Respected global industry analysts, Forrester Research, has forecast the demand for database security services will grow considerably over the next 3 years. This comes on the back of a number of high profile database breach stories reported in the press over the last few years which has affected financial services, corporate and government organisations alike (see link to commentary below).

As the threat to databases continue to rise through rogue insider effort, cybercriminal activity, web application use and remote mobile access, the risk to confidential and sensitive data is coming more under attack. Monitoring and reporting to management of potential fraudulent or malicious activity taking place at the database level of the organisation, plus alerting of vulnerabilities being created to possibly expose management to an attack on their key data, are just two of the areas where the report highlights services will be in demand over the next few years.

For full details on the Report commentary see the link below -     

http://www.darkreading.com/database-security/167901020/security/news/231700002/database-security-market-to-grow-20-percent-through-2014.html

The recent rioting in London, and other major English cities, has taught us one thing if we ever wondered why we need CCTV cameras in our country.

The fact that the cameras were monitoring, recording and reporting back what was happening not only helped identify, and possibly help convict, some of the perpetrators of the looting which was going. It also helped alert police, fire and ambulance services – and management of businesses affected – where potential fraudulent or malicious activity could be heading for next unless the rioting was stopped.

Sometimes you don’t anticipate where, or when, trouble is going to happen. When it does happen, however, you need to have immediate alerting and reporting of what is happening so that you can take mitigating action – and see the perpetrators of the potential abuse – to limit the impact of the action.

Were the looters of the shops and offices aware that CCTV cameras were picking up there every move? Probably not. However, if they had been told in advance that monitoring controls would not only record what they were doing but also identify them as potential perpetrators of the crimes they were committing would they still have gone ahead and carried out the crimes? Possibly, but they would have been silly to do so if they thought that they would be caught.

Monitoring of data security is the exactly same. Think that your actions on data, or the security surrounding data, are not being recorded then you might think about committing a data breach. Know that there are CCTV cameras watching your actions on data then you might think again.

The perpetrators of the looting just highlighted why you need to have monitoring controls to capture evidence of certain aspects of “human nature”. It’s not to spy on everyone. In fact, it’s to vindicate the “good guys” and capture the “bad guys” so think of it that way.

Management of data breach cases over the last year take heed! Monitor for rogue insider activity and/or for cyber criminal activity, and for security vulnerabilities to your data. Security at the perimeter is no longer good enough, or deep enough, to protect your data.

Just tweeted about yet another data breach story where Arizona’s police force computer system has been hacked and confidential documents stolen and published on line.

A spokesman for the police force has told Reuters “We are aware of computer issues. We’re looking into it. And of course we’re taking additional security safeguards”.

This almost appears to have been the default statement being handed around from data breach victim to data breach victim over the last couple of months telling their clients, stakeholders and the outside world that they are aware of security issues surrounding their data but they are now going to take action to resolve them.    

Forgive me but that seems to be a reactive data security strategy rather than a proactive one, and backs up the weaknesses I have written about in data security strategies where businesess and organisations are being encouraged to put in “adequate” controls to protect their data (see my blog of June 6 2011)

Once a data breach story is out there damage is already done. The data has either been lost or put up on line (or sold to the highest bidder) where it can then be used to seriously impact the brand and reputation of the organisation concerned. Board directors and management can start thinking about potential law suits or legal action being taken against them for not having fully protected the source of their data, and market confidence and client attrition has already started to kick in. That’s not to mention fines coming in from the regulators and drop in stock market valuation in the case of some companies.

I heard someone say recently “organisations need to start looking at data security from the inside out and not the outside in”, and by that meaning that we need to look at what we REALLY need to do to protect the source of our data and not do what is just seen to be “adequate”. Perhaps Sony, Nintendo, Sega, Lockheed Martin, the IMF, the CIA and the FBI have exchanged the “we are aware of the computer  issues ………” statement over the last couple of months but the horse, I’m afraid, is already off and running.

Look at where the stable is vulnerable to potential breach and attack, and install a CCTV camera to monitor the activity happening around your stable and maybe, just maybe, you will seen both how and where the horse is going to bolt from the stable before it happen.

Just a thought! 

For details on the police force computer hack see below -

http://www.bbc.co.uk/news/technology-13901478