Newsletters
Risk Central
Digital EditionMind Games
Ara Trembly is founder of The Tech Consultant and The Rogue Guru Blog. He can be reached at [email protected].
It is fair to say we have reached a stage in the evolution of technology in which hacking is an accepted fact of life in our business and personal spheres.
That is not to say we underestimate the damage that hacking attacks can do to insurance enterprises and to our organizations overall, but the prevailing attitude seems to be that the cyber bad guys are smarter than we are.
Our efforts to stop them may be partially successful, but in the end — just as a thief who really wants to steal your locked car will find a way to do it — a hacker who really wants to break in will eventually be able to do so.
We are all used to passwords as a security tool, but it is also useful to realize that passwords can easily be stolen — or guessed, if not adequately deployed.
To take this a bit further, since many of us feel we will lose the battle to hackers at some point, perhaps we are a bit less careful in our efforts to secure the data that is the lifeblood of our organizations. This idea was suggested to me by a recent article I read in “Dark Reading,” a data security publication.
In that piece, author Garret Grajek, CTO and COO for SecureAuth Corp., suggested that what is often missed in cyber attacks is the vulnerability created by what he refers to as “sloppy authentication.”
According to TechTarget.com, “Authentication is the process of determining whether someone or something is, in fact, who or what it is declared to be. In private and public computer networks (including the Internet), authentication is commonly done through the use of logon passwords. Knowledge of the password is assumed to guarantee that the user is authentic.”
We are all used to passwords as a security tool, but it is also useful to realize that passwords can easily be stolen — or guessed, if not adequately deployed.
“Hackers like it when the authentication deployment and security experts build sloppy authentication,” Grajek said. “The sloppiness generates vulnerabilities and thus the vector(s) for attack.”
And while many of us believe that hackers spend hours developing complicated algorithms to crack our systems, he called that idea a myth. “None of the major notable hacks, such as Living Social, Target, SnapChat, or Heartbleed, have provided any truth to these misconceptions,” he noted.
Instead, he said, “hackers attack the enterprise, rather than the algorithm.”
What does this mean? This is simply another way of saying that careless human efforts in the authentication building and securing process can lead to compromised systems and stolen data. Yes, some hackers are very clever — and sometimes they are a step ahead of those of us who would wish to stop them.
In fact, many of them are clever enough to realize that they need not spend countless hours devising mysterious break-in algorithms when they can instead count on the inevitable sloppiness of someone to leave a virtual door open for them. And one reason they can count on such carelessness is the defeated attitude of many who feel that a break-in is inevitable and thus are not vigilant in providing safeguards.
This battle is more psychological than it is technological. Grajek suggested that automated systems that involve less human involvement are the answer, and perhaps there is some merit in this idea.
In the end, however, it is also useful to remember that locking one’s car really does discourage theft, especially if others leave their vehicles unlocked.
