Information Security Blog

Information Security Implementation Without Operation

Implementation Without Operation Leads to Litigation

Brian Krebs posted a story on his blog about a California bank that was sued by one of its business customers that alleged the bank failed to use security controls described in its online banking contract that were intended to prevent unauthorized electronic transfers.

broken Village View Escrow, the company suing Professional Business Bank, lost $465,000 after its computers were infected with the Zeus Trojan and wire transfers were sent around the world. According to Krebs, this happened despite the fact that, “Village View’s contract with Professional Bank stated that electronic transfers would only be allowed if they were authorized by two Village View employees, and confirmed by a call from specific Village View phone numbers.”

The security controls implemented in the online banking contract sound pretty good but when it comes to information security, implementation is only half the battle. If those well-designed controls are not operated effectively, then the result is $465,000 ends up missing and someone gets sued. At Pivot Point Security, we offer three different types of information security assessments for this exact reason.

Our Design Assessments determine whether the appropriate controls were designed or implemented. This assessment provides a limited amount of assurance and is best used in environments that aren’t operational, e.g. the design/build phase of a new application or establishment of a new information security management system for ISO 27001 certification.

Our Compliance Assessments validate that the established controls operate as intended. This assessment provides a higher level of assurance because the recipient of the report knows whether the right controls are in place and the business operations are complying with them. A Compliance Assessment is best used in operational environments with strict contractual, legislative or regulatory requirements (e.g. HIPAA, PCI) or environments where non-compliance with security controls is not transparent to all stakeholders (e.g. online banking customers) and the effects of non-compliance may not have an immediate impact but still pose a significant threat.

Our Substantiative Assessments validate whether security controls actually achieve their objectives. In Professional Bank’s case, the control objective may have been to prevent unauthorized electronic transfers and the security controls implemented to achieve that objective were authorizations by two Village View employees and confirming transfers from authorized phone numbers. A Substantiative Assessment provides the highest level of assurance because the recipient of the report knows whether the right controls are in place, operating as intended and achieving their goals to mitigate risk.

If Professional Bank followed the security procedures in its online banking contract but the thieves impersonated two Village View employees calling from the authorized phone numbers, then the result would still have been the same. A Substantiative Assessment will identify whether there are additional weaknesses or compensating controls in a business process outside the specific controls being tested. This type of assessment is best used in operational environments where security is more important than compliance (e.g. critical infrastructure, finance, intellectual property, etc.).

Which type of information security assessment is best suited for your business in terms of a service provider? Does it change in terms of outsourcing?

Free Download: A Best Practices Guide to Database Security

Because data is only as secure as the systems & processes it relies on – a holistic approach to data security is essential. This roadmap is not meant to be exhaustive but rather to stimulate the necessary thought process to put you on the path to good data security.

Free Whitepaper: Stop Wasting Money on Penetration Testing

Penetration Testing is most frequently performed to:

Substantiate the net effectiveness of a mature control environment
Prove to a third party that an environment is secure/trustworthy
Quickly assess the security of a less mature control environment (in a sense a technical risk assessment)
To validate that significant changes did not have unanticipated results

Free Download: ISO 27001 Implementation Roadmap

Have no fear – our “roadmap” will guide you, step by step, through the entire ISO 27001 process.

Getting to ISO 27001 certification is a process made up of things you already know – and things you may already be doing!

Best Practices for Firing A Network Security Administrator

Want to know how to fire a Network Admin? Need to know what precautions to take? Firing any employee can be a stressful event. Firing one who has significant knowledge of and privileged access to your Information Technology/Security infrastructure is even more stressful, as the risks are so notable.