PSIJanuary2018

ACCESS CONTROL
(from previous page)
organisations with access control systems that
feature outdated protocols. It should also
remembered that even when biometric devices
are used there are hacking tools out there that
make these systems equally at risk of attack,
unless proper actions are taken.
The internal threat should also be considered.
For instance, organisations can no longer rely on
the transactions on an audit report being
acceptable as proof of someone’s activities, as an
individual can simply claim it was not them and
that their card must have been copied. In
addition, many corporate compliance rules can
easily be broken by employees modifying their
passes to perform actions such as breaking the
banking rules on compulsory holidays, engaging
in secure document printing, and logging on to
unauthorised computer and other IT equipment.
The possible consequences of not taking this
issue seriously are numerous. According to the
UK’s National Crime Agency (NCA) cybercrime has
now surpassed all other forms of criminal activity.
The NCA’s Cyber Crime Assessment 2016
recommended stronger law enforcement and
business partnership to fight cybercrime, with
‘cyber enabled fraud’ making up 36 per cent of all
crime reported, and ‘computer misuse’ accounting
for 17 per cent. The report also suggested that the
problem is likely far worse than the numbers
suggest, noting that cybercrime is vastly underreported.
On the look out
Maybe these figures should not come as too
much of a shock considering that infiltrating IT/OT
systems simply involves the use the card reader
protocol to enter a facility, allowing access to
computers. Those computers then act as a
gateway to the target’s internal internet, allowing
a hacker to access sensitive data that can be used
for a variety of purposes including identity theft
and industrial sabotage.
The amount of personal and corporate
information now stored via networks is growing
exponentially thanks to the Internet of Things
(IoT). Estimates about the amount of connected
devices set to be in use over the next few years
vary enormously. According to Intel, the IoT is
predicted to grow from two billion objects in 2006
to 200 billion by 2020, when there will be around
26 smart objects for every human being on Earth.
Meanwhile, IBM claims that every day we create
2.5 quintillion bytes of data – according to the US
definition that’s one followed by 18 zeros – and to
put that huge number into perspective, it equates
to filling up 57.5 billion 32Gb Apple iPads.
Data protection is an area where failure is not
an option – security, legal and regulatory
compliance is vital, while data loss and leakage
risks must be mitigated. On 25th May 2018, the
General Data Protection Regulation (GDPR)
becomes European law. Its primary objectives are
to give citizens and residents control of their
personal data and to simplify the regulatory
environment for international business by
unifying the regulation within the European Union
(EU). It requires any organisation that operates in
the EU, or handles the personal data of people
that reside in the EU, to implement a strong data
protection policy, encompassing access, secure
storage and destruction.
Action plan
Organisations have to be more aware than ever of
how to protect themselves against hackers and
although it is the IT network infrastructure that is
the focus of attention in terms of preventing such
attacks, a comprehensive risk evaluation requires
Organisations can no
longer rely on the
transactions on an
audit report being
acceptable as proof
of someone’s
activities, as an
individual can simply
claim it was not them
and that their card
must have been
copied
36
www.psimagazine.co.uk