HR vital for data security - CIOL News Reports

HR vital for data security

Proper security starts in HR dept, feels Neal Gemassmer of Lumension Security

Majnu Babu

Saturday, September 29, 2007

Email This

Print This

Comments

RSS

BANGALORE, INDIA: Human Resources departments in every organization have a vital role to play to ensure data security, according to Neal Gemassmer, vice president, Asia Pacific of Lumension Security Inc., a US-based security management company.

"Organizations should understand better on how to spend on security. Security is not all about firewall, antivirus software, etc. Proper security starts in the HR department. The HR should educate the employees about losing devices, handling and using different gadgets, etc.," he told CyberMedia News.

Gemassmer was responding to a specific query on whether organizations should aim to spend less of their IT budgets on security, as suggested by John Pescatore, Gartner vice-president, at the analyst firm's London IT Security Summit on 17 September.

Pescatore was mooting a model, which he termed as 'Security 3.0'. "In this, IT security would anticipate threats, rather than fight them after they hit."

With new threats being reported almost on a daily basis and analysts predicting more attacks in the offing, is security, as we have now, a journey without destination, as Pescatore said at the Summit?

Gemassmer offered a different view. "Security is an evolution that doesn't stand still and we cannot be complacent about it. Security is not about technology; it's about educating people. Security starts once a person joins the organization. He should understand the company's security strategy."

The Lumension vice president drew an example from the recent instance of hacking on the Bank of India Web site. Even though the site says it is now safe again, "customers will think twice before using the Net; some of them might even opt for another bank," Gemassmer said adding that IT spend on security cannot be decreased on the face of rising threats.

Referring to a recent UK report that said 53 per cent of employees it interviewed admitted to stealing data, Gemassmer argued in favor of more mechanisms to avoid data theft.

"There should be more discovery mechanisms to detect what employees are carrying or doing. The organizations should build the necessary policy, enforce the policy and audit the policy," he said.

Such mechanisms are necessary as there are a lot of free hacking tools available in the market. "Lots of people do not understand what a vulnerability is." This help hackers to find loopholes," Gemassmer observed.

Gartner estimated that more than 70 per cent of unauthorized access to information systems is committed by employees, as are more than 95 per cent of intrusions that result in significant financial losses.

However, Joanna Rutkowska, chief executive of Invisible Things Lab, puts the blame on technology. "Fixing the problem of stupid users doesn't solve everything. I want technology that will allow me, as a savvy user, to feel secure," and this is not available, she said at the Gartner Security Summit in London.

He also pointed at the delay in patching vulnerability. "It takes 60-90 days to patch," Gemassmer said, adding this helps cyber criminals, who launch new attacks every day. "An effective patch management is needed now," he said.

According to a May 2007 report published by the National Vulnerability Database, 24 new vulnerabilities are identified every day, more than half of which are considered dangerous enough to warrant immediate remediation by IT departments.

"Yes and no," Gemassmer said when asked whether new legislations are required to fight cyber criminals. The governments' roles should be limited to ensure that the companies are doing everything to protect themselves, as this would help customers. "As a customer, I have a right to know my data is safe."

However, it is up to organizations to set up stringent measures to protect themselves. This is more applicable to India as it is "strategic in terms of the large number of BPO operations," he said.

Lumension Security (formerly PatchLink Corp.) opened its India office in Mumbai this week. The Scottsdale, Arizona-based security management company plans to expand its India footprint to New Delhi and Bangalore shortly.

©CyberMedia News

Email This

Print This

Comments

RSS

Toon porn star 'Savita bhabhi' under fire

Nokia Eseries unveils E71 and E66

ViewSonic No. 1 in 22-inch LCD monitors

Firefox 3.0 sets new Guinness world record

Reshape disk for free without destroying data

BT to go beyond India IT, telecom sectors

Flavour of the Month: Gates' exit not a big deal for Microsoft

Global server revenue up 2.5pc in Q1-08

Advanced sputtering tool to fabricate hybrid solar cells

Economics of 450mm wafer transition

	Get the bigger IT Picture here
	How resilient is your organization?

	IBM: Internet Security Systems
	HP : Blade Server
	Trend Micro: Stay Ahead of Web Threats

	Open converged networking
	Solving the "lost data" problem
	24x7 availability of IT services globally at Porsche

	HP Business Availability Center
	Transforming Business
	Aligning IT and Business