By Subashini Selvaratnam
It is a known fact data and information is the most strategic asset in any organisation. So, it comes as no surprise that we create 2.5 quintillion (one quintillion is equivalent to 1 followed by 18 zeros) bytes of data a day.
“About 90% of the data in the world today has been created in the last two years alone, based on IBM research” said Richard Sheng, director of business development and product marketing, APAC marketing department at Trend Micro Inc.
He added information is valuable because it helps organisation to identify trends, understand customer behavior, analyse opportunities as well as discover efficiencies.
“Information is the greatest asset that must be protected at all times as it contain sensitive particulars related to payment card industry, intellectual property, personally identifiable information (PII) and protected health information (PHI),” he said.
 |
| (L-R): Goh Chee Hoe, Anwer Yusoff, Richard Sheng, Ken Low, Laurence Si, Teh Lip Guan |
PII relates to any data that could identify a person such as a name, fingerprints, driving license number, etc while PHI relates to a person’s health care condition, payment history, etc.
“As organisations empower their business i.e. improve business agility by providing quick and intuitive access to the right information, tools and applications, they also need to protect information from theft and loss,” explained Sheng.
“When an organisation embarks a journey to the cloud, it needs to protect sensitive information, comply with regulations while controlling costs,” he said in the media conference at the recently concluded CloudSec 2013 summit, which was held in Kuala Lumpur last week.
Sheng said nowadays cyber threats are getting more personal with the aim of getting valuable information from the victims for financial gains. The hacker gathers information about the victims or even organisations via social networking media such as Facebook, Google + and LinkedIn.
“They target the victims via spear-phishing attack to gain valuable information, which can go undetected for a few months,” he explained.
According to Sheng most organisations perceive data breach as the main concern for information security. This is because a lot of data breaches are via targeted attacks or what have come to be known as advanced persistent threats (APT). The availability of information on the Internet allows attackers to gain relevant data on their chosen targets, making their APT campaigns more effective.
Spear-phishing, for example, continues to be a favoured means by APT attackers to penetrate the targeted networks. In a typical spear-phishing attack, a specially crafted email is sent to specific individuals from a target organisation.
The recipients are convinced through clever and relevant social engineering tactics to either download a malicious file attachment or to click a link to a malware or an exploit-laden site, starting a compromise, based on Trend Micro’s white papers.
“To safeguard information, many organisations are still investing on anti-virus and anti-malware solutions. Organisations should improve their existing defenses and consider what types of and how much information they make available online,” he explained.
Developing Cloud Security Guidelines
Highlighting on the need for guidelines, the spokespersons agreed that the need for guidelines would be the single most important factor for ensuring success in the cloud.
Cloud Security Alliance (CSA)’s chairman for Asia Pacific executive council Ken Low said customers and cloud service providers need to discuss the roadmap and issues to embark on the journey to cloud.
He said the CSA guidelines can helps them to set-up a stable and secure baseline for cloud operations. The guidelines provide a practical, actionable roadmap to managers wanting to adopt the cloud paradigm safely and securely.
“This guideline is a set of best security practices CSA has put together for 14 domains involved in governing or operating the cloud such as cloud architecture, governance and enterprise risk management to security as a service,” he explained at the media conference in CloudSec 2013 summit recently.
They can refer to this guideline, which is called the CSA’s “Security Guidance for Critical Areas of Focus in Cloud Computing V3.0, at www. cloudsecurityalliance.org.
He added that organisations should also discuss with their cloud service providers on types of security tools and technologies for the cloud as well as the implementation and managing process involved in cloud projects.
CyberSecurity Malaysia’s head of innovation and commercialisation Anwer Yusoff agreed with Low that organisations need guidelines in order to ensure that the cloud projects are implemented successfuly.
Yusoff said although the local Government has yet to implement cloud projects, he advised organisations to do their “homework” before embarking into one.
“Organisations must know the details in the service-level agreement, should the service provider go bust, for example,” he said.
To encourage cloud adoption locally, Trend Micro Malaysia Sdn Bhd has lined up several initiatives for both customers as well as cloud service providers.
According to Trend Micro’s managing director for Southeast Asia region Goh Chee Hoh the company has been having discussion with several local Statement Governments, Malaysian Administrative Modernisation and Management Planning Unit (MAMPU), Malaysian Research and Education Network (MyRen) and among others.
“Trend Micro also works closely with establish cloud service providers such as Amazon Web Services,” he explained.
He strongly feels that small and medium enterprises (SMEs) should adopt cloud as it saves times and money. For example, SMEs do not need to build their own data centre as the data can reside on the cloud.
“SMEs do not have to worry about hiring IT security personnel as security technologies can be implemented on the cloud, ensuring information is protected,” he said.
“Trend Micro would continue to educate and encourage SMEs users to adopt cloud for businesses,” he added.
CloudSec summits are Asia Pacific’s cloud security events for CXOs and senior managers. These events are vendor-neutral and feature presentations by industry experts who will address a wide spectrum of real-world challenges and strategies in cybersecurity today.
