Technology & Innovation

Fundamentals 4 + 5: Spotlight on security grows after high-profile cyberattacks

May 14, 2015

Global

May 14, 2015

Global
Riva Richmond

Former editor

Riva Richmond is Director of Digital Media at The Story Exchange, a nonprofit digital media project that tells the stories of women entrepreneurs in articles and videos. Previously she worked as a Senior Editor with The Economist Intelligence Unit's Thought Leadership team in New York. She has reported and written about technology more than a decade, much of that time focused on information security and privacy issues. Prior to her current position, Riva was a freelance journalist writing for The New York Times, Entrepreneur.com, The Wall Street Journal and other national publications.

Contact

Mapping the cloud maturity curve

After a string of high-profile hacks, pressure is mounting on companies to renew their focus on data protection.

How sound are your corporate cloud systems, and how safe are the sensitive data inside them?

Recent security breaches at Sony Pictures, Home Depot and Target have proved again that hackers’ ability to and determination to penetrate corporate networks are only increasing. And they have revealed that current data-retention and governance policies, access controls and security defences—in the cloud and elsewhere—are insufficient, even at large, high-profile companies. 

When such corporate titans are compromised, the damage to reputations and businesses can be substantial. When stolen customer and employee data lead to identity fraud, individuals can suffer significant personal losses. When enough companies and people are victimised, concerns about the risk that cybercrime poses to the economy grow—and governments take notice. 

Governments take notice—and take action 

In the US, a number of states are moving to stiffen laws on disclosure of security breaches that compromise consumers’ sensitive personal information. Most recently, on January 15, Attorney General Eric Schneiderman of New York proposed legislation that could become the nation’s strongest breach-notification law, surpassing the standard set by California’s law in 2013. Florida tightened its requirements last summer.

The federal government could soon follow. In advance of his State of the Union speech in January, President Barack Obama called on Congress to pass broad legislation to bolster information security to protect government, businesses and consumers. Congress has been unable to agree on a cybersecurity bill for several years, but the president said recently that he thinks the issue is ripe for a deal with Republicans.

Indeed, considerable support for such legislation can be seen in the business community, which increasingly recognise that industry cannot fend off cybercriminals on their own.

Bipartisan interest, business support

In a series of recent proposals, the president laid out a plan to encourage companies to share more information about cyberattacks that they sustain with the Department of Homeland Security, which would then share that information with relevant government agencies and private-sector information-sharing groups. In exchange, those companies that have taken steps to safeguard customer information with certain privacy restrictions and security measures would gain “targeted” protection from legal liability.

The president’s plan also envisions stepped-up prosecution of online crimes, including the sale of “botnets”, or networks of computers hijacked and controlled by criminals using malicious software, and the stolen bank-account and credit-card numbers of Americans.

“Much of our critical infrastructure—our financial systems, power grids, pipelines, healthcare systems—run on networks connected to the Internet. So this is a matter of public safety and of public health,” President Obama said on January 13. Criminal hackers now do as much, if not more, damage than conventional criminals, he said.

Will companies move—or be moved?

With pressure mounting, the spotlight on corporate data governance, security and privacy policies will only grow more intense. Companies would do well to renew their focus on data protection—including their approach to cloud infrastructure and the integrity and security of data afforded by appropriately set up and configured systems—before a hacker or a regulator forces them to. 

By Riva Richmond, former Senior Editor, The Economist Intelligence Unit

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week