NEWSLETTERS
 

CIO.com updates, insights and advice on technology, management and your career.

 
 
 
LEADERSHIP
 
CIO Executive Programs
The Leader in Face-to-Face Education for Senior Executives

Offering regional and national programs, CIO (and CSO) events bring together some of the most respected names and thought leaders in information technology and security. Presented by CIOs and other senior level executives, these invitation-only programs offer timely topics and strong networking. Learn More »

 
CIO Executive Council
A Peer-Advisory Service and Professional Association for CIOs

Social Responsibility's Strategic Benefits

December 15, 11:30 AM - 12:30 PM US/Eastern (GMT-5)

Join Ed Granger-Happ, CIO of Save the Children, for a discussion of how creating an organization that is socially responsible improves staffing, retention, leadership development and overall corporate health.

Working With and Communicating to Your Board of Directors

January 13, 2009, 4:00 PM - 5:00 PM US/Eastern (GMT-5)

CIO panelists who will share tips and experiences working with their boards: Twila Day of SYSCO; Jeff O'Hare, West Corp.; Marc West, formerly with H&R Block.

IT's Role in Growing Mid-Market Companies

January 14, 4:00 PM - 5:00 PM ET (GMT-5)

Mid-market Council members will share their companies' stories and challenges in driving or coping with growth. Panelists represent Veterinary Pet Insurance, Medicis Pharmaceutical, and Intrax Cultural Exchange.

More / Register »

Learn more about the CIO Executive Council »



 
 
RESOURCE CENTER
 
 
 
SUBSCRIBE TO CIO
 
Are you involved in setting the direction for your company's IT budget or strategy?

Apply today for a FREE subscription to CIO Magazine!

 
 

Confidential Data: You're Giving Away Your Corporate Secrets!

In the hands of a skilled attacker, even the most innocuous piece of data can be used to attack the system and gain access to the crown jewels.

 

June 13, 2008CIO — A security review or security audit is a process that helps an organization determine if they have the appropriate security measures in place; that is, if the amount they are spending on each security countermeasure approximates the cost to the company of the expected loss. While there are many methodologies for performing a security audit, most include the following steps: identification of valuable assets, estimating their value to the company and their cost if they are somehow damaged, determining their current level of protection, determining the probability of a potential break-in (i.e., risk), deciding if an asset's current protection matches its estimated value and investigating what options are available to remedy any differences. At first glance, while perhaps time-consuming, this does not seem terribly complex. Ask several top executives what they consider to be the company's valuable assets; merge and prioritize the lists, and you are likely well on your way.

If your executives did well, they will have included many types of assets including physical assets such as buildings, technological assets such as computers, intellectual property assets such as domain knowledge, etc. They might have thought to list risks such as fire, theft, computer break-ins, industrial espionage and even natural disasters.

If you add input from the IT team, you will likely get items added to the list involving security of employee passwords, firewall and other Internet-protection mechanisms, power and air-conditioning failures, etc.

Once complete, you will likely have a very comprehensive list of your company's assets that need protection. But one asset is nearly always forgotten. This is the internal configuration of a company's computer systems. "Internal configuration" includes:

  • Internal network topology including firewalls, internal IP addresses, and other networking information and configuration that only need to be accessible from within an enterprise's private network.
  • Hardware and software products, including their manufacturers, models and versions.
  • Usernames, administrative accounts, privileged individuals.
  • Internal or external services used by the company (e.g.: travel agency, office supply website, Active Directory services) and the means of connectivity to those services.
  • Computer languages and software frameworks used for networked applications.
  • Whole or partial source code—including stack traces.

These pieces of internal configuration, along with many others that have been omitted from this column for brevity, all share one thing in common: They are frequently thought of as non-confidential data, yet, in the hands of a skilled attacker, each might contribute to a break-in. With confidential data such as passwords or private keys, the threat from exposure is clear. But from these trivial configuration facts (e.g.: an IP address that is only accessible from within the enterprise network), the threats are less obvious.

Loading...
 
 
CENTER OF EXCELLENCE
 
Security
» Prudential Financial Protects its Brand with Symantec Data Loss Prevention Solutions
FORTUNE 100 insurance leaders rely on the Symantec Data Loss Prevention solution to protect sensitive customer data.
» Information Security: Data Drains and How to Prevent Loss
Do you know where your confidential data is, where it is going, and how to prevent it from leaving your organization.
» Data Loss Prevention: Keeping Sensitive Data Out of the Wrong Hands
Learn what the thought-leaders at PricewaterhouseCoopers have to say on the risks associated with data security.
» 7 Requirements of Data Loss Prevention
Incorporate best practices from many companies using DLP solutions as you establish your organization's requirements and safeguard confidential data.
» Ponemon Study: How Much Does a Data Breach "Cost"?
35 U.S. organizations that lost confidential information and had a regulatory requirement to publicly notify affected individuals are studied in this report.
Center sponsored by

 
 
IT Jobs
 
 
 
ABCs
 

Just the basics, please. Sometimes we all need a refresher or we need to make sure our team and our colleagues are all on the same page.

Over 25 tutorials on everything from business intelligence to virtualization.

 
 
FEATURED SPONSORS
 
 
 
SPONSORED LINKS
 

Is Your WLAN Helping You Comply with Security Guidelines of the PCI Standard?

Why Your Firewall, VPN, and IEEE Aren't Enough to Protect Your Network

Laptop Security: Where Do CIOs See Weaknesses?

Unified Communications & Collaboration: Game-Changing Business Results

Server Virtualization Benchmark Results

Learn to Leverage Maximum Computing Power

Windows Vista: Essential Benefits and Deployment Strategies

Best Practices: Safe and Secure Hardware Asset Recovery

White Paper: Migrating to Windows Vista and Microsoft Office 2007 Together

White Paper: Enabling Next Generation IP Communications

White Paper: Green Issues for Networking

New IDG Survey Results on Data Center Automation

Operational Excellence Is Key to Maximizing IT Investments

The Right and Wrong Master Data Management Strategies to Start Small and Grow Big

Find out how to manage virtualization's risks and reap the rewards.

Conquer the realities of managing virtualization

Remote Infrastructure Management - What Your Peers are Thinking

Complementary BI: The New Approach to Business Intelligence

Learn what it takes to build a holistic digital collaboration platform

Make Hidden Trends, Inter-Relationships and Influences Visible.

Improve delivery of product information to customers.

Renowned Engineering Institution Chooses AMD Processor-Based Servers

Corral, configure and control all your mischievous machinery with a Lantronix device server

Spend less. Get hosted UC. Get cash back. It's easy under a Cypress

Predict the future with HP Insight Power Manager

White Paper: A Cohesive Network Security Approach

A CISO's Guide to Application Security

Examine security implementations based on six key criteria.

Virtualization Benchmark and TCO Analysis-Read Now

White Paper: Scaling Down HPC for Smaller Organizations

White Paper: Never Enough Compute Power?

Microsoft Windows Vista Cost and Benefit Estimator

White Paper: Efficient Desktop Application Management

White Paper: Take your Call Center to the Next Level

White Paper: Improve Employee Efficiency and Reduce Telecom Costs

Dramatically boost network capacity and speed-up to 600 Mbps

White Paper: The Roadmap to Data Center Automation

Learn how companies are changing how they reach out to their most profitable customers.

Get help navigating the management challenges of virtualization.

Narrow the gap between virtualization's benefits and the management risks.

Cash in on the promise of virtualization

Webcast - "Into the Wild: Managing Laptops Outside the Office"

Mobility is Growing: Survey Shows Why CIOs are Concerned

The ECM Paradox: Extending Local Flexibility to Strengthen Central Control

Customer Insight Yields Sales, Marketing Gains

Efficient by design: Watch this flash demo of the Quad-Core AMD Opteron Processor

HP and Oracle deploy unbreakable computing infrastructure at Replacements, Ltd.

File Integrity Monitoring: Prove compliance and secure your IT environments

Affordable technology-no compromise. HP server solutions

SOA Educational Library at the TIBCO SOA Resource Center