Fraud

Data loss prevention: NHS, can you afford not to comply?

May 31st, 2013 by ProcessFlows

Data loss prevention NHSThe NHS lost track of nearly 1.8 million patient records in a single year, as a result of several data breaches, a Daily Mail investigation reveals. The Information Commissioner’s Office, which has levied fines totalling over £1million on NHS bodies, is asking for powers to conduct compulsory audits on hospitals and NHS trusts.

Data loss prevention: NHS, are you able to prove compliance?

All medical institutions in the UK must conform to the Caldicott principles, a set of guidelines established in England and Wales in 1997, to ensure that patient information is secure and confidentiality is not undermined. All hospitals, care homes and home care agencies within the NHS must also safeguard Intellectual Property Rights and the Data Protection Act.

Is your organisation able to prove compliance? Are you protected against data leaks and data theft? When traditional data loss prevention and data software and Acceptable Use Policy fail, Spector360 can help. Only Spector360 monitors, captures and analyses all user and user group activity including email sent and received, chat/IM/BBM, websites visited, applications accessed, web searches,  file transfers and data printed or saved to removable devices.

Spector360 allows Information Security Officers, IT managers and senior management to be able to see and track actions taken on a specific document, to track company owned laptops and mobile devices even when not connected to the network.

Data breach? Act now!

With Spector360’s, comprehensive search functionality, you can quickly find exactly what you are looking for, for example who was copying confidential files, who was printing out patients’ files or who was copying data on external devices.

Spector360 has over 75 predefined reports available and allows you to customise your own. With keyword and event alerts, you will also be automatically informed when an alert has been triggered, allowing you to act rapidly, appropriately, decisively and with confidence. Not six months later, when the auditors are already in the house, but on the spot, so you could immediately prevent wrongdoing and ensure that you will be never caught in a legal bind.

See Spector360 in action

Spector360’s vast functionality and deep-drill reports can only be fully comprehended after a hands-on demonstration. As a GOLD certified SpectorSoft partner, Software Paradise is able to perform evaluation installations, demonstrations and presentations of Spector360. Schedule your demo at spectorsoft@softwareparadise.co.uk now.

SpectorSoft has kindly provided an online based test drive of Spector360 that let’s you take a look at all the great features direct in your browser.

We can source any software for you! Please email us for more information or call us at +44 (0)1962 659168. Quotations submitted within an hour!

Insider Data Theft: When Trusted Employees Go Trojan

October 5th, 2012 by ProcessFlows

Data Theft

MI5 chief Jonathan Evans recently warned businesses to not underestimate the level of industrial espionage taking place across the world. In today’s digital and global world, information is as valuable as cash. In fact corporate espionage costs UK businesses more than 800 million pounds each year. However companies of all sizes tend to neglect one of the most common perpetrators of data theft: their employees.

Who is the Typical Data Thief?

In order to assess this often underestimated threat, Symantec recruited leading forensic psychologists to examine various factors leading to insider data theft, focusing on the behavioural and environmental issues that can cause theft of corporate data. The results, published on Symantec’s website, conclude that the average data thief is first – a current employee; second – male, third: 37 years old. The typical perpetrator  of data theft usually serves in technical positions such as programmer, engineer or scientist.

What are the Common Methods?

Digital documents are portable, easy to copy and can be stolen easier by employees than paper documents. This fact not only applies to the ease with which electronic files are stolen, but also to the sheer quantity taken.
According to a survey conducted by the Ponemon Institute, 29% of thieves say they steal corporate data when they leave a company. 24% of thefts were done using USB devices (sticks, MP3 players) and 18% used email. Smart phones – dangerous combination of storage, data access and ubiquity – are an ideal method of stealing data, but surprisingly most companies do not address this threat at all. The same goes for Instant Messenger services and FTP connections.
All of the methods described above cover intentional data theft by employees. However, an employee may also inadvertently expose confidential data by installing software on their computer. Over half of all respondents to the Ponemon Institute’s survey admitted to downloading personal internet software to their company computers. Many of these programs could contain a Trojan horse or other malware, which seeks out confidential data and copies it to data caches on the Internet for retrieval by unauthorised individuals.

How Can Businesses Prove Data Theft?

While policies and technology will prevent casual data theft, determined employees will still steal data. If this occurs, the company will have to prove two things: that the employee took information without permission and that the theft caused harm. This is where computer forensics steps in. Computer forensics experts can find and document instances of an employee’s improper conduct using specialised software, hardware and techniques.
Our top choice of contemporary forensic software is Internet Evidence Finder (IEF), developed by Magnet Forensics. IEF recovers data in more areas than any other solution, which include:

  • Entire logical or physical drives
  • Unallocated space/deleted data
  • Selected files including live RAM captures, network PCAP files, pagefile.sys, hiberfil.sys files (with full decompression) and more
  • Entire user-selected folders and subfolders
  • Special areas of the NTFS file system

Internet Evidence finder is easy to use and able to recover cloud artefacts, social networking pages, webmail applications, instant messenger clients, P2P file sharing applications, web browser artefacts. For more information about IEF please click here.

Q. What is scareware? What can you do about it?

October 4th, 2010 by ProcessFlows

Millions have fallen for it, have you? Online criminals are laughing all the way to the bank.scareware

A. Scareware refers to fake sales tactics intended to scare users into thinking their PCs have critical errors/viruses that need to be secured right away. Scareware offers an immediate solution (at a price of course) as a software download. More often than not this installs some kind of spyware or malware onto your PC. This software can make you more vulnerable to fraud and identity theft.

Protect yourself and your PC:

  • Don’t click on any pop-ups or ads on websites that mention critical errors/viruses and the like. Even if they say they’re from Microsoft or other well known service providers.
  • Purchase reputable software like ZoneAlarm (info here, call Software Paradise on 0800 289 041 to purchase).
  • It takes some common sense as these cyber criminals need you to get what they want, be it credit card details, passwords etc.
  • These scams can even appear on trusted sites like Google and Twitter – so be wary of everything you click on.
  • Keep your operating system and antivirus protection up-to-date.
  • If you do receive a scareware pop-up don’t click on it to close it. Use your task manager instead.

Top in IT security headlines has been the threat of ’scareware’. Symantec released a report this week stating that over 40 million people have fallen for scareware scams in the last year. There have even been reports of cybercriminals holding your computer and data at ransom by locking your PC and demanding relatively small amounts of money to get your data and control back. Because the amounts of money are small it is believed that there are many cases out there that have gone unreported.

In the current climate people are increasingly worried about online fraud, identity theft and hackers. This is why scareware scams are on the increase – online criminals know they work.

Another Security Warning

August 27th, 2010 by ProcessFlows

This time, from the ISF (Information Security Forum), a leading independent authority on information security, who have just released their predictions for IT security in 2011.

it security

There is a shift predicted to highly organised cyber crime and targeted attacks.
It is important that we keep data safe now and plan for the future.

Chief executive Prof. Howard A. Schmidt at the ISF, states: “Even in today’s financial climate and increased threat environment, we are better placed than ever before to meet these challenges – as long as we have the resolve to strengthen and invest in security rather than reduce it.

There is still time to put security measures in place, and they needn’t cost a fortune. Common sense, combined with first line of defence physical security and second line basic encryption will go a long way in helping to keep information safe and reduce data loss.

Think about the disgruntled employee
Criminals will be approaching employees that have been affected by the recession for sensitive company data.

Don’t be a victim of Social Engineering
Think back to the Second World War and the nostalgic posters, ‘Loose Lips Might Sink Ships’ and ‘The Walls Have Ears’, and keep information to yourself.

Here are the predicted top ten risks:

  1. Criminal attacks
  2. Weaknesses in infrastructure
  3. Tougher statutory environment
  4. Pressures on off shoring / outsourcing
  5. Eroding network boundaries
  6. Mobile malware
  7. Vulnerabilities of Web 2.0
  8. Incidents of espionage
  9. Insecure user-driven development
  10. Changing cultures.

Jason Creasey, head of research at the ISF, has stated that the recession is accelerating the changes and advancements in IT threats: “…. fuelled by increasing staff turnover and dissatisfaction; along with the increased involvement of organised criminal groups that see online crime as a lucrative and low risk alternative to other nefarious activities.

Security Awareness is a Vital Defence

August 17th, 2010 by ProcessFlows

Social Engineering – the inadvertent disclosure of confidential information by your employees, is every organisation’s weakest security link.

chain

Technology solutions, security policies, and operational procedures cannot work in isolation. People play a key role in an organisation’s security policy success.

Phishing, Pharming and SPAM are recognised examples of social engineering, both carried out for the purpose of profit, but there are more. These profiteers are always one-step ahead; creating and deploying new attacks that we are not yet aware of.

Regularly updated security software will deal with the majority of Phishing and Pharming threats and block the deluge of dodgy SPAM, but there are always those that slip through the net. Only users can decide if they are going to respond or not, and if they do, inadvertently hand over sensitive data.

Social Threats:
Social Engineers are practiced at manipulating employees into compromising corporate security, undermining human judgement so the victim is willing to concede network security, or even let them into an office building, without verifying their identity. They gather information by listening to conversations in public places (cafes, public transport etc), watching people enter passwords and PINs into laptops and at cash points, and even searching through the rubbish.

Awareness:

  • If employees don’t know about it, they can’t help!
  • Create a strong security culture within the organisation
  • Make employees aware of the threats and reinforce that security is everyone’s responsibility, not just that of the IT team
  • Point out to employees that they are the last line of defence against hackers who have turned to social engineering because they cannot breach the security systems any other way
  • Have regular training sessions/updates about the latest security threats.