GT Insurance Blog

Insurance problems and cures

Data Breach – Learn Some Lessons from the Big Companies

leave a comment »

Computer_Drill_10-14You’ve seen data breach announcements at companies like Home Depot and Target.   And Morgan Stanley announced that it fired an employee who stole account data on 350,000 clients.  From those breaches come huge cyber liability lawsuits.

All are big companies with huge market value, large customer databases, strong brand names and plenty of budget to spend on data security.

We in the smaller businesses don’t have all those resources.   But are there lessons from these breaches that can provide learning to the owner or manager of a small business?

Yes, there certainly are.

The key lesson?  In most cases, part or all of the data breach was caused by people very close to the organization:

  • Home Depot – Criminals stole a vendor’s credentials.  Then they exploited a weakness in Microsoft Windows.  Then it looks like Home Depot may not have implemented the existing patch for that weakness.  That would be vendor weakness and poor IT procedures.
  • Target – It looks a Target emplyee clicked on a link in a vendor e-mail; the vendor had been hacked, and the link let criminals in the Target system.  That would be vendor weakness and poor security procedures at the employee level.  A Federal judge is allowing a lawsuit by credit card issuers to proceed against Target.
  • Morgan Stanley – Morgan Stanley is said to have caught the employee before the majority of the information was published or sold.  They said they’ve turned the information over to law enforcement.

These company probably spend more on data security that you or we bring in with total sales. And they were still burned.

What should you learn from their examples? (Our thanks to IT Radix for much of this material.  Click here to visit their page for more info or to get their help with IT problems.)

1) People you know are the most likely cause of a breach.  A former employee, a careless employee, an employee not implementing security, a vendor opening your door to hacking.

2) Have a secure back up program in place both onsite and offsite – ensuring that at least one part of the backup program is not directly attached to your network.

3) Have a password policy in place and follow it.  It should include:

  • A password strength protocol
  • A password change policy
  • A plan to change passwords

4) Consider putting an employee monitoring program in place that will help:

  • To monitor and filter website and web traffic
  • To guard against company secrets being shared via email
  • Delete files or lock a computer if a laptop is stole

5) Whether a user is accessing company files in the office or remotely, ensure that your file access permissions are correct and that at least double security identification measures are in place.

6) Put a strong email program in place where:

  • Email is backed up
  • Email is encrypted as it goes through the Internet.

7) Ensure that anti-virus and malware protection is in place and up to date.

8) Server and computer operating systems, software, anti-virus software, firewalls, applications of all sorts should patched and updated regularly – some daily.

9) Consider putting a hardware firewall appliance in your network and if outsiders need access to some company data, place that data outside / securely apart from the internal company network.

10) Separate your secure Wi-Fi network from any that guests use to access the Internet.

11) Cover yourself with data breach insurance for your own problems, and cyber liability insurance for losing control of client information.

The smart business owner or manager may not have heard all these recommendations before, but they are becoming survival issues for any organization, regardless of its size.

While we’re happy to talk about data breach insurance issues (in NJ 800-548-2329), the first stop is a good IT organization.  Call a good provider like IT Radix (at 973-298-6908.)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

%d bloggers like this: