Light Reading

Verizon: Security Compliance Coming Up Short

Carol Wilson
2/7/2014
50%
50%

If recent, highly publicized data breaches weren't proof enough, a report that Verizon Enterprise Solutions will issue next week shows businesses aren't doing an adequate job of maintaining compliance with security standards by constantly testing their systems.

Verizon issues two annual reports per year, one tracking data breaches and another detailing compliance with the Payment Card Industry (PCI) Data Security Standard. The PCI report, due out next Tuesday, shows that businesses are treating PCI DSS compliance a bit too casually. While a growing number (82%) of businesses meet overall PCI standards, less than one-quarter are doing the required regular security testing and even fewer (17%) the security monitoring that would detect breaches and enable a fast response. (See Verizon Finds Credit Card Security Iffy, Verizon Breaks Down Security Threats by Industry Segment, and Verizon: Hackers Still Using Old Tricks.)

While Verizon isn't commenting on the specific breaches at Target and Nieman-Marcus, that lack of ongoing testing and monitoring would explain why data breaches persisted for weeks or even months before being detected and stopped. "We can see an improvement overall across all industries in PCI compliance, but we also see that security testing is not performing well," says Ciske Van Oosten, an architect of the upcoming report and part of Verizon's PCI Security Practice, which does security assessments, program and project management, and risk assessments for businesses. "We know there is now increased awareness of data breaches but whether that leads to doing right things in terms of internal and external integration testing, we will have to see." (See Verizon Ventures into Risk Management.)

Because attacks are growing both in size and sophistication, and because newer attacks don't yet have signatures to make them detectable by malware prevention programs, it's important that businesses do daily testing and monitoring to maintain PCI compliance, Van Oosten says. Generally following a breach, a review of the invaded company's data logs show red flags indicating suspicious activity that could have been detected earlier and addressed, he adds. But even small companies handle such a volume of data that only automated daily monitoring would be effective.

"The PCI standard requires you to remain up to date -- on a daily basis with log monitoring, and that process needs to be automated, even if you have only a single server," Van Oosten comments. "Compliance in not just reducing the chance of being breached, it can help you respond sooner to it and contain the cost of a breach. But that means ongoing testing."

Most breaches today are detected by law enforcement or third parties, not by the businesses themselves, which catch less than 10% of the breaches.

Companies can also improve their chances against data breaches by using up-to-date software systems, by encrypting information at its point of entry into a company's network, and by maintaining separate secure status for the encryption keys. The latter approach would prevent most data captured in a breach from being used in a criminal way, unless those who steal the data are able to steal the encryption keys separately, he adds.

— Carol Wilson, Editor-at-Large, Light Reading

(15)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
Page 1 / 2   >   >>
mendyk
50%
50%
mendyk,
User Rank: Light Sabre
2/11/2014 | 8:52:17 AM
Re: It's all about the Benjamins
Seven -- Agreed -- we should be less concerned about individual dumb users than about people on the inside, whether dumb or corrupt. As your examples point out, internal stupidity and criminality are potentially orders of magnitude more damaging than someone hacking one external user's weak password. I've been hacked twice on credit card accounts, and both times it was obvious that the hacking was an inside job. And of course, there's Mr. Snowden.
MKassner
50%
50%
MKassner,
User Rank: Light Beer
2/11/2014 | 7:50:55 AM
What would constant review have accomplished?
Monday morning quarterbacking is always easy. I dare say that when humans are involved, the bad guys will always have the upper hand. To say that more monitoring would help is a cheap shot by Verizon. What happened to Target would have happened to any company in the retail business. 

Quite simply the bad guys have the money to hire creative pen-testers, and all it takes is one crack to get in. Whereas, the good guys have to do battle against EVERY possible crack. 

 

 
pdonegan67
50%
50%
pdonegan67,
User Rank: Light Sabre
2/11/2014 | 5:00:33 AM
Re: It's all about the Benjamins
I guess it all depends what you call "a lot".

ESET is a credible outfit and they have presented evidence below of some subscribers becoming more self-conscious about their on-line behaviour and hesitating to follow through on impulses where before they wouldn't have.

http://www.welivesecurity.com/podcasts/is-nsa-surveillance-affecting-online-behavior/

As you say, it's perhaps not "a lot" thus far. But the industry has got used to such a ferocious pace of consumption by consumers that even the prospect of a slight slowing in the rate of acceleration hasn't tended to figure much in people plans up until now.


Definitely something to watch verrrry closely I would think.

 
brookseven
50%
50%
brookseven,
User Rank: Light Sabre
2/10/2014 | 6:39:11 PM
Re: It's all about the Benjamins
 

Ladies and Gentlemen,

 

I am providing a link here:

http://gcn.com/articles/2011/06/30/dhs-test-found-thumb-drives-disks-network.aspx?s=gcndaily_010711

To demonstrate that this is actually a lot harder than it may seem.  The biggest single issue in corporate security is users.  They do stupid things.  How many of you don't mouse over links in e-mails before clicking?  One example.  

In the case listed (from a couple of years ago), a number of usb flash drives were left in parking lots of DoD offices and contractors.  60% were plugged in.  Yes 6 0 not 6 not .6 but 6 out of 10.

If somebody wants into your network, they will get in.  That is a given.  It is not a question of IF they can get in it is HOW MUCH it will cost and HOW LONG it will take.  Let's use Target.  Imagine giving an IT security guy $1M as a bribe to let a hacker in.  Think you might be able to find someone in your organization disaffected enough to take a substantial bribe?

Then we get to the electronic bits of this.  Networks and systems are probed constantly.  You couldn't actually investigate every attempt as you probably have thousands per second at a major institution.  Most are simple enough to defeat, but the volume of stupid attacks makes finding that needle (aka the one sophisticated hack) a real hard bit to locate.

Security is imperfect in the non-electronic world.  Why do we expect that there is perfection in the electronic version?

 

seven

 
mendyk
50%
50%
mendyk,
User Rank: Light Sabre
2/10/2014 | 6:07:28 PM
Re: It's all about the Benjamins
I'm supposed to be the cynical curmudgeon. You're forcing me out of my comfort zone. Yes, in many ways we are the dull-witted sheeple that some outside observers make us out to be. But even Target has said publicly that the data breach has cost it business.
Mitch Wagner
50%
50%
Mitch Wagner,
User Rank: Lightning
2/10/2014 | 5:59:08 PM
Re: It's all about the Benjamins
Americans have a remarkably short attention span. 
Mitch Wagner
50%
50%
Mitch Wagner,
User Rank: Lightning
2/10/2014 | 5:50:00 PM
Re: It's all about the Benjamins
I am cynical on this subject. I don't see a lot of evidence that businesses and consumers are changing their behavior as a result of data breaches. 
mendyk
50%
50%
mendyk,
User Rank: Light Sabre
2/10/2014 | 5:44:58 PM
Re: It's all about the Benjamins
110 million (!) accounts potentially compromised -- that's close to the total number of US households. Don't see how that can be quickly forgotten.
Carol Wilson
50%
50%
Carol Wilson,
User Rank: Blogger
2/10/2014 | 5:36:31 PM
Re: It's all about the Benjamins
I think it remains to be seen whether Target is  hurt long-term. They had tried to become a one-stop shop for bargain folks with taste (the folks with tight budgets that couldn't stand Walmart) by adding groceries. But from what I'm reading and seeing, folks are thinking twice about relying on their Red Cards to the extent they used to. 

It couild be this is quickly relegated to yesterday's news. At some point, though, consumers are going to balk at never knowing if their credit card data is sescure. 

There is also the issue of ongoing ramifications from the Target breach. People are still getting notified by banks and others than their accounts have been breached. 
Mitch Wagner
50%
50%
Mitch Wagner,
User Rank: Lightning
2/10/2014 | 5:30:54 PM
Re: It's all about the Benjamins
Will Target's brand really suffer long-term damage? Or will this be forgotten soon enough?
Page 1 / 2   >   >>
Educational Resources
sponsor supplied content
Educational Resources Archive
Flash Poll
From The Founder
Last week I dropped in on "Hotlanta," Georgia to moderate Light Reading's inaugural DroneComm conference – a unique colloquium investigating the potential for drone communications to disrupt the world's telecom ecosystem. As you will see, it was a day of exploration and epiphany...
LRTV Documentaries
Verizon's Emmons: SDN Key to Cost-Effective Scaling

5|22|15   |   03:53   |   (0) comments


For Verizon and other network operators to ramp up available bandwidth cost effectively, they need to move to SDN and agree on how to do that.
LRTV Documentaries
Lack of Universal SDN a Challenge

5|21|15   |   04:51   |   (3) comments


Heavy Reading Analyst Sterling Perrin talks about how uncertainty about SDN standards and approaches may be slowing deployment.
LRTV Custom TV
Steve Vogelsang Interview: Carrier SDN

5|20|15   |   05:02   |   (0) comments


Sterling Perrin speaks to Steve Vogelsang, Alcatel-Lucent CTO for IP Routing & Transport business, about the new Carrier SDN-enabling Network Services Platform and the operator challenges it solves.
LRTV Custom TV
Carrier SDN: On-Demand Networks for an On-Demand World

5|20|15   |   20:52   |   (0) comments


Steve Vogelsang, Alcatel-Lucent CTO for IP Routing & Transport business, talks about requirements and benefits of Carrier SDN during the keynote address at the Light Reading Carrier SDN event May 2015.
LRTV Documentaries
The Security Challenge of SDN

5|19|15   |   02:52   |   (0) comments


CenturyLink VP James Feger discusses concerns that virtualization could create new vulnerabilities unless network operators build in safeguards.
LRTV Custom TV
NFV Elasticity – Highly Available VNF Scale-Out Architectures for the Mobile Edge

5|18|15   |   5:50   |   (0) comments


Peter Marek and Paul Stevens from Advantech Networks and Communications Group talk about their NFV Elasticity initiative and the company's latest platforms for deploying virtual network functions at the edge of the network. Packetarium XL and the new Versatile Server Module: 'designed to reach parts of the network that other servers cannot reach.'
LRTV Huawei Video Resource Center
Bay Area Spark Meetup 2015

5|14|15   |   3:54   |   (0) comments


Developed in 2009, Apache Spark is a powerful open source processing engine built around speed, ease of use and sophisticated analytics. This spring, Huawei hosted a meetup for Spark developers and data scientists in Santa Clara, California. Light Reading spoke with organizers and attendees about Huawei's code contributions and long-term commitment to Spark.
LRTV Custom TV
The Transport SDN Buzz

5|12|15   |   06:01   |   (1) comment


Sterling Perrin, senior analyst at Heavy Reading, speaks with Peter Ashwood-Smith of Huawei and Guru Parulkar of ON.Lab about the evolution of transport SDN and the integration of technologies.
LRTV Custom TV
Next-Generation CCAP: Cisco cBR-8 Evolved CCAP

5|5|15   |   04:49   |   (0) comments


John Chapman, Cisco's CTO of Cable Access Business Unit and Cisco Fellow, explained the innovation design of Cisco's cBR-8, the industry's first Evolved CCAP, including DOCSIS 3.1 design from ground-up, distributed CCAP with Remote PHY and path to virtualization. Cisco's cBR-8 Evolved CCAP is the platform that will last through the transitions.
LRTV Custom TV
Meeting the Demands of Bandwidth & Service Group Growth

5|1|15   |   5:35   |   (0) comments


Jorge Salinger, Comcast's Vice President of Access Architecture, explains how DOCSIS 3.1 and multi-service CCAP can meet the demands of the bandwidth and service group growth.
LRTV Custom TV
DOCSIS 3.1: Transforming Cable From Hardware-Defined Network to Software-Defined Network

4|29|15   |   03:48   |   (0) comments


John Chapman, Cisco's CTO of Cable Access Business Unit and Cisco Fellow, explains how DOCSIS 3.1 can transform cable HFC network to a more agile software-defined network.
LRTV Huawei Video Resource Center
Predicting Traffic Patterns for Quality Mobile Broadband

4|29|15   |   6:45   |   (0) comments


Accessing information ubiquitously creates complexity and creates heavy traffic onto the network, especially at large-scale events like sporting events or festivals. In this video, Huawei's Mohammad Hussain speaks to experts about how to predict traffic and improve user experience during periods of heavy traffic.
Upcoming Live Events
June 8, 2015, Chicago, IL
June 9, 2015, Chicago, IL
June 9-10, 2015, Chicago, IL
June 10, 2015, Chicago, IL
September 29-30, 2015, The Westin Grand Müchen, Munich, Germany
October 6, 2015, The Westin Peachtree Plaza, Atlanta, GA
October 6, 2015, Westin Peachtree Plaza, Atlanta, GA
All Upcoming Live Events
Infographics
Network functions virtualization (NFV) is not the easiest of topics to take on board, so here's a Light Reading infographic, developed following conversations with the folks at HP, that helps make sense of where NFV is taking the industry.
Hot Topics
Verizon Saves 60% Swapping Copper for Fiber
Sarah Thomas, Editorial Operations Director, 5/19/2015
Choosing a Technology Supplier? Consider Changing Your Selection Criteria
Steve Saunders, CEO and founder, Light Reading, 5/18/2015
Chattanooga Charts Killer Gigabit Apps
Mari Silbey, Senior Editor, Cable/Video, 5/20/2015
10 Alternate Uses for Tablets
Eryn Leavens, Copy Desk Editor, 5/22/2015
Smarter 'Dumb' TVs Will Drive OTT Adoption
Mari Silbey, Senior Editor, Cable/Video, 5/18/2015
Like Us on Facebook
Twitter Feed
Webinar Archive
BETWEEN THE CEOs - Executive Interviews
With 200 customers in 60 countries, Stockholm-based Net Insight has carved out a solid leadership position in one of the hottest vertical markets going in comms right now: helping service providers and broadcasters deliver video and other multimedia traffic over IP networks. How has Net Insight managed to achieve this success in the face of immense competition from the industry giants?
My ongoing interview tour of the leading minds of the telecom industry recently took me to Richardson, Texas, where I met with Rod Naphan, CTO and SVP, Solutions, ...
I recently popped down to Texas to chat with CEO Eric L. Pratt about his company, Taqua.
Cats with Phones