In March, Hannaford Bros., a Scarborough, Mass.-based supermarket chain, announced someone had hacked into its computer system and exposed 4.2 million debit and credit card numbers, resulting in more than 1,800 fraud cases. Affecting customers in five different states, the data breach underscores–via a very public example–the need for robust network security for all companies regardless of size.
Michelle Drolet, CEO at Towerwall Inc., a Framingham, Mass.-based provider of advanced information security solutions, attributed the problem at Hannaford to malware, a program or file designed to specifically damage or disrupt a system. “The hackers were able to use computer code to infiltrate the system and capture the sensitive data,” Drolet says.
Hannaford isn’t alone in its plight. According to Scott & Scott, L.L.P., a Dallas-based law and technology services firm, 85% of businesses have experienced a data security breach, and of those, fewer than 43 percent had an incident response plan in place. The results can be devastating: Seventy-four percent reported a loss of customers, 59% faced potential litigation, 33% faced potential fines, and 32% experienced a decline in share value.
Midsized firms are particularly vulnerable to network security breaches, Drolet says, because most don’t have security personnel or engineers on staff to serve as a “second set of eyes” for their networks. Without that layer of in-house security, Drolet says, companies can quickly become victims of criminals who are looking to corrupt, steal, and share critical information stored on networks.
Take passwords, for example. According to Bill Carey, vice president of marketing at Siber Systems Inc., the developer of password and identity management software RoboForm, every new password that is issued can effectively decrease the level of network security for a company. And when employees start writing them down, the security becomes even more lax.
“It can turn into a conundrum pretty quickly,” Carey says. Add in the fact that many companies offer remote access for employees, trading partners, and other entities, and the situation becomes even more complicated. “It’s an issue that companies of all sizes are dealing with as they strive to make information more accessible to employees.”
To avoid such calamities, Drolet says companies should use a system of “evaluating, establishing, educating, and enforcing,” beginning with an internal look at exactly what you want to protect.” For example, is it intellectual property related to human resources or engineering applications? Is it sensitive customer data or employee information?
Once you have decided what you want to protect, look at those areas carefully to find out how they can be compromised, Drolet says. A company that has a high number of trusted relationships with other firms that tap into its data are advised to look carefully at patches, firewalls, and anti-virus technology located at those shared gateways.
“Poke holes at the critical areas to see just how someone can break in,” Drolet explains. She adds that once those holes have been identified, the next step is to create a remediation plan to protect those