1 | P a g e

PREVENT & PROTECT

2 | P a g e

The number of U.S. data breaches tracked in 2014 hit a record high of 7831, according to a recent

report released by the Identity Theft Resource Center. An article in CNN Money estimated nearly

one million malware threats are released every day2. Malware in general is more malicious than

years past, with ransomware being just a small example of our challenges in IT. Although Gartner

stated that organizations will increasingly recognize that it is not possible to provide a 100 percent

secured environment3, businesses must develop strategies to prevent and protect from data

breaches.

In a nutshell, the security landscape has significantly changed over the last several years and

businesses must adapt by incorporating cost effective solutions to fight the ever-growing threats.

To complicate the issue, many IT departments have faced reductions of force and often have had

budget constraints that limit their ability to stay ahead of the curve.

DSM has assessed a great number of environments and regardless

of the size of the organization and number of IT people on staff,

every assessment yields a great number of vulnerabilities.

Moreover, DSM has noted weaknesses during many of our

assessments that indicate gaps in an organization’s ability to

recover data in the event of a breach. Backups were the traditional

way to protect from data loss; however, it is no longer sufficient as

a standalone solution. In short, businesses must layer prevention

and protection strategies.

Prevention Strategies In simplistic terms, a prevention strategy should stop threats before they occur. The question

business leaders should ask is, “how secure are my systems and data?” If a survey was sent to a

dozen IT departments, most likely the results would indicate a broad number of strategies being

deployed followed immediately by statements indicating that staffing and budgeting are limiting

their ability to prevent malicious attacks.

Many business leaders are not technical and must rely upon their technical staff to provide

guidance. Often internal IT departments lack the knowledge and/or expertise in deploying

technologies or processes to help mitigate against a breach. Accordingly, DSM recommends

asking these simple questions:

(1) What are we doing today to prevent a data breach?

(2) What limitations are we facing?

(3) What is the process to validate our data and systems are protected?

1 Identity Theft Resource Center Breach Report Hits Record High in 2014 2 Nearly 1 million new malware threats released every day 3 Gartner Identifies the Top 10 Strategic Technology Trends for 2015

Backups were the

traditional way to protect

from data loss; however, it

is no longer sufficient as a

standalone solution. In

short, business must layer

prevention and protection

strategies.

3 | P a g e

The answers to these questions will help define the magnitude of information security as a true

business threat. Then the organization will be ready to determine the overall readiness and health

of IT.

The most common practice of identifying issues and establishing budgets is leveraging a third

party assessment. Before embarking on an assessment, the business needs to ensure it is willing

to put the effort to remediate and mitigate against identified risks. Moreover, the firm providing

the assessment must gain your confidence by showing it has a methodology that maps to your

business needs. Accordingly, DSM developed an assessment methodology that breaks down our

findings into four categories.

1) Security

2) Management

3) Availability

4) Recovery

This approach produces a comprehensive review of an environment beyond traditional security.

In fact, it provides a review of an organization’s ability to recover and outlines improvements for

systems management, IT automation and high availability to applications and data. This proven

methodology provides health checks of critical systems and applications in conjunction with

assessing the security and overall recoverability of an environment. Additionally, DSM provides

budgets to remediate and strengthen the underlying technologies your business depends upon.

Assessment Woes While IT Assessments are a proven approach to identifying weaknesses, not everyone is

comfortable with a third party reviewing their environment. Depending upon the situation, some

technical people may embrace an assessment while others tend to avoid them. DSM has

performed a great number IT assessments which have yielded many different views from the

various IT teams. One observation is that many organizations have

a strong confidence in their solutions. In some instances we have

experienced resistance to an outsider assessing their security

posture due to insecurities. Regardless of the maturity of an

organization or the age of the systems that are deployed, auditors

most always uncover issues that would have gone unnoticed until

an event surfaced the weakness. Simply said, everyone can

improve process or techniques to secure infrastructure and data.

The real question everyone should ask is, “If a data breach

occurred, how would it impact our business?” SafeNet stated Data

breaches have a significant impact on whether a customer will

interact with an organization again4. Additionally, IBM and

Ponemon Institute indicated that the total average cost for data

breaches paid by United States companies increased from $5.4 million to $5.9 million5 in 2014.

Is it worth the risk or should organizations have a preventative strategy? We believe an

assessment is only one layer of protection but it will remain a necessity to ensure organizations

are following industry best practices.

4 Global Survey Reveals Impact of Data Breaches on Customer Loyalty 5 2014 Cost of Data Breach Study: United States

Data breaches have a

significant impact on

whether a customer

will interact with an

organization again.

4 | P a g e

Protection Strategies DSM believes in the statement, it is not a matter of “IF’ it is “WHEN” as it relates to security

breaches. Accordingly, DSM recommends that organizations mature in the area of protection

strategies. Simplified, a protection strategy is a layered approach to protect data from being

compromised and in the event of an emergency the data or systems can easily be recovered. At a

high level, organizations must go beyond traditional backups to ensure they are protecting critical

and confidential data. Confidential data should be encrypted to minimize the threat of leakage

and organizations must consider technologies that streamline the recovery approach for

corrupted or loss data.

How Effective are My System Backups? The good news is technology is constantly improving; however, many organizations have made

significant investments in backup technologies that may not be effective. IT assessments have

identified that many organizations are performing traditional backups, nevertheless they are

lacking a comprehensive recovery strategy to recover data beyond a

backup. Accordingly, there are gaps between business requirements

and the technical ability to provide instant access to data after an

outage. Disaster Recovery has been focused mostly on the fire or the

hurricane but must expand into the real threat of today which is data

compromise or leakage.

Today’s businesses require the ability to recover data from minutes

ago versus last night’s backup. An easy calculation for recovery times

is if it takes one (1) hour to backup data, it will typically take two (2)

hours to recover it with traditional backups. Hence, how can we

shorten our recovery time in the event of a virus such as

CryptoLocker? Beyond security awareness training to reduce the end

user’s mistake, businesses must leverage technologies that provide

automated snapshots of files or volumes.

DSM recommends reviewing your data protection solution to ensure it has adequate retention

and archive for compliance and that it has the ability to replicate the data offsite. In addition, it

should tightly integrate into virtual infrastructure while giving the ability to instantly recovery

both physical and virtual systems.

Performing IT Basics One interesting finding that all assessments have disclosed is most organizations are not doing

the IT basics. IT staff reduction in conjunction with speed that technology

changes has yielded an interesting issue. IT departments tend to spend

more energy with projects in parallel with troubleshooting the tireless day-

to-day technical issues as opposed to keeping up with the daily

management tasks. Results show that patch management for Microsoft

and third party applications is not managed well in most every

environment. While most have automated tools, many are not fully

configured or lack processes to validate systems and applications are

updated. Moreover, some audits reveal that Anti-Virus can be sparsely

implemented.

The reality is the day-to-day tasks which are essential to protecting the environment are somewhat

boring which exasperates the situation. Based upon our experience, it appears that many IT teams

would rather learn the new upcoming technology rather than focusing on the daily management

tasks.

Today’s businesses

require the ability to

recover data from

minutes ago versus

last night’s backup. An

easy calculation for

recovery times is if it

takes one (1) hour to

backup data, it will

typically take two (2)

hours to recover it with

traditional backups.

5 | P a g e

Another driving factor for poor patch and AV management is that these lower-level tasks are often

delegated to junior IT staff without the appropriate controls to validate. As a result, critical tasks

which are essential to protection and recovery are often overlooked due to the backlog of Critical

and Important tasks that fill up the ticketing queue for those who have ticketing systems. For the

lesser sophisticated staff that does not leverage a ticketing system, these crucial tasks are lost.

Delegating low-level tasks does not mean you are minimizing the criticality or delegating the

responsibility; it simply means controls such as reporting must be in place to validate on a routine

basis.

Conclusion In summary, the security landscape has significantly changed over the last several years

and businesses must invest in strategies not only to prevent a malicious attack

while protecting data but also have the enhanced recovery abilities. In

the past many businesses would elect to repurpose budgets allocated to

security towards higher prioritized projects. Risks today expand beyond

an inconvenience to downtime and possible data corruptions that places

customers and revenue lines at risk.

Data protection has to extend beyond standard backups to enterprise-

class systems that enable offsite replication and instant recovery. In

addition, solutions have to expand beyond backups to provide high

availability to essential data.

The lower skilled tasks do not lessen the level of urgency to ensure backups

and patches are pushed out on a routine basis. Accordingly, management

must deploy appropriate controls to validate these tasks are completed.

DSM recognizes that budgets can limit an organizations ability to have a foolproof system,

nevertheless, DSM has leveraged a layered approach that delivers these services at an affordable

cost.

For more information about Information Security and how we can help you, please contact us at

863-802-8888 or security@dsm.net.