The U.K.’s Information Commissioner’s Office (ICO) has issued a report that outlines the top eight threats to IT security that resulted in sensitive data loss and regulatory fines totaling almost a million pounds, including the £200,000 fine issued against the British Pregnancy Advice Service and the £250,000 penalty against Sony Computer Entertainment Europe.
“Our experiences investigating data breaches on a daily basis shows that whilst some organisations are taking IT security seriously, too many are failing at the basics. If you’re responsible for the security of your organisation’s information and you think salt is just something you put on your chips, rather than a method for protecting your passwords, then our report is for you,” said ICO’s Group Manager for Technology Simon Rice.
“The report provides an introduction into these established industry practices that could save you the financial and reputational costs associated with a serious data breach.”
The top eight computer security vulnerabilities covered in the ICO’s report comprise:
- a failure to keep software security up to date
- a lack of protection from SQL injection
- the use of unnecessary services
- poor decommissioning of old software and services
- the insecure storage of passwords
- failure to encrypt online communications
- poorly designed networks processing data in inappropriate areas
- the continued use of default credentials including passwords
“In just the past couple of months we have already seen widespread concern over the expiry of support for Microsoft XP and the uncovering of the security flaw known as Heartbleed. While these security issues may seem complex, it is important that organisations of all sizes have a basic understanding of these types of threats and know what action they need to take to make sure their computer systems are keeping customers’ information secure,” Rice said.
Rice and the ICO will be publishing a series of blogs this week discussing the ICO’s latest mitigation advice, and will be holding a question and answer session Friday about the ICO report. Questions should be emailed to firstname.lastname@example.org or tweeted to @ICONews by Thursday, May 15th.
Read More Here (PDF)…