printer friendly version

IT security: time for a rethink?

Protecting IT systems from unauthorised access may be a never-ending battle as the good guys and the bad guys try to stay ahead of one another. But a major cybercrime study suggests that the bad guys have changed the rules and that protecting corporate secrets is now the greatest challenge facing IT.

The study estimates that the UK lost R264 billion to cybercrime last year. R164 billion of that loss was due to the IT-based theft of corporate secrets.

These high-profile IT crimes that we hear about all the time include identity theft, online fraud and DNS attacks, but top of the list are losses from stolen secrets (categorised below as IP theft) and espionage.

The astonishing scale of these losses is alarming enough for any CEO. What is equally concerning is that the people stealing the secrets are technically sophisticated, well resourced, exceptionally determined, well paid and mostly working from within your organisation.

However, the real shocker is that such massive losses are routinely based on the exploitation of cards, PINs and passwords.

Since the early 1960s, IT security has relied on passwords to control access. In an evolution that runs parallel with commercial computing, various security enhancements have been added to passwords. They got encrypted; symbols got added; and they get changed on a rolling basis to refresh their security.

Although they are still the most common credentials, many organisations have moved from passwords into two-factor authentication, such as combining an IT access card with a unique number – the chip and PIN approach.

But there is a problem here: cards, PINs and passwords are inherently insecure because they are all routinely lost, forgotten, shared and stolen. Has their time come to end? If it has, should IT be looking for new technologies to improve security?

Learning from physical security

Over 60 000 fingerprint scanners are deployed across southern Africa, controlling physical access for some 2,5 million people, predominantly within the workplace but also in environments like colleges and residential estates.

It surprises many people that the region is one of the world’s largest markets for biometric access control. Locally, we have learnt a lot about biometric applications that cut costs by reducing risks. Since around 2005, there has been a high-volume migration into biometrics and away from traditional access cards.

The dominant business case for this migration is that biometrics pay for themselves: they cut losses that can be directly attributed to conventional access credentials. The hard-nosed world of physical security is not investing in biometrics because it is fond of gadgets.

The business case for biometric security is proven. Intelligently applied, biometrics can dramatically cut unauthorised IT access and the enormous losses it causes.

Share this article:

Further reading: