Business Security Information

While trying to catch up on some of my reading this week, I came across an article from the December 14, 2009 edition of Forbes magazine which discussed computer-controlled vending.  A vending machine is equipped with an add-on box which captures all the transactions and transmits the information back to the company.  The boxes can also send an e-mail or text message when a vending machine sells out of an item.  This type of electronic device saves the vending company money in lower fuel costs and more efficient use of their manpower.  If you are interested in learning more, you can check out the website for Cantaloupe Systems .

I have written numerous articles covering the different elements and aspects of security, but one issue I have never touched on is the importance of having quality information to make good security decisions for your business.  Quality or complete information is key to any business decision including security issues, but most businesses fail to track security incidents or issues at their company.  I have worked with a lot of small and medium-sized businesses over the years, and I have not run into one yet who does.

Before I start this article, I want to say this is strictly an opinion piece and may not be directly related to the emphasis of this site which is security for small and medium sized businesses.  I do think the basic premise of the article will be relevant to any business, not just a company that has ships on the high seas.

What are Insiders?

I have read a number of articles related to the security issue of insider threats over the past month or two and thought it would be a good idea to cover that issue in one of my posts.  First, what is an insider–just an employee or more than that?  Insiders are more than just employees or staff and can include consultants, vendors, contractors, service providers and other that you deal with on a regular basis.  Insiders are dangerous because in your dealings with them, you have  probably given them access to your company’s network and/or business facilities.  This opens you up to all kinds of threats.

As a business owner, you must sometimes ask yourself this question when talking to an employee and maybe at times when talking with a customer.  How can you know if you should investigate further or if you should trust that gut feeling you get sometimes?  Well, Carolyn Finch recently had an article in CSO (Chief Security Officer) magazine covering body language and how to use it when looking for signs that someone is lying.

On this site I cover physical security, computer security and fraud (on and off-line) issues.  When I read a recent survey report from Panda Security regarding small and medium-sized businesses, it made me take a look at the number of articles I have written for each of those categories.  I found that I have written more articles covering computer security and fraud issues than I have physical security issues.

I have written about PCI Compliance in a previous article and will not repeat that information here, but I did want to discuss the issues of PCI Compliance related to a recent data breach at Network Solutions.  If you have not heard anything about this particular case, the incident occurred on March 12th of this year but was not discovered until July 13th.  Approximately 573,928 credit card accounts were compromised in this attack.  Currently, it appears that it was an outside attack.

As I have been writing articles for this site, it occurred to me that I often use security terminology that readers may not understand. This thought led to the idea of writing a weekly article that would define one or more security terms.  Hopefully, this will give readers some basic knowledge they may not already have and also keep readers up on new terminology which seems to be introduced quite often, especially in computer security. The greater the understanding of these security terms, the better security issues will be able to be addressed.

I have another life story today to make a point about the use of Social Security Numbers as personal identifiers. Over the past two weeks, my wife and I have had the need to talk to our mortgage company, a dentist, a doctor for one of our kids, our phone company and, of course, our health insurance company.  When talking to each one of them, they either asked for my social security number or wanted to have the last four digits of my social security number.  Some asked to verify my identity, and others asked because they said it was necessary for insurance purposes.  These situations got me thinking about why businesses are using social security numbers as personal identifiers.  Then, it got me thinking about why all these different types of business have or want my social security number.

It was a beautiful summer day this week so I decided to take my oldest two children to an amusement park near our home.  They had been wanting to go there all summer, and it was a perfect day for it, not too hot but warm enough to enjoy the water park as well as the many amusement rides.  Since we arrived a few minutes before they were to open, I looked at their security setup at the main entrance.  It looked impressive with everyone being funneled through three checkpoints, all of which had walk-through metal detectors, security officers who searched all bags, and other security officers with hand-held metal detectors.  As we took our turn through the security checkpoint, they had us go through the walk-through metal detector and then searched a backpack that one of my sons had brought with him.  It appeared that security was pretty good at this amusement park.  As the day progressed, though, I found that looks can be deceiving.