IT Governance Blog on IT governance, risk management, compliance and information security.

2011 saw a vast growth in the number of malware attacks on businesses and individuals. Hackers are now at a point where they can “wreak havok and access the best-kept secrets of organisations without ever leaving their living-rooms”. From phishing scams, to the Sony hack, 2011 has seen the worst of all cyber attacks. Millions of people’s data has been compromised around the world: hackers have made millions, whilst companies have lost millions. So, will 2012 see a repeat of last year? Or will we clamp down on cyber crime once and for all?

We here at IT Governance Ltd have picked the bad and the very bad to show you just what a year it’s been in cyberspace….

1. Sony PlayStation hack

Now this really was the worst of the worst – names, addresses and card details were stolen from around 77 million people who had accounts with the PlayStation Network (PSN).

2. Student loan phishing scam

Students across the UK mistakenly handed over access to their bank details after receiving an email asking them to confirm their details. Anywhere between £1,000 and £5,000 was stolen from each student who gave access.

3. Android apps

22 apps were removed from the android market by Google after it was discovered they contained fradulant software. The apps tricked users into sending premium text messages.

4. RIM hack

Blackberry’s blog was hacked after the London riots, warning Blackberry not to assist the police.

5. Local council fined £130,000 for breach of DPA

Powys Council, England, was fined £130,000 after the details of a child protection case were sent to the wrong person. This was one of the largest fines the ICO have actioned against a council. Read more >>

6. WikiLeaks

WikiLeaks was responsible for releasing top secret information about governments across the world on its website.

7. NHS Breach

Lulzsec hacked the NHS, alerting them that their information security management system was inadequate. However, they put on the “white hat” approach, publicizing the hack but not revealing any compromising information.

8. Gmail phishing scam

Chinese identity thieves used ‘spear phishing’ tactics to take over hundreds of Gmail accounts, including those belonging to senior officials and military personnel.

9. Epsilon data breach

Epsilon, the email communication giant was hacked in March 2011, where customer email lists were stolen from at least 26 different companies.

10. RSA attack

One of the most high-profile breaches of 2011 involved the world’s most-used two-factor authentication systems. Hackers stole information relating to RSA’s SecurID system, by mimicking RSA naming conventions to avoid detection. What was so unique about this case, was that only one attack on an RSA customer was ever reported, showing that the counter-actions RSA took were extremely effective.

Source: Security News Daily, Information Week and Real Business.

The lesson to take away from these hacks and breaches is that companies and individuals alike need to be educated on cyber issues. There needs to be an understanding of what to look out for, what to click and what not to click, who to give your details to and who not to, and to generally be alert, rather than sticking our heads in the sand.

Education will help combat cyber issues and prevent repeat attacks occurring in 2012.

We have a number of staff awareness training courses available at IT Governance, covering DPA, Information Security and ISO 27001 and PCI DSS training. These are extremely effective and affordable, considering no travelling or other course attendance costs are incurred, as learners can study from their desk in their spare time.

Book your e-Learning course today >>

ENISA has just released their first EU report on the cyber security challenges that the Maritime Sector face. The report highlights that maritime cyber security is low, to virtually non-existent, showing little difference between now and 8 years ago….

This report is extremely startling as 90% of the EU’s external trade, and more than 40% of the internal trade takes place via maritime routes. If this was to be disrupted by a cyber threat, then it would have disastrous consequences for the EU Member States’ governments and social wellbeing. Trade, resources and leisure would all be severely affected.

ENISA suggest there should be regulations and policies considering cyber security, on a risk-based approach. Better information exchange and statistics on cyber security is also needed to help people understand and improve their own actuarial models and help reduce risks.

The report shows that little has changed in the 8 years since the Port of Houston was crippled by a cyber attack, allegedly committed by a teenager back in 2003. As a result, data (tides, water depths and weather) to help pilots navigate through the harbour and by shipping companies became inaccessible. The UK teenager was accused of ‘electronic sabotage’, bringing down the Internet systems of the worlds 8^th busiest maritime facility, whilst attempting to extract revenge on a fellow IRC user. The recent ENISA study has shown that the state of the Maritime Cyber Security infrastructure has not changed since the attack, leaving it vulnerable to further cyber attacks.

Modern containerships and oil tankers are highly automated and manned by a small number of crew relying on automated systems. Additional harbours and container ports are also highly automated, meaning that the whole maritime network would come to a standstill if disrupted by a cyber threat. The recent Stuxnet and Duqu attacks have shown that industrial systems as well as traditional computer systems are vulnerable to cyber attacks.

Considering how important the maritime trade is to the EU, and that attacks on critical infrastructure are increasingly becoming common, it just shows how serious cyber security in the maritime industry needs to be taken.

Protect your company from cyber threats with the complete cyber security toolkit: The No 3 ISO27001 Comprehensive ISMS Toolkit.

Use this toolkit to implement your very own ISO 27001 (the world’s only cyber security standard) project. Coming with complete documentation and books to guide you through the process, this all-inclusive toolkit will have your business’ cyber defences up in no time.

Take action now against cyber threats with the No 3 ISO27001 Comprehensive ISMS Toolkit >>

We know it’s the season of good will, for giving and for spreading Christmas wishes, but the worst thing you could do is to spread your company’s confidential data across the web.

With cyber attacks on the rise, companies are building up their cyber defense systems – and so should you! Just because it’s the festive season doesn’t mean you’re safe from an attack; in fact, hackers are more likely to attack when they know barriers are down.

Read Cyber Risks for Business Professionals: A Management Guide to truly understand the risks involved with online threats. As an eBook, you’ll be able to download it straight away for some reading over the holiday period. This book will help you understand and manage the technological risks, familiarise yourself with the legal issues, control employee use of Web 2.0 technologies and use technology to address the risks.

Find out more information >>

Alternatively, if you wanted to get kick started on a cyber security project straight away, then download the No 3 ISO27001 ISMS Comprehensive toolkit. In line with ISO 27001 (the world’s only cyber security standard), this unique toolkit provides complete coverage on how to implement, develop and accelerate an ISO 27001 project within your business.  This toolkit comes with all the documentation, books and guidance you will need to get started and make your company fully cyber secure.

Find out more information >>