The Cyber Threats Keep Coming

The cyber risks that confront businesses seem to be multiplying. Hacktivists have staged attacks that brought down the websites of major banks, companies are fretting about thefts of intellectual property, there are regular reports of breaches that expose the personal data of large numbers of consumers, and the White House is warning about the possibility of attacks targeting critical parts of the U.S. infrastructure.

Cyber criminals are also increasingly sophisticated, able to slip through the security measures organizations employ. And the price tag for cyber events is rising. The Ponemon Institute’s 2013 study of the cost of cyber crime found the average annual cost for organizations was $11.56 million, up 26% from the previous year. According to Ponemon, companies are seeing more successful cyber attacks and it takes them longer to resolve such attacks.

Amid such changes, companies’ traditional approach to IT security is evolving.

“Historically, information security has been perimeter-based,” said Bob Parisi, a senior vice president and technology, network risk and telecommunications specialist at insurance brokerage Marsh. “You dig a moat, fill it with water and alligators, build a wall, put archers on top, put all your valuables inside, and let people in through the gate.

“Mobile devices, especially the very popular concept today [of ‘bring your own device’], sort of exploded that concept, so there’s no longer a perimeter per se,” said Parisi, pictured at left. IT departments are adapting, he said, by making changes ranging from locking down disk drives and USB ports, to monitoring emails to ensure nothing inappropriate is entering or leaving the company’s systems, to utilizing secure gateways or virtual private networks, he said.