IT security: time for a rethink?

April 2011 Cyber Security

Protecting IT systems from unauthorised access may be a never-ending battle as the good guys and the bad guys try to stay ahead of one another. But a major cybercrime study suggests that the bad guys have changed the rules and that protecting corporate secrets is now the greatest challenge facing IT.

The study estimates that the UK lost R264 billion to cybercrime last year. R164 billion of that loss was due to the IT-based theft of corporate secrets.

These high-profile IT crimes that we hear about all the time include identity theft, online fraud and DNS attacks, but top of the list are losses from stolen secrets (categorised below as IP theft) and espionage.

The astonishing scale of these losses is alarming enough for any CEO. What is equally concerning is that the people stealing the secrets are technically sophisticated, well resourced, exceptionally determined, well paid and mostly working from within your organisation.

However, the real shocker is that such massive losses are routinely based on the exploitation of cards, PINs and passwords.

Since the early 1960s, IT security has relied on passwords to control access. In an evolution that runs parallel with commercial computing, various security enhancements have been added to passwords. They got encrypted; symbols got added; and they get changed on a rolling basis to refresh their security.

Although they are still the most common credentials, many organisations have moved from passwords into two-factor authentication, such as combining an IT access card with a unique number – the chip and PIN approach.

But there is a problem here: cards, PINs and passwords are inherently insecure because they are all routinely lost, forgotten, shared and stolen. Has their time come to end? If it has, should IT be looking for new technologies to improve security?

Learning from physical security

Over 60 000 fingerprint scanners are deployed across southern Africa, controlling physical access for some 2,5 million people, predominantly within the workplace but also in environments like colleges and residential estates.

It surprises many people that the region is one of the world’s largest markets for biometric access control. Locally, we have learnt a lot about biometric applications that cut costs by reducing risks. Since around 2005, there has been a high-volume migration into biometrics and away from traditional access cards.

The dominant business case for this migration is that biometrics pay for themselves: they cut losses that can be directly attributed to conventional access credentials. The hard-nosed world of physical security is not investing in biometrics because it is fond of gadgets.

The business case for biometric security is proven. Intelligently applied, biometrics can dramatically cut unauthorised IT access and the enormous losses it causes.


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

OSINT: A new dimension in cybersecurity
Cyber Security
The ancient Chinese strategist Sun Tzu noted, you should always try to know what the enemy knows and know more than the enemy.

Sasol ensures Zero Trust for SAP financials with bioLock
Technews Publishing Editor's Choice Cyber Security Security Services & Risk Management
Multi-factor authentication, including biometrics, for SAP Financials from realtime North America prevents financial compliance avoidance for Sasol.

Building a holistic application security process
Altron Arrow Cyber Security
Altron Arrow asks what it means to build a holistic AppSec process. Learn what’s involved in a holistic approach and how to get started.

Managing data privacy concerns when moving to the cloud
Cyber Security
While the cloud offers many business benefits, it can also raise concerns around compliance, and some organisations have taken the approach of staying out of the cloud for this reason.

Accelerating your Zero Trust journey in manufacturing
IT infrastructure Cyber Security Industrial (Industry)
Francois van Hirtum, CTO of Obscure Technologies, advises manufacturers on a strategic approach to safeguarding their businesses against cyber breaches.

The democratisation of threats
Cyber Security
Bugcrowd looks at some of the primary vulnerabilities the world faced in 2021, and the risks moving forward with growing attack surfaces and lucrative returns on crime.

Protecting yourself from DDoS attacks
Cyber Security Security Services & Risk Management
A DDoS attack, when an attacker floods a server or network with Internet traffic to prevent users from accessing connected online services, can be costly in both earnings and reputation.

Exploiting Android accessibility services
Cyber Security
Pradeo Security recently neutralised an application using Android accessibility services that exploits the permission to perform fraudulent banking transactions.

Cyber resilience is more than cybersecurity
Technews Publishing Editor's Choice Cyber Security Integrated Solutions IT infrastructure
Hi-Tech Security Solutions held a round-table discussion focusing on cyber resilience and found that while the resilience discipline includes cybersecurity, it also goes much further.

Keeping devices in check
Cyber Security Asset Management, EAS, RFID IT infrastructure
Kaspersky patents new technology for analysing relationships between electronic devices to counter cyberattacks launched through connected IoT devices.