The future crimes of the New Economy include the willful violation of personal privacy for financial gain, extortion through the theft and ransom of proprietary and financial data, massive financial fraud and embezzlement schemes, theft of trade secrets, and theft of identity. Most readers of this column will have taken many steps to improve information security. We recommend that firms prioritize limited resources on the basis of a hierarchy of need. First priority, for firms with an Internet presence of any degree, the highest priority is to ensure that all external communication paths are protected. Perimeter protection includes vigilance such as hardening platforms and applications against attack, and ensuring that all necessary patches are up to date.
Next priority is to improve account management.
Many successful hacks come in through accounts on platforms that are incorrectly configured - it is not uncommon to do a review of system accounts and find several that are still active that belong to former employees or even deceased individuals. Companies are advised to strongly consider an alert and notification service so timely information on patches is received and action taken by appropriate staff. Regular frequent monitoring of systems, including real-time monitoring of critical Internet facing sites is also an excellent idea. In conjunction with this type of monitoring, companies must be prepared with an incident detection and response process. Take care of the low hanging fruit as fast as you can.