What bad security habits do we need to give up in 2016?
2015 played host to some significant cyber breaches. Experian, TalkTalk and Ashley Madison all fell foul of malicious attacks, and they weren’t the only ones. In 2016, businesses need to resolve to do better – but the question is, how? What bad security habits need to be given up to ensure a safer, more secure experience next year? What lengths could, and indeed should, have businesses gone to last year in order to prevent some of the data breaches that occurred?
Industry experts elaborate on what they believe needs to be done better in 2016, and how to leave those bad habits behind.
Jeremiah Grossman, Founder of WhiteHat Security:
"2016 is the year companies must resolve to get better at web security. A lot better. Let’s look at just one of the past year’s major breaches — TalkTalk. TalkTalk, a major UK telecoms operation, was arguably one of the most widely reported breaches of the year with reputable media reports suggesting the attack was carried out through SQL injection. SQLi gives a remote attacker the ability to run commands against the backend database, including potentially stealing all the data contained in it. This sounds bad because it is.
The more we learn about incidents like TalkTalk, the more we see that these breaches are preventable. We know how to write code that’s attack-resilient and we know multiple methods for fixing vulnerabilities and defending against incoming attacks. All it takes to stop these breaches from happening is doing the things we already know how to do. Doing the things we already know work. Let’s make 2016 the year we take web security seriously."
Perry Correll, Principal Technologist, Xirrus Networks:
"Xirrus recently polled Wi-Fi users and found that 76 percent connect to Wi-Fi outside of their home. Public Wi-Fi offers the convenience of accessibility, but typically doesn’t encrypt data, which leaves passwords exposed and sensitive data vulnerable to the possibility of capture by those with malicious intentions.
It’s bad enough worrying that while sipping a latte, cyber criminals might be trying to steal your credit card data and bank account numbers, but even more daunting to know that corporate espionage is on the rise. Hotel Wi-Fi networks, which are notoriously easy to breach, offer hackers little challenge when it comes to intercepting private or classified information accessed by executives who stay in hotels on business. Now more than ever, large and small enterprises—from coffee houses to airports and hotels—must upgrade their networks to provide better security for their customers."
Wieland Alge, VP & GM EMEA, Barracuda:
"All IT Security experts should try to give up ‘SEP’ – the concept of ‘Somebody Else’s Problem’. As The Hitchhiker's Guide to the Galaxy’s Ford Prefect described it: “An SEP is something we can't see, or don't see, or our brain doesn't let us see, because we think that it's somebody else's problem.”
SEP behaviour exists right across the IT security community because we’ve often been treated as nerds, techies and obstacles to business.
If the business IT team move some web applications into the cloud without telling the IT security team, then – despite it being business IT’s problem – we know that the apps no longer have the protection of a proper firewall/WAF and we should really help resolve it. Likewise, we can’t continue to say 'Cool, no attacks coming!' whenever the internet goes down.
A good New Year’s Resolution would be to actively search for ‘SEPs’ and fix them.”
Mark Edge, UK Country Manager, Brainloop:
“The General Data Protection Regulation (GDPR) arrives in 2017, so CISOs should spend this year resolving bad data protection practices.
The regulation will address the changing way businesses operate in the modern world, with a focus on protecting data stored and transferred in and out of Europe. It may be surprising to hear that malicious, or, more likely, careless employee behaviour is the number one threat to data security. Email, especially personal email, is simply not secure enough to communicate highly sensitive information, whilst consumer-grade file sharing solutions have little in-built security and no audit trail. USB drives, instant messaging and hard copies of confidential documentation also present a clear data protection problem.
CISOs must break bad habits with a positive change, so instead of placing cumbersome restrictions upon employees, they should implement intuitive and highly-secure collaboration tools that form positive habits and an easy transition ahead of the GDPR.”
GfK and VMware: Innovating together on hybrid cloud
GfK has been the global leader in data and analytics for more than 85 years, supplying its clients with optimised decision inputs.
In its capacity as a strategic and technical partner, VMware has been walking GfK along its digital transformation path for over a decade.
“We are a demanding and singularly dynamic customer, which is why a close partnership with VMware is integral to the success of everyone involved,” said Joerg Hesselink, Global Head of Infrastructure, GfK IT Services.
Four years ago, the Nuremberg-based researcher expanded its on-premises infrastructure by introducing VMware vRealize Automation. In doing so, it laid a solid foundation, resulting in a self-service hybrid-cloud environment.
By expanding on the basis of VMware Cloud on AWS and VMware Cloud Foundation with vRealize Cloud Management, GfK has given itself a secure infrastructure and reliable operations by efficiently operating processes, policies, people and tools in both private and public cloud environments.
One important step for GfK involved migrating from multiple cloud providers to just a single one. The team chose VMware.
“VMware is the market leader for on-premises virtualisation and hybrid-cloud solutions, so it was only logical to tackle the next project for the future together,” says Hesselink.
Migration to the VMware-based environment was integrated into existing hardware simply and smoothly in April 2020. Going forward, GfK’s new hybrid cloud model will establish a harmonised core system complete with VMware Cloud on AWS, VMware Cloud Foundation with vRealize Cloud Management and a volume rising from an initial 500 VMs to a total of 4,000 VMs.
“We are modernising, protecting and scaling our applications with the world’s leading hybrid cloud solution: VMware Cloud on AWS, following VMware on Google Cloud Platform,” adds Hesselink.
The hybrid cloud-based infrastructure also empowers GfK to respond to new and future projects with astonishing agility: Resources can now be shifted quickly and easily from the private to the public cloud – without modifying the nature of interaction with the environment.
The gfknewron project is a good example – the company’s latest AI-powered product is based exclusively on public cloud technology. The consistency guaranteed by VMware Cloud on AWS eases the burden on both regular staff and the IT team. Better still, since the teams are already familiar with the VMware environment, the learning curve for upskilling is short.
One very important factor for the GfK was that VMware Cloud on AWS constituted an investment in future-proof technology that will stay relevant.
“The new cloud-based infrastructure comprising VMware Cloud on AWS and VMware Cloud Foundation forges a successful link between on-premises and cloud-based solutions,” says Hesselink. “That in turn enables GfK to efficiently develop its own modern applications and solutions.
“In market research, everything is data-driven. So, we need the best technological basis to efficiently process large volumes of data and consistently distill them into logical insights that genuinely benefit the client.
“We transform data and information into actionable knowledge that serves as a sustainable driver of business growth. VMware Cloud on AWS is an investment in a platform that helps us be well prepared for whatever the future may hold.”