Corporate security threats many times come from customers, business partners

80 to 90 per cent of violations are inbound

While a company can do everything possible for its own network security, in the age of e-commerce and online banking that's not enough. Increasingly, IT managers have to ask, Is the guy we do business with the loose wire in security?

The answer may be "yes" because the customer, client and trading partner isn't meeting expectations about secure data-sharing, such as using encryption to shield sensitive information. And when their PCs are hijacked by cybercrooks or their employees transmit sensitive data in a way that violates regulatory statutes, suddenly it's your company's problem, too.

In healthcare, data related to personal health information (PHI) and personally identifiable information (PII) which is transmitted to business partners has to be kept confidential through encryption, notes Richard DeRoche, corporate director of information technology at for Lutheran Life Communities. The healthcare provider, with eight locations and 1,600 employees, provides older adults with retirement facilities, home care and nursing services in Illinois, Indiana and Florida.

But when Lutheran Life Communities installed a data-loss prevention device -- in this case, one from Palisade Systems -- to make sure PHI and PII data transmissions were sent correctly, the big shock was the discovery that it was business partners that had issues.

"85% to 90% of the violations are inbound," says DeRoche, noting that while employees at Lutheran Life Communities were, by and large, following instructions about encrypting sensitive data, the healthcare provider's business partners and even a state agency were the ones making the most mistakes in that regard.

That ignited debate in the legal division at Lutheran Life Communities as to whether the company should even be accepting email that appears to violate rules such as HIPAA and the HITECH Act, regulations that carry punishment and fines for violations.

DeRoche says the company has decided to start sending warning messages back to the originators of email that violates its security and privacy policy, saying the company can't willingly accept the messages in their current form. He notes there's a need to establish more business-partner agreements where these type of data-protection issues are spelled out in advance.

Lutheran Life Communities, which like many firms has not found it easy to establish a way to get myriad business partners using encryption, set up Microsoft SharePoint as an external portal intended for business partners to share confidential data with the company. It's a password- and encryption-based system that works but is a tad "awkward" for end users, DeRoche notes.

Banking is another industry where mistakes made by others have an unwanted impact.

Cybercriminals are proving adept in tricking both retail and corporate online banking customers, sometimes carrying out elaborate scams to lure victims to fake phishing sites to steal account information or even hijacking PCs with Trojan software to make fraudulent transactions through Automated Clearinghouse (ACH) services.

The criminals can remotely initiate large-dollar payments right through the victim's desktop computer, and these unauthorized payments end up in the bank accounts of the money mules helping them. Corporate bank customers, when they discover what happened, have to plead their case with the banks, and under the law, corporate customers don't have the same sort of fraud protections for lost amounts in this regard as consumers in online banking.

Some banks are moving more forcefully to try to prevent these types of attacks on their customers and the banking system.

For example, Fairfield County Bank, based in Connecticut, has decided in order to prevent attacks, it will require its corporate ACH banking customers -- about 80 companies with several hundred end users -- to make use of a specific security protection for ACH payments.

All of the bank's customers will get a IronKey Trusted Access for Banking token, which is a secure USB token that can be managed via the IronKey cloud-based service. The handheld IronKey USB device, plugged into a computer, aims to protect against keylogging and browser-based attacks and malware by essentially creating a controlled online work environment separate from the user's operating system.

"It will be required," says Christina Bodine, assistant vice president, cash-management office and business e-banking, at Fairfield County Bank.

She says the mandatory security device will help protect the customer and differentiate the bank's services. Like other banks, Fairfield County Bank recommends bank customers use dedicated machines for funds transfer, but doesn't require it.

Another financial institution, Bank of North Carolina, is also offering the IronKey USB token -- complete with the bank's logo on it -- to customers, says Debbie Myers, BNC senior vice president of e-banking and business services manager. But the bank, which is charging a monthly service fee for it, is not planning to make use of IronKey mandatory.

"We're providing it as an option at this time to our customers," says Myers, adding customers are still learning about it and the bank is reluctant to make it a requirement.

Join the CSO newsletter!

Error: Please check your email address.

Tags security threatssecurityanti-malwaremalware

More about MicrosoftRoche

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Ellen Messmer

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts