What the UK government can teach organisations about IT security and battling cyber-crime.

Oct. 27, 2010 - PRLog -- Cybercrime is now viewed as a viable alternative to direct military operations, with large scale cyber-attacks already launched against Estonia, Lithuania and Georgia. Due to how dependent individuals, organisations and nations alike have become on technology, the damage a potential attack would be hugely detrimental to any business operation. Criminals are aware of this reliance and are preparing attacks either for financial or political gain.

As criminals seek to diversify their methods, cybercrime has become the fastest growing illegal activity in the world, with over 40,000 Trojans reported in July alone, the volume therefore of online threats should not be underestimated. Trojans for example can be purchased at a relatively low cost, for high impact: making it easier for criminals to initiate attacks.

The UK government launched the Data Handling Review (June 2008) in response to the embarrassing data loss incident which occurred in the HM Revenue and Customs department in which 25 million people’s private information was put at risk by the loss of two discs. The report was established ‘to improve accountability and scrutiny of performance…People have a right to expect that their public services achieve and maintain high standards in this important area (handling information)’. The aims established include ‘to assess and improve procedures for the use and storage of data in government’, this was to be done with ‘stronger accountability mechanisms’, ‘setting clear common standards and procedures’ and the ‘obligatory use of protective measures such as encryption and penetration testing’. In addition to these targets, training was recommended in order to alter the understanding and overall approach to the culture of data handling.

Whilst there have since been data breaches within the public sector, and lessons are being learnt from errors of judgement (such as misplaced unencrypted USBs and discs), the theory of these policies can be transferred to any organisation. It is near impossible to guarantee 100% protection from breaches; however with clear procedures in place, the chance of such an incident occurring is dramatically reduced. The core objectives of the Data Handling Review were to: create sensible and achievable policies, to educate employees about these procedures, change the overall business culture towards IT security, create accountability for actions and finally to introduce assessments to ensure that the changes are actually implemented.

In order to apply these goals, the following questions can therefore be asked of any business:

Which policies are currently in place to protect confidential information?

Are employees fully aware, if not trained, on company policies regarding data storage and protection?

If the IT infrastructure was attacked, is there a backup elsewhere of all of the business’ data?

Aside from, at the very least, an up to date firewall and anti-virus software, what other types of IT security are employed to prevent malicious activity?

If a website is owned: how is it protected it from defacement? Are scans in place to monitor any sites being set up to mirror the original, and to defraud others? If online transactions are performed: how secure are they?  Are all of the website ports protected and operating correctly?

Although the government and other organisations may not have previously operated correctly in terms of IT security and online protection, it is hoped that news about data loss and website attacks will now decrease as awareness increases with the introduction of new policies and spending to proactively protect technology and information, which is now almost taken for granted. The government’s decision to increase spending on cyber-crime should set a precedent for organisations, to employ the policies and approaches necessary to prevent a possible negative impact on business.

If you have any concerns surrounding these issues then please do not hesitate to call (03335555247), email (info@msc247.com) or Tweet (@MSC_247)  Managed Services Centre with your questions, and we will be happy to help find the appropriate solution to suit your needs.

# # #

MSC provide IT management services, your information is completely secure, so you can maintain an impeccable reputation.

Whelp to increase your efficiency and therefore productivity, so you can focus on what you do best.