 
mendyk
50%
50%
mendyk,
User Rank: Light Sabre
2/10/2014 | 5:44:58 PM
Re: It's all about the Benjamins
110 million (!) accounts potentially compromised -- that's close to the total number of US households. Don't see how that can be quickly forgotten.
Carol Wilson
50%
50%
Carol Wilson,
User Rank: Blogger
2/10/2014 | 5:36:31 PM
Re: It's all about the Benjamins
I think it remains to be seen whether Target is  hurt long-term. They had tried to become a one-stop shop for bargain folks with taste (the folks with tight budgets that couldn't stand Walmart) by adding groceries. But from what I'm reading and seeing, folks are thinking twice about relying on their Red Cards to the extent they used to. 

It couild be this is quickly relegated to yesterday's news. At some point, though, consumers are going to balk at never knowing if their credit card data is sescure. 

There is also the issue of ongoing ramifications from the Target breach. People are still getting notified by banks and others than their accounts have been breached. 
Mitch Wagner
50%
50%
Mitch Wagner,
User Rank: Lightning
2/10/2014 | 5:30:54 PM
Re: It's all about the Benjamins
Will Target's brand really suffer long-term damage? Or will this be forgotten soon enough?
Page 1 / 2   >   >>
Light Reading’s Upskill U is a FREE, interactive, online educational resource that delivers must-have education on themes that relate to the overall business transformation taking place in the communications industry.
NEXT COURSE
Wednesday, October 5, 1:00PM EDT
Gigabit & Smart Cities
Joe Kochan, COO & Co-Founder, US Ignite
UPCOMING COURSE SCHEDULE
Friday, October 7, 1:00PM EDT
Gigabit & DOCSIS 3.1
Ty Pearman, Director, Access Architecture, Comcast
Wednesday, October 19, 1:00PM EDT
Securing a Virtual World
Rita Marty, Executive Director, Mobility and Cloud Security, Chief Security Office, AT&T
Friday, October 21, 1:00PM EDT
Security: Evolving the Data Center
Rasool Kareem Irfan, Head, Telecom & Infrastructure Security Practice, Tata Communications Transformation Services Ltd (TCTS)
in association with:
From The Founder
Light Reading today starts a new voyage as part of a larger Enterprise.
Flash Poll
Live Streaming Video
Charting the CSP's Future
Six different communications service providers join to debate their visions of the future CSP, following a landmark presentation from AT&T on its massive virtualization efforts and a look back on where the telecom industry has been and where it's going from two industry veterans.
LRTV Documentaries
From Philly, With Love

9|30|16   |     |   (5) comments


Join Alan Breznick, cable's answer to the Italian Stallion, as he runs through the highlights of SCTE Cable-Tec Expo, lumbers along in Rocky Balboa's footsteps and searches for the perfect Philadelphia cheesesteak.
LRTV Interviews
CenturyLink: SD-WAN Customers Looking for Value Not Cost Savings

9|30|16   |   5:31   |   (0) comments


At NFV & Carrier SDN in Denver, CenturyLink's Eric Nowak told Light Reading that when customers launch SD-WAN, they aren't necessary looking to save money, but instead they are looking for more value from what they're spending. He also shared some unique case studies and lessons learned from launching SD-WAN services.
LRTV Custom TV
Flexible Deployment Approaches for the Gigabit Services Evolution

9|29|16   |     |   (0) comments


For many operators, the gigabit evolution begins with the shift from DOCSIS 3.0 to DOCSIS 3.1. But that move represents a change not only in the protocol itself, but in the approach to architecting their entire DOCSIS delivery chain -- from the headend to the outside plant and home gateway components.

Jonathan Ruff, senior director of global technical ...

LRTV Interviews
Level 3 VP: Enterprises Need More for Less

9|29|16   |   05:27   |   (0) comments


Andrew Dugan, Level 3 group vice president of global technology and IT, says enterprises need more bandwidth and they need it faster and with greater security, but they want to spend less, if possible. They are looking to carriers to reduce their network complexity and help protect them from cyberattacks as well.
LRTV Interviews
CenturyLink: SDN/NFV Pose New Interconnection Possibilities

9|28|16   |   04:37   |   (0) comments


Network operators should develop new APIs and business processes for reselling virtual assets to each other, says CenturyLink's Bill Walker. That will enable them to build digital business portfolios that help them avoid becoming commodity transport providers.
LRTV Interviews
Level 3: Overcoming Terror of Being Supplier, Integrator & Developer

9|28|16   |     |   (0) comments


At Light Reading's NFV & Carrier SDN event in Denver, Travis Ewert of Level 3 Communications said there is terror in becoming supplier, integrator and developer, but it can be overcome and be cost effective.
LRTV Custom TV
Introducing IoT World News

9|27|16   |   01:43   |   (0) comments


Self-driving cars, medical sensors, smart cities... and refrigerators. In order to address the huge scope of IoT, KNect365 has created a unique online community that will help businesses to understand and monetize the opportunities that live within the IoT market. We look forward to welcoming you to IoT World News -- your gateway to a better connected future.
LRTV Interviews
AT&T: Reusable Functions Next NFV Key

9|27|16   |   06:03   |   (0) comments


The next generation of NFV has to break functions down into reusable software chunks, making everything much more cloud-like.
LRTV Interviews
Masergy on Security: Attackers Gaining Upper Hand

9|27|16   |   5:10   |   (2) comments


At Light Reading's NFV & Carrier SDN event in Denver, Ray Watson, vice president of Global Technology at Masergy, says that because of the growth in virtualization, the threat landscape is shifting in favor of the attackers. As a result, service providers need to think beyond just defending the perimeter and take a more holistic approach to security.
LRTV Interviews
Verizon Takes Next Step on Biz Virtualization Journey

9|26|16   |   4:38   |   (2) comments


At September's NFV & Carrier SDN event in Denver, Light Reading sat down with Victoria Lonker, director of Product and New Business Innovation at Verizon, to chat about where the carrier is with delivering virtualized services to business customers.
LRTV Interviews
Global Services: The $40B Face-Off

9|26|16   |   05:53   |   (1) comment


More service providers than ever before are battling it out to win a slice of what is now a $40 billion global communications services pie, explains Ovum Principal Analyst David Molony.
LRTV Documentaries
MEC Congress: The Key Takeaways

9|22|16   |   03:25   |   (3) comments


Three key takeaways from the Mobile Edge Computing (MEC) Congress in Munich, Germany.
Upcoming Live Events
November 3, 2016, The Montcalm Marble Arch, London
November 30, 2016, The Westin Times Square, New York City
December 1, 2016, The Westin Times Square, New York, NY
December 6-8, 2016, The Westin Excelsior, Rome
May 16-17, 2017, Austin Convention Center, Austin, TX
All Upcoming Live Events
Infographics
Hot Topics
Eurobites: Telefónica Taps Juniper for Network Security
Paul Rainford, Assistant Editor, Europe, 9/26/2016
AT&T CEO Backs Black Lives Matter
Dan Jones, Mobile Editor, 9/30/2016
Powell Kills the Cable Show
Mari Silbey, Senior Editor, Cable/Video, 9/29/2016
Telstra Sees Quadrupled Data Capacity by 2020
Carol Wilson, Editor-at-large, 9/28/2016
From Philly, With Love
Alan Breznick, Cable/Video Practice Leader, Light Reading, 9/30/2016
Like Us on Facebook
Twitter Feed
BETWEEN THE CEOs - Executive Interviews
Light Reading CEO Steve Saunders and UXP Systems CEO Gemini Waghmare discuss the strategic importance of digital identity for operators in the midst of transformation.
Join us for an in-depth interview between Steve Saunders of Light Reading and Alexis Black Bjorlin of Intel as they discuss the release of the company's Silicon Photonics platform, its performance, long-term prospects, customer expectations and much more.
Animals with Phones
There's Nothing Like Missing a Full Minute of Pokémon Go Click Here
Live Digital Audio

A vital part of increasing the number of women in comms is transforming the ways companies can support and empower women. While progressive company policies that support both men and women in achieving work-life balance are a step in the right direction, creating a company culture that supports those policies can at times be more challenging.

During this show, we'll talk to Lynn Comp, Senior Director of Industry and Sales Enabling (ISE) in the Network Platforms Group at Intel, about why those challenges exist and how companies can overcome them. She'll provide insight into how Intel has worked to create a culture that supports work-life balance, and provide steps and guidance for other companies wishing to do the same. We will also leave plenty of time to get your questions answered live on the air.