printer friendly version

Wireless technology a new threat to digital security?

Companies urged to beef up security to avert being branded 'digital Parmalat'.

Newer technologies such as wireless computers and mobile telephony are posing a security threat to organisations because of inherent risks to auditing service providers and of vetting employees.

These are the startling findings of a survey commissioned by global audit and business advisory firm, Ernst & Young. The results of the survey are published in the new release of the highly acclaimed Defending the Digital Frontier.

Shaun Nel, Ernst & Young senior manager for Information Systems Assurance & Advisory Services (ISAAS) division, explained that Defending the Digital Frontier is a handbook for management which introduces the central information security themes management need to be aware of. It also highlights other areas of significant risk such as outsourcing and off-shoring where the immature security of third party providers, difficulties of auditing those providers and problems in vetting employees are just some of the security issues facing organisations.

With wireless technologies being touted as a panacea for communities where communication infrastructure has historically lagged, and as a cheaper, more agile infrastructure for organisations, the issue of effectively securing this infrastructure becomes paramount.

"The hype and the speed with which wireless technology was introduced to these shores was not equally matched by adequate digital systems security," notes Nel. "This oversight has made wireless technology susceptible to security lapse and a weaker link that can be exploited by unscrupulous end users," he says.

Nel says that although wireless technology is yet to gain widespread adoption in South Africa, he cautioned that companies could and invariably would fall prey to computer crime if they do not prioritise digital security as an integral part of any infrastructure project.

The Ernst & Young survey has found that 20% of companies still do not have an intrusion detection system and that nearly one third do not have a documented incident response plan. In addition, one third of those that have a business continuity or recovery plan do not have a means in place of testing the plan.

Jan Babiak, head of Ernst & Young's global information security practice, said stakeholders are growing increasingly intolerant of IT security, which they regard as integral to good governance following well-publicised corporate collapses. "If organisations wish to avoid the risk of becoming labelled as a 'digital Parmalat' then they must wake up to their responsibilities. Senior management do not need to be experts in security, but they should not be ignorant of the risks and/or abdicate responsibility either," says Babiak.

Knowing the identity of system users and the permissions they have been granted is a fundamental issue in systems administration, Babiak notes, adding that ignorance about the identities of those allowed access to the system and the limitations associated with this access thereof makes companies vulnerable to users who might engage in illegal activities.

The study, nonetheless, revealed positive news. It found that 83% of companies have a documented information security policy, while 85% undertook reviews of their policies to ensure alignment with other business processes and risk strategies. This would indicate that there is activity in many areas, but many organisations are making some fundamental mistakes by not following through on the initial activities of policy setting and plan development.

The survey also highlights the failure to recognise the role of people in addition to process and technology in the fight against digital crime.

Other findings of the survey include

* 89% of respondents said they had addressed the need for privacy policies.

* 88% of respondents had a physical security policy in place.

* 14% of respondents said that in the event of a digital security incident, they had no formal process that required executive level involvement;

* A further 21% left the decision to involve company executives about an incident to the computer security incident-response team leader.

* 37% of respondents said that only the security department was formally trained in security measures.

"Many organisations have little choice but to live at the digital frontier," Babiak says. "By doing so they gain many benefits but, to date, few have paid enough attention to the commercial impact of the risks they face. By tackling digital security as a management issue, and by strengthening their digital security culture from the top down, organisations can build secure and cost-effective futures at the digital frontier," Babiak concludes.

Share this article:

Further reading: