Employees, not hackers, cause most corporate data loss

Majority of corporate data loss comes from risky employee actions and systemic failures at the corporate level when it comes to implementing comprehensive IT security policies. Now, a new study from Compuware reports new information that supports Trend Micro's conclusions from back in July. The unsung heroes in the IT department, it turns out, may be doing a better job stopping outside hackers than they get credit for.

According to a new study (PDF, info required) from Compuware, IT departments should take a bow—only 1 percent of corporate data losses this past year were due to hackers. Unfortunately, the good news mostly ends there. Negligent employees are far and away the largest cause of data breaches, but IT managers also listed outsourcing and malicious employees (possibly ex-employees as well, one assumes) as two significant reasons why data breaches often occur.

Compuware reports that of the 1,112 IT practitioners it surveyed, 79 percent reported that their organization had experienced at least one data breach. That's an extraordinarily high number, but there are several intervening variables that may have inflated it.

* Compuware does not completely define the term "data breach." It provides an indication of what it means by describing a data breach as "the loss or theft of information about individuals such as consumer data, customer information, employee records, and so forth." That definition is more than adequate for a general discussion or description, but fails to address certain meaningful nuances.
* Compuware does not filter its results by magnitude; a breach that affected two million people is treated equally to one that impacted just two.
* Compuware does not filter by severity; this is where the subtle nuances of definition I mentioned earlier come into play. We know that a data breach involves the loss or theft of consumer data or employee records, for example, but no information on what, precisely, was stolen or exposed. If I'm a customer of JC Penney, and someone steals the list of customers who bought there over the past 24 months, I'm unhappy. If that list contained my home phone number and address, I'm concerned. If, on the other hand, that list contained my phone number, address, Social Security number, and credit card information, I'm downright worried, and may wish to take immediate action.

I raise these variables because the "gotcha!" of this particular story—79 percent of companies reporting data breaches—has, in my view, been somewhat distorted in the reporting. Compuware's figures may be perfectly accurate, but I'd be careful when drawing any conclusions from them—not every data breach is of TJ Maxx proportions.

In general, Compuware's study seems well-grounded and covers a number of interesting topics. Asked where their efforts are typically focused post-breach, a large group—41 percent of those surveyed—indicated that they participate in investigating, categorizing, and verifying the particulars of the incident. 18 percent of respondents indicate they were involved in remediation activities, 16 percent were tasked with training and educating staff or personnel, 11 percent conducted a root-cause analysis, and 10 percent established an incident response team.

I'm not sure what to make of that last, since incident response teams are emergency groups trained to respond when an emergency occurs. The fact that so many respondents were involved in specifically establishing one implies that 10 percent of the organizations surveyed didn't have them to begin with. Note the relatively low number of IT employees who were asked to spend time training fellow workers, as this will be important later.

Next up, we've got what I personally consider to be the most interesting information in the report, for all that it's largely gone unreported by the press. Having ascertained the roles IT personnel are most likely to play in the event of a data breach, Compuware asked them how confident they are in their own organization's ability to respond to such an event.

The majority of IT workers surveyed are clearly less-than confident in their employer's ability to monitor and detect information theft, even though they themselves almost certainly play a role in such efforts; 56 percent of respondents labeled themselves either "Somewhat confident" or "Not confident." As for the "Unsure" category, it's hard to imagine that the security professionals who opted for this category are secretly "Very Confident" or "Confident." As for why the breaches themselves occur, there's one category that stands out in particular:

Asked to name the leading causes of data breaches, IT staff couldn't run for the negligence category fast enough. Combine this with the fact that most workers don't trust their company to monitor the occurrence of data theft and the fact that relatively few IT staffers are tasked with employee training post-breach, the entire corporate security model begins to sway suspiciously.

The majority of IT professionals surveyed don't believe their employers can adequately monitor company resources for data breaches or prevent these breaches from occurring. Who's causing the breaches? Negligent employees. Given these two facts, one would expect to see the number of IT staff involved in employee training to skyrocket post-breach, as the company attempts to plug the hole, but again, evidence suggests this isn't happening; the majority of IT staffers are involved in fixing the technical aspects of the problem, with relatively few addressing the root cause of the issue.

This obviously makes some sense, given that the IT department wasn't hired to teach Security 101, but it may also indicate that company management hasn't grasped the true root of the problem. It's easy to bring in a consultant for some remedial security training, but without the explicit involvement of the IT department, such training will inevitably focus more on general bad practices and less on the specific situations that may have exposed customer data in this particular case. There's nothing in Compuware's report, meanwhile, that suggests this loop is changing, or that IT workers today feel more confident in their company's ability to deal with a data breach than employees did five years ago.

The report ultimately suggests that the vast majority of companies have security models that are semifunctional at best. Accountability is a hit-or-miss affair, confidence in the system as a whole is minimal, and the flaws that contribute to data breaches aren't confined to any single level of an organization. Not the most optimistic Friday read, I'll admit, but the results aren't all that surprising, either.

Live-in: Some fear misuse, Some welcome it

Maharashtra government's nod to the 'live-in' proposal, where in it considered giving the status of a 'wife' to a woman, if she is involved in such a relationship for a 'reasonable period', has received mixed reactions, raising fears of misuse.

Nishita John, a professional working in a consultancy firm feels that the government need not bring in legislation to regulate live-in relationships.

"If the relationship between the two individuals is consensual, then both should also consider how they will manage if the relationship should fail. It is not for the state to decide anything," she said.

Maharashtra government had approved the proposal on October 8, based on recommendations of the Justice Mallimath Committee which said if a man and a woman are living together as husband and wife for a 'reasonably long period', the man shall be deemed to have married the woman according to customary rights of either party.

The committee had also mooted that the definition of the word 'wife' under Section 125 of the CrPc, be amended to include a woman, living with the man like his wife for a 'reasonably long period'.

However, the definition of 'reasonably long period' is missing from the recommendation, which has left many worried on account of its worthiness and ramifications as it may be grossly misused.

"The period for which the couple live together should be clearly defined to ensure that it cannot be misused," Vivek Jaiswal, a software professional, said.

Indian cities have been seeing a growing number of live-in relationships, a concept once frowned upon as being too 'Western', and popular culture like films have also begun to accept the reality of its existence.

However, experts feel that the debate over the amendment was a larger one that extended beyond live-in relationships, which are more an urban phenomenon.

"The amendment would be more useful to women living in rural areas. In many areas polygamy still exists with no legal rights for the second wife under law," lawyer and women's right activist Veena Gowda said.

This new definition of a wife under the CrPC would provide some financial protection to women who are in relationships that are deemed as marriage by the society they live-in but have no legal standing, she said.

Pencil Vs. Pen

Choice Pencil:

Disposable pens are made of plastic, which doesn't biodegrade and
is hazardous when burned. Excepting the metal bit around the eraser,
pencils naturally dispose of themselves when you sharpen them.

Better yet: Fountain pen

Who is King Mouse or Keyboard ?

I consider myself to be a fairly fast typer, albeit it with two fingers. No matter how hard my teachers in computer classes at College classes would try, I never got the whole concept of touch-typing with all my fingers. However, I am sure that using my two fingers that I could now out type most all of my teachers. Although being able to type is an important skill I am not sure how important the ability to type fast is to people who choose a career in IT and focus on the Microsoft platform.

I was working in a cyber cafe yesterday with a friend of mine that works in IT but in the Linux space as a systems administrator. While I was finalising an upcoming Reporting Services course that I am delivering he was making changes to DNS for one of his clients. What amazed me was not the number of commands that he was typing but the sheer speed at which he was typing. When I asked what he was doing after feverishly typing for several minutes, he responded that he was still making DNS changes. As someone that worked as a systems administrator back in the NT 4 days, I know how easy it is to make a DNS change. Simply open DNS manger and with a couple clicks and typing a few IP addresses the change is made. In some ways I think that not working in a command line environment has meant that typing speeds have dropped, as there is no longer a need to type reams of commands to achieve something simple. Do you think fast typing is still a skill that a DBA should have?

Mouse is taking place of Keyboard but Keyboard is king!!

You will proud to be an Indian....

A Pakistani man says...

The two Ambani brothers can buy 100 percent of every company
listed on the Karachi Stock Exchange (KSE) and would still be left
with $30 billion to spare. The four richest Indians can buy up all
goods and services produced over a year by 169 million Pakistanis
and still be left with $60 billion to spare. The four richest Indians
are now richer than the forty richest Chinese.

In November, Bombay Stock Exchange's benchmark Sensex flirted
with 20,000 points. As a consequence, Mukesh Ambani's Reliance
Industries became a $100 billion company (the entire KSE is
capitalized at $65 billion). Mukesh owns 48 percent of Reliance.

In November, comes Neeta's birthday. Neeta turned
forty-four three weeks ago. Look what she got from
her husband as her birthday present: A sixty-million
dollar jet with a custom fitted master bedroom, bathroom
with mood lighting, a sky bar, entertainment cabins,
satellite, television, wireless communication and a separate
cabin with game consoles. Neeta is Mukesh Ambani's wife,
and Mukesh is not India's richest but t he second richest.

Mukesh is now building his new home, Residence Antillia
(after a mythical, phantom island somewhere in the Atlantic
Ocean). At a cost of $1 billion this would be the most expensive
home on the face of the planet. At 173 meters tall Mukesh's new
family residence, for a family of six, will be the equivalent of a
60-storeyed building. The first six floors are reserved for parking.
The seventh floor is for ca servicing and maintenance. The eighth
floor houses a mini-theatre. Then there's a health club, a gym and
a swimming pool. Two floors are reserved for Ambani family's guests.
Four flo ors above the guest floors are family floors all with a superb
view of the Arabian Sea. On top of everything are three helipads.
A staff of 600 is expected to care for the family and their family home.

In 2004, India became the 3rd most attractive foreign direct
investment destination. Pakistan wasn't even in the top 25 countries.
In 2004, the United Nations, the representative body of 192 sovereign
member states, had requested the Election Commission of India to
assist the UN in the holding elections in Al Jumhuriyah al Iraqiyah
and Dowlat-e Eslami-ye Afghanestan. Why the Election Commission
of India and not the Election Commission of Pakistan? After all,
Islamabad i closer to Kabul than is Delhi.

Imagine, 12 percent of all American scientists are of Indian origin;
38 percent of doctors in America are Indian; 36 percent of NASA
scientists are Indians; 34 percent of Microsoft employees are Indians;
and 28 percent of IBM employees are Indians.

For the record: Sabeer Bhatia created and founded Hotmail. Sun
Microsystems was founded by Vinod Khosla. The Intel Pentium
processor, that runs 90 percent of all computers, was fathered by
Vinod Dham. Rajiv Gupta co-invented Hewlett Packard's E-speak
project. Four out of ten Silicon Valley start-ups are run by Indians.
Bolly wood produces 800 movies per year and s ix Indian ladies
have won Miss Universe/Miss World titles over the past 10 years.

For the record: Azim Premji, the richest Muslim entrepreneur on
the face of the planet, wa born in Bombay and now lives in
Bangalore.India now has more than three dozen billionaires;
Pakistan has none (not a single dollar billionaire).

The other amazing aspect is the rapid pace at which India is
creating wealth. In 2002, Dhirubhai Ambani, Mukesh and
Anil Ambani's father, left his two sons a fortune worth $2.8 billion.
In 2007, their combined wealth stood at $94 billion. On 29 October
2007, as a result of the stock market rally and the appreciation of
the Indian rupee, Mukesh became the richest person in the world,
with net worth climbing to US$63.2 billion (Bill Gates, the richest
American, stands at around $56 billion).

Indians and Pakistanis have the same Y-chromosome haplogroup.
We have the same genetic sequence and the same genetic marker
(namely: M124). We have the same DNA molecule, the same DNA
sequence. Our culture our traditions and our cuisine are all the same.
We watch the same movies and sing the same songs. What is it that
Indians have and we don't?

INDIANS ELECT THEIR LEADERS

US meltdown: 5 lessons for investors

The stunning collapse of Lehman Brothers and the crisis engulfing Wall Street is having an impact across the world. There could be several more developments over the next few months that might make things more difficult.

For investors, this is an important period to learn from such developments. This will ensure that they are not in a tough situation in the future. Here are five such important lessons.

Every investment has risk: Typically, during good times, investors tend to ignore the risk element in a paper and focus only on returns.

Investors in equities stand to lose their entire money, if the company goes down. The plunging shares prices of Lehman Brothers, Freddie Mac and Fannie Mae to one dollar proves that entire market capitalisations can simply get wiped out.

Even debt market products get badly hit on account of the write-down of the debt that they hold. So, a portfolio needs to be as diversified as possible to insulate a person for such situations.

Everything is interlinked: From the price of a stock to an insurance policy, everything is linked. A fall in the price of a particular stock in Europe could mean the overseas mutual fund, where you have invested, is likely to see a fall in its net asset value. Even an insurance policy with a domestic company, which has a foreign partner, can be adversely impacted.

The latter implies you will lose your premiums as well as your cover. While such risks cannot be avoided, a portfolio that contains only domestic stocks or an insurance company may sound safe, but there is no guarantee that it will not be impacted adversely.

Diversify, the only mantra for retirement planning: The result of all the financial planning is gauged by the final corpus that you are able to create for retirement.

A sufficiently-big nest will ensure that there are adequate funds during the sunset years. Many people, even those who are in the financial sector, make the basic mistake of putting all their eggs in one basket.

Many a time, employees buy shares of their own companies thinking that being an insider they are privy to the most-sensitive information. This could lead to a great risk, if suddenly something were to go wrong.

The solution again is diversification. Having exposure to local equities, international equities, debt, commodities together would be a better idea to create a sound portfolio that will weather tough times. And even within each of these areas, spread the money across investment options.

Treat your career like an investment: Most people do not pay the right amount of attention to their career or working life. Just like an investment that needs constant monitoring and analysis, there is a need to monitor the career in the same manner. Most people are shocked when they lose their jobs.

The better way is to be prepared for the worst. That will help to insulate you from any career related problem.

Also, concentration on issues like upgrading skills through training, attending conferences and seminars and networking will help to improve your career. Yes, all these cost money. However, the returns over the years are much more.

Save during good times: Most importantly, when the earnings are high, save well. Good times are not for ever. Creating a meaningful portfolio or a simple savings corpus would be of great help during bad times. Proper investments will ensure that there are reserves that can be used during emergencies.

A sum of Rs 10,000 saved each month for 25 years growing at 15 per cent annually will give rise to a corpus of Rs 2.55 crore (Rs 25.5 million). All this money can be rather useful when the cash flow actually stops. Arnav Pandya

E-mail etiquette for your Mobile devices

• Don't compose and converse at the same time. I’ve seen it many times, and so have you. Someone who is multitasking—talking on the phone, typing an e-mail, and who knows what else. (Yes, I’ve seen eating, drinking, and grooming.) "If you must answer or type a message, please excuse yourself," says Oliver Mims, who hosts the online etiquette series "Proper Ollie." "Do not type and carry on a conversation at the same time." And why not? It's just bad manners. You wouldn't imagine talking to someone on the phone and in person at the same time, would you?
• Take your time—or better yet, wait. Related to the distraction problem above, if you’ve ever been on the receiving end of a message hastily typed from a smartphone, you know what I'm talking about. The message is riddled with typographical errors and appears abrupt. "People are so anxious to answer on the spot that they sacrifice the quality of their communication, which wouldn’t be the case had they waited to respond," says Pamela Holland, co-author of "Help! Was That a Career Limiting Move?"
• Don't keep the device on 24/7. Even though being accessible all day and night can be good for business, it can ultimately be bad for you. In my earlier version of this column, short battery lives meant it was impractical to keep a smartphone powered "on" all day, but that's increasingly not the case. Just because you can be wired all the time, don't submit to the temptation. We all know the impact of "always connected" lifestyles on our personal health.
• Mind your Ps and Qs. Technology can be a blessing and a curse. My PDA, for example, can finish words by trying to guess what I wanted to say. Pay close attention to this "helpful" feature, because it doesn’t always guess correctly. Ditto for automatic spell-check features.

Whether you’re sending or receiving e-mail from a mobile device, one rule holds true: If you're aware of your surroundings, and aware of other people, you're far less likely to offend anyone. That's how I see it.

"When people are mindful of being considerate and respectful of
those around them, they usually make the right social decisions."