Is IT safe?
Play
IT security director Benjamin Mah says that data security is becoming more critical as systems and cloud computing become more important to organisations
For Benjamin Mah, Oracle’s Asia Pacific director for enterprise security, cloud computing, mobile applications and social media have posed new challenges for the security of IT systems.
The 2008-2009 US-led global financial crisis exemplified how important system security could be. In the wake of the collapse of US investment bank Lehman Brothers, many financial institutions around the world were seriously affected.
When a banker was fired, he or she also took customers from Bank A to Bank B.
“Security equals trust. The trust between employers and employees was at the lowest ebb in 2008,” said Mah, who has over 13 years of experience in delivering solutions on security and other IT issues.
Prior to joining Oracle, Mah helped launch Encentuate Inc, a provider of enterprise single sign-on software.
In 2000, he also pioneered e-Cop and developed it into a managed security service company until its acquisition by Temasek Holdings of Singapore.
To tackle the trust issue, he says, the solution is to adopt a unified, simple and yet cost-effective platform on user identification across all devices, social media and infrastructure.
For example, user IDs such as “Ben”, “Kben” or “BenK” shall be all unified, minimising fragmentation in ID and database security management, thus raising the system security to a new height.
This applies to staff, suppliers, outsource workers in India or the Philippines, or even cloud workers providing software and infrastructure as a service.
India alone has become the world’s major provider of outsourced IT services, which now account for about 5 per cent of the Indian economy.
According to a recent research survey, 48 per cent of threats against applications and data are caused by insiders, while 92 per cent of stolen records come from database servers, and 86 per cent of hacking involves stolen credentials or IDs, which may result from outsourcing and cloud computing.
Mah said all applications are now online and widely available, marked by widespread outsourcing and use of service providers as well as a growing adoption of cloud computing, so these all pose new problems for security management.
However, security remains a major barrier to cloud computing – which is aimed at saving IT costs as more enterprises turn to this option, thus removing the need for in-house servers and IT infrastructure.
In addition, there is a new culture in which employees are asked to bring their own devices to work, while companies attempt to further cut down on data-centre cost and provide more mobile access to workers and suppliers.
All these trends have contributed to a higher level of security risk.
In terms of identification, recent research shows that 76 per cent of mobile applications store user names as .txt and 10 per cent of them use a password in plain text. The research also shows that 56 per cent of employee behaviour on social sites such as Facebook can endanger corporate security.
As a result, it is important to know your users and how they authenticate themselves, and know their roles and what they are supposed to use.
In other words, the new security system is supposed to be context-aware, meaning that it knows where the user is and what device is used, based on the company’s entitlements and data access policy.
