SESSION 13 - Information Security - Barbarians at the gateway

Question 1

Whats the article about?

Answer 1

• Information Security is everyone’s business and need to be made a top organizational priority.
• Firms suffering a security breach can experience direct financial loss, exposed proprietary information, fines, legal payouts, court costs, damaged reputations, plummeting stock prices, and more.

Question 2

What are bad apples?

Answer 2

o Around 70% of loss-causing security incidents involves insiders.
 Rogue employees can:
* Steal secrets
* Install malware.
* Hold a firm hostage.
o Temporary Workers:
 Contract workers,
 Temporary staff

Question 3

Whats social engineering?

Answer 3

o Employees who get tricked into revealing information.
o Scams can be made based off Facebook profiles.

Question 4

Whats phishing?

Answer 4

o Refers to cons (fraud) executed through technology.
o Con artists can fake bank, government, job emails through logos, standard outlines, etc.
o Some attempt to lead a person to downloading a dangerous software, which gives them information into the laptop. (Passwords, data, etc.)
o Spear Phishing specifically target a given organization.

Question 5

Whats malware?

Answer 5

o Seeks to compromise a computing system without permission.
o Has access to mobile devices, embedded devices, and firms networking equipment.
o Uses weaknesses such as browsers, plug-ins, etc.
o Methods of infecting:
 Virus:
* Programs that infect other software or files.
 Worms:
* Programs that take advantage of security vulnerability to automatically spread.
 Trojans:
* Exploits, like a trojan horse, without the victim seeing what it is.

Question 6

What are the key takeaways?

Answer 6

• Many organizations are bound by security compliance commitments and will face fines and retribution if they fail to meet these commitments.
• The use of frameworks and being compliant is not equal to security. Security is a continued process that must be constantly addressed and deeply ingrained in an organization’s culture.
• Security is about trade-offs- economic and intangible. Firms need to understand their assets and risks to best allocate resources and address needs.
• Information Security is not simply a technical fix. Education, audit, and enforcement regarding firm policies are critical. Involvement and commitment is essential from the boardroom to frontline workers and out to customers partners.