California computer security firm McAfee presented the findings Thursday at the World Economic Forum in Davos, Switzerland, with a warning that the world's dismal financial straits are exacerbating data theft woes.
"Based on the survey findings McAfee conservatively estimates that the global damage from data loss to top one trillion dollars," said McAfee chief executive Dave DeWalt.
A few months ago I did an interview article about the current economic state and how it would affect InfoSec. Now I am poised to revisit that sentiment.
I would really like to be angry at CEO's and companies not giving enough to their IT staff to properly secure systems but I really cant. A few weeks ago I saw many friends lose their jobs, hard workers, and diligent people. The economy sucks right now, and it doesn't matter if you agree if we're in a recession or not, big business believes it.
With a decree from McAfee like this I hope C-Level executives start revisiting InfoSec priorities. They need to see where their policy-rubber doesn't hit the road so to speak. Want specifics? ok, here's some just off the top of my head.
- We need to revise policy. Even if stringent policy isn't your businesses style get someone to draft policy that fits your corporate culture ans still secures your entity.
- Adequate attention needs to be given to client side attacks.
- We need to prioritize the awareness of web application vulnerabilities.
- We need to stop preaching defense in depth, and start doing it.
- We need secure code review in our release cycles.
- We need more application whitelisting on our desktops.
- We need to review our wireless policies.
- We need more database security and input validation or filtering.
-We need user awareness training, compliance testing, auditing, and pentesting.
Lets hope the reality of losing more than our current stimulus package can wake a few people up.
