Consider these scenarios: A low-level IT systems engineer spills soda, which takes down a bank of servers; a warehouse fire burns all of the patient records of a well-regarded medical firm; a government division’s entire website vanishes without a trace. Data breaches and failures are not isolated incidents. According to the 2014 Verizon Data Breach Investigations Report, databases are one of the most critical vulnerability points in corporate data assets. Databases are targeted because their information is so valuable, and many organizations are not taking the proper steps to ensure data protection.

• Only 5 percent of billions of dollars allocated to security products is used for security in data centers, according to a report from International Data Corporation (IDC).
• In a July 2011 survey of employees at organizations with multiple computers connected to the Internet, almost half said they had lost or deleted data by accident.
• According to Fortune magazine, corporate CEOs are not making data security a priority, seemingly deciding that they will handle a data problem if it actually happens.

You might think CEOs would be more concerned, even if it is just for their own survival. A 2013 data breach at Target was widely considered to be an important contributing factor to the ouster of Greg Steinhafel, then company president, CEO and chairman of the board. The Target breach affected more than 40 million debit and credit card accounts at the retailing giant. Stolen data included names of customers, their associated card numbers, security codes and expiration dates.
Although the threats to corporate database security have never been more sophisticated and organized, taking necessary steps and implementing accepted best practices will decrease the chances of a data breach, or other database security crisis, taking place at your organization.

6 Basic Security Concerns

If you are new to database administration, you may not be familiar with the basic steps you can take to improve database security. Here are the first moves you should make

1. The physical environment. One of the most-often overlooked steps in increasing database security is locking down the physical environment. While most security threats are, in fact, at the network level, the physical environment presents opportunities for bad actors to compromise physical devices. Unhappy employees can abscond with company records, health information or credit data. To protect the physical environment, start by implementing and maintaining strict security measures that are detailed and updated on a regular basis. Severely limit access to physical devices to only a short list of employees who must have access as part of their job. Strive to educate employees and systems technicians about maintaining good security habits while operating company laptops, hard drives, and desktop computers. Lackadaisical security habits by employees can make them an easy target.

2. Network security. Database administrators should assess any weak points in its network and how company databases connect. An updated antivirus software that runs on the network is a fundamental essential item. Also, ensure that secure firewalls are implemented on every server. Consider changing TCP/IP ports from the defaults, as the standard ports are known access points for hackers and Trojan horses.

3. Server environment. Information in a database can appear in other areas, such as log files, depending on the nature of the operating system and database application. Because the data can appear in different areas in the server environment, you should check that every folder and file on the system is protected. Limit access as much is possible, only allowing the people who absolutely need permission to get that information. This applies to the physical machine as well. Do not provide users with elevated access when they only need lower-level permissions.

4. Avoid over-deployment of features. Modern databases and related software have some services designed to make the database faster, more efficient and secure. At the same time, software application companies are in a very competitive field, essentially a mini arms race to provide better functionality every year. The result is that you may have deployed more services and features than you will realistically use. Review each feature that you have in place, and turn off any service that is not really needed. Doing so cuts down the number of areas or “fronts” where hackers can attack your database.

5. Patch the system. Just like a personal computer operating system, databases must be updated on a continuing basis. Vendors constantly release patches, service packs and security updates. These are only good if you implement them right away. Here is a cautionary tale: In 2003, a computer worm called the SQL Slammer was able to penetrate tens of thousands of computer services within minutes of its release. The worm exploited a vulnerability in Microsoft’s Desktop Engines and SQL Server. A patch that fixed a weakness in the server’s buffer overflow was released the previous summer, but many companies that became infected had never patched their servers.

6. Encrypt sensitive data. Although back-end databases might seem to be more secure than components that interface with end users, the data must still be accessed through the network, which increases its risk. Encryption cannot stop malicious hackers from attempting to access data. However, it does provide another layer of security for sensitive information such as credit card numbers.

Famous Data Breaches

Is all this overblown? Maybe stories of catastrophic database breaches are ghost stories, conjured up by senior IT managers to force implementation of inconvenient security procedures. Sadly, data breaches happen on a regular basis to small and large organizations alike. Here are some examples:

• TJX Companies. In December 2006, TJX Companies, Inc., failed to protect its IT systems with a proper firewall. A group led by high-profile hacker Albert Gonzalez gained access to more than 90 million credit cards. He was convicted of the crime and invited to spend over 40 years in prison. Eleven other people were arrested in relation to the breach.
• Department of Veterans Affairs. A database containing names, dates of birth, types of disability and Social Security numbers of more than 26 million veterans was stolen from an unencrypted database at the Department of Veterans Affairs. Leaders in the organization estimated that it would cost between $100 million and $500 million to cover damages resulting from the theft. This is an excellent example of human error being the softest point in the security profile. An external hard drive and laptop were stolen from the home of an analyst who worked at the department. Although the theft was reported to local police promptly, the head of the department was not notified until two weeks later. He informed federal authorities right away, but the department did not make any public statement until several days had gone by. Incredibly, an unidentified person returned the stolen data in late June 2006.
• Sony PlayStation Network. In April 2011, more than 75 million PlayStation network accounts were compromised. The popular site was down for weeks, and industry experts estimate the company lost millions of dollars. It is still considered by many as the worst breach of a multiplayer gaming network in history. To this day, the company says it has not determined who the attacks were. The hackers were able to get the names of gamers, their email addresses, passwords, buying history, addresses and credit card numbers. Because Sony is a technology company, it was even more surprising and concerning. Consumers began to wonder: If it could happen to Sony, was their data safe at other big companies.
• Gawker Media. Hackers breached Gawker Media, parent company of the popular gossip site Gawker.com, in December 2010. The passwords and email addresses of more than one million users of Gawker Media properties like Gawker, Gizmodo, and Lifehacker, were compromised. The company made basic security mistakes, including storing passwords in a format hackers could easily crack.

Take These Steps

In summary, basic database security is not especially difficult but requires constant vigilance and consistent effort. Here is a snapshot review:

• Secure the physical environment.
• Strengthen network security.
• Limit access to the server.
• Cut back or eliminate unneeded features.
• Apply patches and updates immediately.
• Encrypt sensitive data such as credit cards, bank statements, and passwords.
• Document baseline configurations, and ensure all database administrators follow the policies.
• Encrypt all communications between the database and applications, especially Web-based programs.
• Match internal patch cycles to vendor release patterns.
• Make consistent backups of critical data, and protect the backup files with database encryption.
• Create an action plan to implement if data is lost or stolen. In the current computing environment, it is better to think in terms of when this could happen, not if it will happen.

Basic database security seems logical and obvious. However, the repeated occurrences of major and minor data breaches in organizations of all sizes indicate that company leadership, IT personnel, and database administrators are not doing all they can to implement consistent database security principles.
The cost to do otherwise is too great. Increasingly, corporate America is turning to cloud-based enterprise software. Many of today’s popular applications like Facebook, Google and Amazon rely on advanced databases and high-level computer languages to handle millions of customers accessing their information at the same time. In our next article, we take a closer look at advanced database security methods that these companies and other forward-thinking organizations use to protect their data and prevent hackers, crackers, and thieves from making off with millions of dollars worth of information.

Source: Sys-con Media

Uit onderzoek van Forrester in opdracht van Xerox komt naar voren dat bijna driekwart van de Europese ondernemingen veel rendement verwacht van Big Data en analytics.

Voor het onderzoek werden gesprekken gevoerd met 330 senior business- (CEO, HR, Finance en Marketing) en IT-beslissers in Retail, Hightech, industriële en financiële dienstverlenende organisaties in België, Frankrijk, Duitsland, Nederland en het Verenigd Koninkrijk. Forrester concludeert dat 74 procent van de West-Europese bedrijven verwacht door inzichten verkregen met big data een return on investment (ROI) te realiseren binnen 12 maanden na implementatie. Meer dan de helft (56 procent) ervaart momenteel al de voordelen van big data.ondernemingen veel rendement verwacht van Big Data en analytics.

Niet van een leien dakje
Het simpelweg aanschaffen van een analysepakket voor grote hoeveelheden data is echter niet voldoende. Slechte datakwaliteit en het gebrek aan expertise belemmeren de transformatie die organisaties kunnen doormaken door met big data te werken. Er zal voldoende gekwalificeerd personeel moeten komen, om ervoor te zorgen dat op de juiste manier met de juiste data wordt gewerkt.

Onderbuikgevoel
Big data is essentieel bij het nemen van beslissingen in 2015: 61 procent van de organisaties zegt beslissingen steeds meer te baseren op data-driven intelligence, dan op factoren zoals onderbuikgevoel, mening of ervaring.

Onjuiste data
Onjuiste data blijken kostbaar: 70 procent van de organisaties heeft nog steeds onjuiste data in hun systemen en 46 procent van de respondenten is van mening dat dit zelfs een negatieve invloed heeft op de bedrijfsvoering.

Veiligheid
Van de respondenten beoordeelt 37 procent gegevensbeveiliging en privacy als de grootste uitdagingen bij het implementeren van big data-strategieën. Nederlandse organisaties zien het gebrek aan toegang tot interne data vanwege technische bottlenecks als grootste uitdaging bij de implementatie van big data (36 procent).

Bron: Automatiseringsgids, 1 mei 2015

Cio's in de publieke sector hebben voor de investeringsagenda van 2018 cloudoplossingen, security en data-analyse bovenaan hun prioriteitenlijst staan. Ook business intelligence (bi) en datamanagement scoren hoog. Anders dan in andere sectoren zijn de cio's in de publieke sector nog nauwelijks bezig met kunstmatige intelligentie en IoT. 

Dat blijkt uit cijfers van analistenbureau Gartner. Daaraan deden 461 cio's mee van nationale, federale en lokale overheden, defensie en inlichtingendientsen uit 98 landen. De uitkomsten zijn onderdeel van de 2018 CIO Agenda Survey, onder bijna 3200 cio's.

De cio's binnen de publieke sector noemen: 'cloud solutions', 'cybersecurity' en 'analytics' als belangrijkste onderdelen van de ict-omgeving waarin in 2018 de meeste investeringen zullen plaatsvinden. Volgens de respondenten wordt de datacenterinfrastructuur het vaakst aangewezen als plek om kosten te besparen. Als belangrijkste prioriteit voor het verbeteren van de bedrijfsvoering wordt 'digital transformation' genoemd.

Gartner legt de uitkomsten van de cio's in de publieke sector ook naast die van de hoogste ict-verantwoordelijken in alle andere sectoren. Daaruit blijkt dat sommige uitkomsten sterk verschillen. Voorbeelden is: 'artificial intelligence' (ai), ofwel kunstmatige intelligentie. Dat onderdeel ei

ndigt in de algemene ranglijst binnen de top tien, maar onder de cio's van de publieke sector eindigt het op de negentiende plaats. Cio's binnen defensie en inlichtingendiensten vormen een uitzondering.

Ook internet of things (IoT) heeft nog nauwelijks prioriteit op de investeringsagenda van cio's in de publieke sector. Hoewel het in het gemiddelde van cio's uit verschillende sectoren eindigt in de top-tien, komt IoT op de prioriteitenlijst van de cio's in de publieke sector uit op een twaalfde plek. 

Smart city's

Alleen lokale overheden (gemeenten) vormen een uitzondering doordat die cio's soms smart city-projecten ontplooien. Dat geldt ook weer voor cio's bij defensie en inlichtingendiensten. Maar over het algemeen is het monitoren van datastromen afkomstig van sensoren nog niet ver doorgedrongen op de lijst van prioriteitenlijst voor ict-investeringen bij de overheid.

Het Internet of Things brengt allerlei beveiligingsrisico's met zich mee, maar ervaren experts die hierbij kunnen helpen zijn schaars, zo stelt martkvorser Gartner. Volgens Gartner zijn beveiligingstechnologieën vereist om alle Internet of Things-apparaten tegen aanvallen te beschermen.

Het gaat dan om zowel bekende als nieuwe aanvallen. Gartner wijst naar aanvallen waarbij aanvallers zich als bepaalde apparaten voordoen of "denial-of-sleep-aanvallen" uitvoeren, om zo de batterij van apparaten leeg te maken. De beveiliging van het Internet of Things wordt verder gecompliceerd door het feit dat veel van de apparaten eenvoudige processoren en besturingssystemen gebruiken die geen complexe beveiligingsoplossingen ondersteunen. Ook is er een tekort aan expertise.

"Ervaren IoT-beveiligingsspecialisten zijn schaars, en beveiligingsoplossingen zijn op het moment gefragmenteerd en bestaan uit verschillende leveranciers", zegt Nick Jones, vicepresident en analist bij Gartner. Jones voorspelt dat er de komende jaren nieuwe dreigingen voor het Internet of Things zullen verschijnen, aangezien hackers nieuwe manieren vinden om aangesloten apparaten en protocollen aan te vallen. Dit zou inhouden dat veel van de IoT-apparaten gedurende hun levenscyclus van hardware- en softwareupdates moeten worden voorzien.

Source: Security.nl

Geopolitieke ontwikkelingen, zoals internationale conflicten of politieke gevoeligheden, hebben een grote invloed op de digitale veiligheid in Nederland. Dat stelt staatssecretaris Klaas Dijkhoff in een rapportage die hij gisteren naar de Tweede kamer zond.

Het rapport 'Cyber Securitybeeld Nederland' (CSBN) laat zien dat de eerder al gesignaleerde trends doorzetten in 2015. Een aanpak waarbij publieke en private partijen nationaal en internationaal samenwerken om de cybersecurity te verbeteren, wordt dan ook noodzakelijk geacht. Staatssecretaris Dijkhoff laat weten dat hij tijdens het aanstaande EU-voorzitterschap van Nederland hier aandacht voor wil vragen bij andere Lidstaten: "Alleen als we samenwerken, kunnen we ons digitale leven beschermen tegen criminaliteit en spionage."

Werkprogramma

Tegelijk met het CSBN is de voortgang van het werkprogramma van de Nationale Cyber Security Strategie 2 (NCSS 2) naar de Kamer verzonden. Het NCSS2, gestart in 2013, heeft als doel de Nederlandse digitale weerbaarheid te verbeteren. Het werkprogramma zou 'op hoofdlijnen' op schema liggen, meldt Dijkhoff aan de Tweede Kamer.

In zijn beleidsreactie benadrukt de Staatssecretaris dat publiek-private samenwerking is cruciaal is in de aanpak van cybercrime en digitale spionage. De snelle ontwikkeling van cyberdreigingen in combinatie met een geopolitieke omgeving die steeds stabiel wordt, vraagt om 'voortdurende aandacht'. Daarom wil Dijkhoff alle relevante publieke en private partijen betrekken bij het doorontwikkelen van de 'cybersecurity-visie'. Uitgangspunt daarbij zal zijn dat cybersecurity een balans is tussen vrijheid, veiligheid en economische groei.

Alert Online

Bewustwording over online veiligheid is een belangrijk onderdeel van het digitale veiligheidsbeleid van de overheid. Daarom wordt ook dit jaar weer de campagne 'Alert Online' gehouden. Deze campagne is een gezamenlijk initiatief van overheid, bedrijfsleven en wetenschap en vindt dit jaar plaats van 26 oktober tot 6 november 2015. Er wordt aandacht besteed aan cybercrime die mensen en bedrijven treft, zoals phishing en cryptoware. 

Bron: Automatiseringsgids, 15 Otober 2015

Despite exponential increases in data storage in the cloud along with databases and the emerging Internet of Things (IoT), IT security executives remain worried about security breaches as well as vulnerabilities introduced via shared infrastructure.

A cloud security survey released Wednesday (Feb. 24) by enterprise data security vendor Vormetric and 451 Research found that 85 percent of respondents use sensitive data stored in the cloud, up from 54 percent last year. Meanwhile, half of those surveyed said they are using sensitive data within big data deployments, up from 31 percent last year. One-third of respondents said they are accessing sensitive data via IoT deployments.

The upshot is that well over half of those IT executive surveyed are worried about data security as cloud usage grows, citing the possibility of attacks on service providers, exposure to vulnerabilities on shared public cloud infrastructure and a lack of control over where data is stored.

Those fears are well founded, the security survey notes: “To a large extent both security vendors and enterprises are like generals fighting the last war. While the storm of data breaches continues to crest, many remain focused on traditional defenses like network and endpoint security that are clearly no longer sufficient on their own to respond to new security challenges.”

Control and management of encryption keys is widely seen as critical to securing data stored in the cloud, the survey found. IT executives were divided on the question of managing encryption keys, with roughly half previously saying that keys should be managed by cloud service providers. That view has shifted in the past year, the survey found, with 65 percent now favoring on-premise management of encryption keys.

In response to security concerns, public cloud vendors like Amazon Web Services, Google, Microsoft and Salesforce have moved to tighten data security through internal development, partnerships and acquisitions in an attempt to reduce vulnerabilities. Big data vendors have lagged behind, but the survey noted that acquisitions by Cloudera and Hortonworks represent concrete steps toward securing big data.

Cloudera acquired encryption and key management developer Gazzang in 2014 to boost Hadoop security. Among Hortonworks’ recent acquisitions is XA Secure, a developer of security tools for Hadoop.

Still, the survey warned, IoT security remains problematic.

When asked which data resources were most at risk, 54 percent of respondents to the Vormetric survey cited databases while 41 percent said file servers. Indeed, when linked to the open Internet, these machines can be exposed vulnerabilities similar to recent “man-in-the-middle” attacks on an open source library.

(Security specialist SentinelOne released an endpoint platform this week designed to protect enterprise datacenters and cloud providers from emerging threats that target Linux servers.)

Meanwhile, the top security concerns for big data implementations were: the security of reports that include sensitive information; sensitive data spread across big data deployments; and privacy violations related to data originating in multiple countries. Privacy worries have been complications by delays in replacing a 15-year-old “safe harbor” agreement struck down last year that governed trans-Atlantic data transfers. A proposed E.U.-U.S. Privacy Shield deal has yet to be implemented.

Despite these uncertainties and continuing security worries, respondents said they would continue shifting more sensitive data to the cloud, databases and IoT implementations as they move computing resources closer to data. For example, half of all survey respondents said they would store sensitive information in big data environments.

Source: Datanami

Organizations today don’t use previous generation architectures to store their big data. Why would they use previous-generation BI tools for big data analysis? When looking at BI tools for your organization, there are 10 “Commandments” you should live by.

First Commandment: Thou Shalt Not Move Big Data
Moving Big Data is expensive: it is big, after all, so physics is against you if you need to load it up and move it. Avoid extracting data out into data marts and cubes, because “extract” means moving, and creates big-data-sized problems in maintenance, network performance additional CPU — on two copies that are logically the same. Pushing BI down to the lower layers to run at the data is what motivated Big Data in the first place.

Second Commandment: Thou Shalt Not Steal!...Or Violate Corporate Security Policy
Security’s not optional. The sadly regular drumbeat of data breaches shows it’s not easy, either. Look for BI tools that can leverage the security model that’s already in place. Big Data can make this easier, with unified security systems like Ranger, Sentry and Knox; even Mongo has an amazing security architecture now. All these models allow you to plug right in, propagate user information all the way up to the application layer, and enforce a visualization’s authorization and the data lineage associated with it along the way. Security as a service: use it.

Third Commandment: Thou Shalt Not Pay for Each User, Nor Every Gigabyte
One of the fundamental beauties of Big Data is that when done right, it can be extremely cost effective. Putting five petabytes of data into Oracle could break the bank; but you can do just that in a big data system. That said, there are certain price traps you should watch out for before you buy. Some BI applications charge users by the gigabyte, or by gigabyte indexed. Caveat emptor! It’s totally common to have geometric, exponential, logarithmic growth in data and in adoption with big data. Our customers have seen deployments grow from tens of billions of entries to hundreds of billions in a matter of months, with a user base up by 50x. That’s another beauty of big data systems: Incremental scalability. Make sure you don’t get lowballed into a BI tool that penalizes your upside.

Fourth Commandment: Thou Shalt Covet Thy Neighbor’s VisualizationsSharing static charts and graphs? We’ve all done it: Publishing PDFs, exporting to PNGs, email attachments, etc. But with big data and BI, static won’t cut it: All you have is pretty pictures. You should be able let anyone you want interact with your data. Think of visualizations as interactive roadmaps for navigating data; why should only one person take the journey? Publishing interactive visualizations is only the first step. Look ahead to the Github model. Rather than “Here’s your final published product,” get “Here is a Viz, make a clone, fork it, and this is how I derived at those insights, and see what other problem domains it applies to.” It lets others learn from your insights.

Fifth Commandment: Thou Shalt Analyze Thy Data In Its Natural Form
Too often, I hear people referring to big data as “unstructured.” It’s far more. Finance and sensors generate tons of key value pairs. JSON — probably the trendiest data format of all — can be semi-structured, multi-structured, etc. MongoDB has made a huge bet on making sure data should stay in this format: Beyond its virtues for performance and scalability reasons, expressiveness gets lost when you convert it into the rows and tables. And lots of big data is still created in tables, often with thousands of columns. And you’re going to have to do relational joins over all of it: “Select this from there when that...” Flattening can destroy critical relationships expressed in the original structure. Stay away from BI solutions that tell you “please transform your data into a pretty table because that’s the way we’ve always done it.”

Sixth Commandment: Thou Shalt Not Wait Endlessly For Thine ResultsIn 2016 we expect things to be fast. One classic approach is OLAP cubes, essentially moving the data into a pre-computed cache, to get good performance. The problem is you have to extract and move data to build the cube before you get performance (see Commandment #1). Now, this can work pretty well at a certain scale... until the temp table becomes gigantic and crashes your laptop by trying to materialize it locally. New data will stop analysis in its tracks while you extract that data to rebuild the cache. Be wary of sampling too, you may end up building a visualization that looks great and performs well before you realize it’s all wrong because you didn’t have the whole picture. Instead, look for BI tools that make it easy to continuously change which data you are looking at.

Seventh Commandment: Thou Shalt Not Build Reports, But Apps Instead
For too long, ‘getting the data’ meant getting a report. In big data, BI users want asynchronous data from multiple sources so they don’t need to refresh anything — just like anything else that runs in browsers and on mobile devices. Users want to interact with the visual elements to get the answers they’re looking for, not just cross-filtering the results you already gave them. Frameworks like Rails made it easier to build Web applications. Why not do the same with BI apps? No good reason not to take a similar approach to these apps, APIs, templates, reusability, and so on. It’s time to look at BI through the lens of modern web application development.

Eighth Commandment: Thou Shalt Use Intelligent ToolsBI tools have proven themselves when it comes to recommending visualizations based on data. Now it’s time to do the same for automatic maintenance of models and caching, so your end user doesn’t have to worry about it. At big data scale, it’s almost impossible to live without it, there’s a wealth of information that can be gleaned from how users interact with the data and visuals, which modern tools should use to leverage the data network effects . Also, look for tools that have search built in for everything, because I’ve seen customers who literally have thousands of visualizations they’ve built out. You need a way to quickly look for results, and with the web we’ve been trained to search instead of digging through menus.

Ninth Commandment: Thou Shalt Go Beyond The Basics
Today’s big data systems are known for predictive analytical horsepower. Correlation, forecasting, and more, all make advanced analytics more accessible than ever to business users. Delivering visualizations that can crank through big data without requiring programming experience empowers analysts and gets beyond a simple fixation on ‘up and to the right.’ To realize its true potential, big data shouldn’t have to rely on everyone becoming an R programmer. Humans are quite good at dealing with visual information; we just have to work harder to deliver it to them that way.

Tenth Commandment: Thou Shalt Not Just Stand There On the Shore of the Data Lake Waiting for a Data Scientist To Do the WorkWhether you approach Big Data as a data lake or an enterprise data hub, Hadoop has changed the speed and cost of data and we’re all helping to create more of it every day. But when it comes to actually using big data for business users, it is too often a write-only system: Data created by the many is only used by the few.

Business users have a ton of questions that can be answered with data in Hadoop. Business Intelligence is about building applications that deliver that data visually, in the context of day-to-day decision making. The bottom line is that everyone in an organization wants to make data-driven decisions. It would be a terrible shame to limit all the questions that big data can answer to those that need a data scientist to tackle them.

 Source: Datanami