[Comment] The Enemy Within: Employees, Agents and Company Data
If your business traded gold, you would probably keep your yellow bars behind bars and only entrust one or two people with the key. But do your protect your valuable virtual assets as securely and what happens if you don’t?
The number of security breaches affecting UK business continues to grow, with 93 percent of large organisations and 87 percent of small businesses reporting incidents last year.
Logic might suggest the main threat comes from outside, but increasingly it is those on the inside, entrusted with access, who misuse or steal company data. It isn’t just the likes of Aviva and Wm Morrisions who have suffered recently: staff-related incidents have risen particularly sharply in small businesses, with 57 percent reporting a breach in 2013, up from 45 percent the year before.
No business likes to believe it is an easy target and most business owners naturally assume their database is safe - because only a few people have access and they trust their staff.
Many employ cutting edge software systems requiring biometric triggers to enable approved personnel to log on and may also, or alternatively, use system monitors to examine IT processes to identify unusual patterns of behaviour and access.
But what happens if there is a business requirement to share parts of internal systems and data with third parties, such as clients, agents, distributors or others? What sort of access should be provided, and is it sensible to use a standard piece of software and rely upon built-in security to ring fence virtual assets?
Intellectual property law specialists Virtuoso Legal recently helped a client who had provided a third party with access to confidential data stored on an off-the-shelf product, and learnt the hard way that it gave them nowhere near enough protection.
When the client fell out with an overseas agent, who had a login and password that gave them unlimited access to files, they found that confidential information and customer data had been handed over to a competitor.
Although Virtuoso Legal secured an injunction and other relief from the court barring the perpetrators from spreading malicious stories, there was no similar gag for their ‘friends and family’. The ensuing social media storm was impossible to control.
Liz Ward, Principal at Virtuoso Legal, sets out the lessons from this episode: “Your database is highly likely to be one of your most important business assets and you should treat it as such. So make sure it can’t be accessed by just anyone and that all access is monitored.
“If you are using industry-standard software it is sensible to ensure that there are built-in security systems. Check that you know how to use these, and that they are appropriate and meet the requirements of your business. You need to make sure you ring fence information so it can only be viewed by those who really need to see it.”
She also emphasises the importance of customer care: “Respond quickly to any complaints, especially the vocal ones on social media. Remember, social media is just that, a conversation broadcast to the public.
“If everyone is happy, then it’s fine. But it’s almost impossible to control the reach of a negative message and this can badly damage your business, even if the initial complaint was fairly trivial.”
Aside from the reputational and commercial damage a data security breach can cause, businesses can easily fall foul of their legal obligations. The European Parliament is also considering a law that would make companies liable for a fine of five percent of their global turnover if they suffer a serious data breach.
Article contributed by Virtuoso Legal
GfK and VMware: Innovating together on hybrid cloud
GfK has been the global leader in data and analytics for more than 85 years, supplying its clients with optimised decision inputs.
In its capacity as a strategic and technical partner, VMware has been walking GfK along its digital transformation path for over a decade.
“We are a demanding and singularly dynamic customer, which is why a close partnership with VMware is integral to the success of everyone involved,” said Joerg Hesselink, Global Head of Infrastructure, GfK IT Services.
Four years ago, the Nuremberg-based researcher expanded its on-premises infrastructure by introducing VMware vRealize Automation. In doing so, it laid a solid foundation, resulting in a self-service hybrid-cloud environment.
By expanding on the basis of VMware Cloud on AWS and VMware Cloud Foundation with vRealize Cloud Management, GfK has given itself a secure infrastructure and reliable operations by efficiently operating processes, policies, people and tools in both private and public cloud environments.
One important step for GfK involved migrating from multiple cloud providers to just a single one. The team chose VMware.
“VMware is the market leader for on-premises virtualisation and hybrid-cloud solutions, so it was only logical to tackle the next project for the future together,” says Hesselink.
Migration to the VMware-based environment was integrated into existing hardware simply and smoothly in April 2020. Going forward, GfK’s new hybrid cloud model will establish a harmonised core system complete with VMware Cloud on AWS, VMware Cloud Foundation with vRealize Cloud Management and a volume rising from an initial 500 VMs to a total of 4,000 VMs.
“We are modernising, protecting and scaling our applications with the world’s leading hybrid cloud solution: VMware Cloud on AWS, following VMware on Google Cloud Platform,” adds Hesselink.
The hybrid cloud-based infrastructure also empowers GfK to respond to new and future projects with astonishing agility: Resources can now be shifted quickly and easily from the private to the public cloud – without modifying the nature of interaction with the environment.
The gfknewron project is a good example – the company’s latest AI-powered product is based exclusively on public cloud technology. The consistency guaranteed by VMware Cloud on AWS eases the burden on both regular staff and the IT team. Better still, since the teams are already familiar with the VMware environment, the learning curve for upskilling is short.
One very important factor for the GfK was that VMware Cloud on AWS constituted an investment in future-proof technology that will stay relevant.
“The new cloud-based infrastructure comprising VMware Cloud on AWS and VMware Cloud Foundation forges a successful link between on-premises and cloud-based solutions,” says Hesselink. “That in turn enables GfK to efficiently develop its own modern applications and solutions.
“In market research, everything is data-driven. So, we need the best technological basis to efficiently process large volumes of data and consistently distill them into logical insights that genuinely benefit the client.
“We transform data and information into actionable knowledge that serves as a sustainable driver of business growth. VMware Cloud on AWS is an investment in a platform that helps us be well prepared for whatever the future may hold.”