« Back to DataSecurityPolicies.com

Archive for the 'Corporate Security Policy' Category



World Bank Data Breach

Photo credit: KAREN BLEIER/AFP/Getty Images

Photo credit: KAREN BLEIER/AFP/Getty Images

In breaking news directly related to data security policies, FoxNews is reporting that the World Bank has suffered possibly “the worst security breach ever at a global financial institution”:

 The World Bank Group’s computer network — one of the largest repositories of sensitive data about the economies of every nation — has been raided repeatedly by outsiders for more than a year, FOX News has learned.

It is still not known how much information was stolen. But sources inside the bank confirm that servers in the institution’s highly-restricted treasury unit were deeply penetrated with spy software last April. Invaders also had full access to the rest of the bank’s network for nearly a month in June and July.

In total, at least six major intrusions — two of them using the same group of IP addresses originating from China — have been detected at the World Bank since the summer of 2007, with the most recent breach occurring just last month.

While it remains unclear how much data has been pilfered from the bank, it’s a lot. According to internal memos, “a minimum of 18 servers have been compromised,” including some of the bank’s most sensitive systems — ranging from the bank’s security and password server to a Human Resources server “that contains scanned images of staff documents.”

One World Bank director tells FOX News that as many as 40 servers have been penetrated, including one that held contract-procurement data.

Despite the gravity of the break-ins, the bank is trying hard to pretend to outsiders it didn’t happen. “There were attempts to hack the bank’s computer systems last summer,” says a World Bank spokesman. “However, there was no compromise of confidential information.”

So if this actually happened, which data security policies could have helped prevent the “the worst security breach ever at a global financial institution”?

  • Corporate Security Policy
  • Incident Response Policy
  • Network Security Policy
  • Vulnerability Management Policy

Others?

October 12th, 2008 | Posted in Corporate Security Policy, Data Security Policy, Incident Response Policy, Network Security Policy, Security Policies, Vulnerability Management Policy | No Comments

Security Training Video

Here’s a fun security training video that could be useful to explain the value of security policies and security concepts like defense in depth:

I like how it incorporates Second Life as a training tool.  :)

November 29th, 2007 | Posted in Corporate Security Policy, Data Security Policy, Security Policies | 1 Comment

Corporate Security Policy

Randy Bias wrote a helpful article called Architecting Practical Corporate Security Policies here. I especially liked the Example Policy Framework and the suggestions on what should be included in a Corporate Security Policy.

Here’s an excerpt:

Corporate Security Policy
 Audience: Executive Management, particularly the CSO, CISO, and Senior INFOSEC Staff

This element is really the overarching framework within which the rest of your policies would be designed. It provides context for the entire policy framework, policy on creating policy, and pointers to which portions of the policy are relevant for which audiences.

Encompassed within the corporate security policy might be 5 key areas (in order):

  • Risk Management Policy
  • Core Policies
  • Vendor & Service Provider Evaluation Policies
  • Processes & Procedures
  • Compliance Policy

Very useful info! Check it out!

October 16th, 2007 | Posted in Corporate Security Policy, Security Policies | No Comments