Wireless technology a new threat to digital security?

February 2005 Cyber Security

Companies urged to beef up security to avert being branded 'digital Parmalat'.

Newer technologies such as wireless computers and mobile telephony are posing a security threat to organisations because of inherent risks to auditing service providers and of vetting employees.

These are the startling findings of a survey commissioned by global audit and business advisory firm, Ernst & Young. The results of the survey are published in the new release of the highly acclaimed Defending the Digital Frontier.

Shaun Nel, Ernst & Young senior manager for Information Systems Assurance & Advisory Services (ISAAS) division, explained that Defending the Digital Frontier is a handbook for management which introduces the central information security themes management need to be aware of. It also highlights other areas of significant risk such as outsourcing and off-shoring where the immature security of third party providers, difficulties of auditing those providers and problems in vetting employees are just some of the security issues facing organisations.

With wireless technologies being touted as a panacea for communities where communication infrastructure has historically lagged, and as a cheaper, more agile infrastructure for organisations, the issue of effectively securing this infrastructure becomes paramount.

"The hype and the speed with which wireless technology was introduced to these shores was not equally matched by adequate digital systems security," notes Nel. "This oversight has made wireless technology susceptible to security lapse and a weaker link that can be exploited by unscrupulous end users," he says.

Nel says that although wireless technology is yet to gain widespread adoption in South Africa, he cautioned that companies could and invariably would fall prey to computer crime if they do not prioritise digital security as an integral part of any infrastructure project.

The Ernst & Young survey has found that 20% of companies still do not have an intrusion detection system and that nearly one third do not have a documented incident response plan. In addition, one third of those that have a business continuity or recovery plan do not have a means in place of testing the plan.

Jan Babiak, head of Ernst & Young's global information security practice, said stakeholders are growing increasingly intolerant of IT security, which they regard as integral to good governance following well-publicised corporate collapses. "If organisations wish to avoid the risk of becoming labelled as a 'digital Parmalat' then they must wake up to their responsibilities. Senior management do not need to be experts in security, but they should not be ignorant of the risks and/or abdicate responsibility either," says Babiak.

Knowing the identity of system users and the permissions they have been granted is a fundamental issue in systems administration, Babiak notes, adding that ignorance about the identities of those allowed access to the system and the limitations associated with this access thereof makes companies vulnerable to users who might engage in illegal activities.

The study, nonetheless, revealed positive news. It found that 83% of companies have a documented information security policy, while 85% undertook reviews of their policies to ensure alignment with other business processes and risk strategies. This would indicate that there is activity in many areas, but many organisations are making some fundamental mistakes by not following through on the initial activities of policy setting and plan development.

The survey also highlights the failure to recognise the role of people in addition to process and technology in the fight against digital crime.

Other findings of the survey include

* 89% of respondents said they had addressed the need for privacy policies.

* 88% of respondents had a physical security policy in place.

* 14% of respondents said that in the event of a digital security incident, they had no formal process that required executive level involvement;

* A further 21% left the decision to involve company executives about an incident to the computer security incident-response team leader.

* 37% of respondents said that only the security department was formally trained in security measures.

"Many organisations have little choice but to live at the digital frontier," Babiak says. "By doing so they gain many benefits but, to date, few have paid enough attention to the commercial impact of the risks they face. By tackling digital security as a management issue, and by strengthening their digital security culture from the top down, organisations can build secure and cost-effective futures at the digital frontier," Babiak concludes.

For more information contact Shaun Nel, Ernst & Young, 011 772 3000, shaun.nel@za.ey.com.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Exploiting the global pandemic
Issue 7 2020 , Cyber Security
Cyber criminals targeting remote work to gain access to enterprise networks and critical data reports FortiGuard Labs.

Integrated security is key to Huawei Mobile Services
Issue 7 2020 , Cyber Security
To ensure sufficient mobile device security, the technology giant incorporates security into its chip, device and cloud capabilities.

Cybersecurity becomes key enabler of sustainable business growth
Issue 7 2020 , Cyber Security
The adoption of rushed digital transformation strategies has left many facing unintended complexities and challenges.

Challenges healthcare is facing
Issue 6 2020 , Cyber Security
The healthcare industry has been forever changed by digital transformation, but cybercriminals are targeting the healthcare sector now more than ever.

Secure IoT devices and networks
Issue 6 2020, Technews Publishing , Cyber Security
Check Point Software’s IoT Protect solution secures IoT devices and networks against the most advanced cyber-attacks.

SentinelOne Protects the AA
Issue 6 2020 , Cyber Security
National provider of 24-hour motorist assistance stays on the road thanks to accelerated, AI-powered threat prevention, detection and response.

Protecting database information
Issue 6 2020 , Cyber Security
SearchInform has officially released Database Monitor, a solution for the protection of information stored in databases.

Work from home securely
Issue 5 2020 , Cyber Security
First Consulting provides enterprise-level IT security to working-from-home employees at more than 40 South African organisations.

Agility, meticulous alignment and testing
Issue 5 2020 , Cyber Security
Data loss can put the nails in the coffin for unprepared businesses. Investing in cyber resilience is key to succeed in the age of digital transformation.

Cybersecurity comment: A holistic approach to threat vulnerability
Issue 5 2020 , Cyber Security
Any organisation, whether large or small, public or private, should follow an established framework in order to protect itself against cyber threats.