- Details
-
Created on Tuesday, 13 November 2012 18:39
The optimism bias, the belief that bad things only happen to other people, seems to be alive and kicking within UK small- and medium-sized businesses (SMBs). That is the disturbing conclusion that can be drawn from a new report published today.
That belief flies in the face of reality according to the new survey undertaken by the Ponemon Institute and commissioned by Faronics. Fifty-four percent of the respondents have experienced at least one data breach in the last year; and almost one in five have suffered more than four. But what worries Faronics is that the remaining 46% of SMBs seem to demonstrate a real lack of awareness of the financial and long-term damage that a breach can have on a company.
One of the problems, Faronics’ VP of product management, Dmitry Shesterin, told Infosecurity is that “SMBs have a huge perception gap. People don’t usually pay attention until its too late and they have to pay the consequence – which is the core finding of the research in the UK.” Shesterin partially blames it on what he calls the FUD (fear, uncertainty and doubt) marketing of the security industry: users get astronomical figures on the cost of cybercrime from all sides, “and people just don’t believe it.” SMBs have difficulty rationalizing the warnings of £1 million cost for a single breach when their turnover is not much greater than that. But the research shows, he added, that breaches happen everywhere, “and it’s just a matter of time before it happens.”
What is surprising, he noted, is that despite (or possibly because of) all this FUD marketing, many of the SMBs don’t even use anti-virus software, which has been the first line of basic security for decades. FUD, it would seem, has had a negative effect: numbing SMBs against security precautions “and opening them up to attacks.”
Traditionally there are three reasons for the lack of security within SMBs: cost (security systems are too expensive to justify); capability (SMBs simply don’t have specialist infosecurity staff); and availability (most security systems target larger corporates rather than smaller SMBs). But, “the main reason I see,” suggested Shesterin, “genuinely and honestly, they do not care – they concentrate on business. The first thing that really jumps at me is that the SMB’s modus operandi for security is that it simply wants to be faster than the slowest person running from the bear.” So long as an SMB has minimal security, the attackers will go for the company with less security. “IT security is a necessary evil that needs to be done, but as cheaply and unobtrusively as possible – and primarily for regulatory reasons.”
A second problem that concerns Shesterin is that within SMBs it is not the IT department – nor any particular security understanding – that drives the security posture. “IT departments usually do security to get their CEO or CFO off their back. It’s not their own priority – they just do what they’re told. And they’re often told what to do because the business owner went to a trade show or has been talking to someone who is doing something and decides he should do it as well.” The implication is that what little security is done by SMBs is not necessarily the best security available.
The fact remains, however, that despite this head-in-the-sand approach by many SMBs, those same companies will be breached sooner or later – and possibly very soon. While disbelieving the FUD of some companies, SMBs are also ignoring the genuine costs of a security breach. The Ponemon research showed that the average cost of a breach to the SMB is nearly £150,000, and that it takes more than nine months to get back to normal.
“There really is no room for nonchalance when it comes to security strategies and it is completely irresponsible to assume the repercussions will be anything less than they are,” continued Shesterin. “Organizations need to know exactly what is at stake in order to readdress existing security practices and ensure they are as well protected as they can be.”
This article originally posted on http://www.infosecurity-magazine.com
- Details
-
Created on Tuesday, 13 November 2012 18:23
Even with smartcards, biometrics, and other multifactor authentication solutions, everyone still uses basic name/password log-on combinations. Security experts always recommend "strong passwords." But what qualifies as a strong password? And how do you avoid creating a password so strong you can't remember it?
According to NIST (National Institute of Standards and Technology), a strong password should contain no fewer than 12 characters, a rule adopted by the U.S. government in 2007 and further defined in the U.S. Government Configuration Baseline. Admin passwords should be 15 characters. Readers may sigh at those lengths, but they've been the recommended minimum for half a decade. Anything shorter is not considered secure.
Sure, many people can and do use shorter passwords. But you should be aware that as you increase the length, you provide greater protection over time. An 8-character password may be fine for a few days of protection, but a 12-character password is generally thought to be long enough to provide protection for a maximum of 90 days. A 15-character password is often considered good protection for up to a year.
The myth of complexity
Most security guidelines also insist on character complexity, which usually means that the password must contain multiple character sets, such as uppercase alphabetic characters, numbers, keyboard symbols, and so on. As I've noted in the past, however, complexity is less important than length. A password of sufficient length can defeat a password guesser or cracker, whereas complexity adds significant value only when the complexity is random or near-random.
Typically, when users are forced into complexity, they use the same types of characters in the same places. For example, when people are required to create an 8-character password with complexity, most will choose a root word in their country's language, with an uppercase first letter (usually a consonant), followed by a lowercase vowel. If they use a number, it will usually be a "1" or a "2" and placed at the end. If they use a symbol, it will usually be one of a handful of characters placed somewhere in the middle, often replacing a letter with a similar shape: an @ or a zero to replace an "o," an exclamation mark for an "i," and so on.
Password attackers know this, and their password cracking tools are optimized to guess at passwords using these patterns. Several security experts, including myself, have analyzed large dumps of captured passwords and found the password patterns I've outlined above to hold true again and again.
For complexity to add significant value, the password must be truly unique and random -- something like %Tv4$H@.<P. But if it's that ugly, people will either write it down or never remember it. Unfortunately, most security auditors and regulations (including PCI DSS) require password complexity. For example, I use a financial website with a maximum password length of six characters, but complexity is required. It makes me want to scream! I'd be much better off with a password of Dogdogdogdog or Iforeverlovedogs.
Some people like to use special password-keeping programs, but I prefer to do something else that is faster for me. I use the same root password (let's say TadPole) in all my passwords, but vary the beginning and the end. One website may be 44TadPole44. Another may be TadPole32, and yet another may be AmazTadPole32On. I have a method to my madness, so the pre- and post-portions make sense to me for particular websites.
Thanks to the common root method, I can keep passwords to hundreds of different websites in my head. Because each password is different, if an attacker compromises one of my passwords on one website, my password commonality remains unknown. Even if they figure out I'm using a common password root -- heck, I'm telling them right here -- they'll have a hard time figuring out the right pre- and post-portions aligned with other websites. None of the currently available password tools can handle that type of replacement complexity when trying different password combinations.
Lie in reply to password reset questions
Just as important as a good, strong password is making your password reset questions unguessable. There are lots of stories (remember the Sarah Palin email hack?) where people who were not even true hackers did a little research and guessed a person's password reset questions correctly. In general, the effort needed to crack reset questions is an order of magnitude less than guessing the actual password. It's the weakest link.
Do what I do and don't answer those questions truthfully. When they ask you your mother's maiden name, the brand of your first car, or your birthplace, you are not obligated to provide correct answers. Instead, pick a common password reset answer for each website and use my password root strategy, remembering to vary the common root word or phrase so you can remember it and associate it with each website.
Anyone can end up with a compromised password. It happens. Websites get hacked. Ingenious, targeted phish emails fool the best of us. But if you follow these recommendations, you can reduce the risk of successful password hack attacks.
