Contributors - CyberSecurity Malaysia

has caused a US$2.25 million fine to the largest retailpharmacy chain in the US, violations to the HIPAA thatcarried headlines in the nation earlier this year. The incidentreported by the media in 2006 where these pharmacieshad dumped thrash that exposed critical informationincluding details of patients, physicians, medicationinstructions, consumers, credit card and insurance cardinformation. Not only fine, the chain was also requestedby the enforcement to provide security programmes andensure its effectiveness for the next 20 years.People do businesses in borderless environment whererisks are obvious. As such, cyber threats have becomeone of most serious and national security challengesfor a nation. Failure to protect information as it is beingtransmitted in cyber world can create huge adverseimpact to organizations and the country in total. This isvery much reflected in any Critical National InformationInfrastructure of any countries where failure in protectingone organization may cause a cascading effect to otherorganisations due to interdependencies that exist amongstthem. This causes service disruptions that can createloss not only in monetary form but also a public outcryas happened once in Malaysia a few years back when oneof the public light rail transit services went down due topower failure.Whether we realize it or not, impact of security breacheswill be as huge as capable to bring down a power grid. TheSupervisory Control and Data Acquisition (SCADA) systemsare frequently used to control sensitive equipment power,water and gas sectors in which the information can bemanipulated if they were not protected. Not only causingpower blackout, but also constituting dangers to peopleand environment. In one of the classic incident of SCADAback in 2003, “Blaster Worm” virus managed to get hookedinto the SCADA system for power grid in the northeast ofUS that caused blackout. In Malaysia itself, the spread ofthe virus has caused us as much as RM31million that took2 months to eradicate.SCADA can also vulnerable to disgruntled employees ormalicious hackers who will exploit security weaknessesin information systems. In an incident in the US, afterbeing turned down for a permanent position in an oiland gas company, an IT consultant purposely tamperedwith the computer systems. When this happen, integrityand confidentiality of the systems and information can bequestionable.Getting assurance through ISMSIncidents highlighted earlier can simply cause businessdisruptions; consequently impact the image, reputation,confidence as well as monetary. Thus, informationsecurity controls have to be in place to prevent securitybreaches coupled with business continuity plan toensure organizations remain in business for long. Manyorganizations are moving towards complying withInformation Security Management Systems (ISMS) ISO27001:2005 as an approach to assure the main informationproperties are preserved. Complying and certifying againstthis standard provides confidence to stakeholders andbusiness opportunities to grow knowing the informationsecurity related risks are well taken care since it is a riskbasedapproach.ISMS implementation is capable in increasing predictabilityand reducing uncertainty of business operations bylowering information security-related risks to definableand acceptable levels. Controls of 11 security domainsprovided by the standard reflect the holistic approachfor organizations to equip themselves in securing theirbusiness environment. Business continuity plan is one ofthe domains to ensure necessary tasks and procedureswere in place to allow continuity in the event of servicedisruption. For top management, compliance andcertification to the standard allows information security isachieved in a controlled manner.ConclusionManaging information security is not just having anti-virusor audit controls in place; it is more than that. It requirestop management commitment as at the end of the day,the adverse impact resulting from information securitybreaches will fall back on them.Thus, top management has great responsibilities inprotecting their stakeholders’ interest and for the businessto stay relevant in their industry. They must recognize thatsecuring information in not just an investment, but it isessential for organizations to survive and even better increate a competitive advantage. •References[1] Paul Williams, Andersen, “Information SecurityGovernance”, Information Security Technical Report,Vol 6, No. 3 (2001) 60-70[2] Linda Tucci, “FTC pursuing HIPAA violations as amatter of consumer Protection”, SearchCompliance.com, Sep 2009[3] Goodin, Dan, “(Former) IT consultant confessesto SCADA tampering”, http://www.theregister.co.uk/2009/09/24/scada_tampering_guilty_plea/,Sep 2009[4] Lim Mi-jin, Kim Jeen-kyun, “Digital dangersin a wired world”, JoonAng Daily, Dec 2009,http://joongangdaily.joins.com/article/view.asp?aid=291393335.e-Security | CyberSecurity Malaysia | Volume 21 - (Q4/2009)