{"id":11727,"date":"2024-04-04T07:30:52","date_gmt":"2024-04-04T11:30:52","guid":{"rendered":"https:\/\/360legal.net\/blog\/?p=11727"},"modified":"2024-04-01T14:38:50","modified_gmt":"2024-04-01T18:38:50","slug":"common-sense-measures-for-managing-information-security-risk","status":"publish","type":"post","link":"https:\/\/360legal.net\/blog\/common-sense-measures-for-managing-information-security-risk\/","title":{"rendered":"Common Sense Measures For Managing Information Security Risk"},"content":{"rendered":"

RUNNING A CLIENT-FIRST COMPANY, I\u2019m always looking to see how other companies measure up and if they are Client-First. So, what could The Air National Guard, The CFPB, Ransomware, and Process Serving possibly have in common? Well, let me tell you…<\/p>\n

In the late 90s, I was a member of a team of professionals that provided information security technology and solutions to the $\"Common$ government. One accomplishment I am most proud of is that my team engineered and deployed the first worldwide VPN network for the U.S. Air National Guard (USANG) using commercial Internet.<\/p>\n

Then, like now, organizations want to have all available bandwidth to enable seamless corporate communication. With advancements in technology, there is also associated \u201crisk.\u201d Recently, many in the mortgage default industry have faced this increased risk by experiencing information security breaches and ransom- ware attacks. And, if your firm isn\u2019t exposed to enough risk already, in August of 2023, the CFPB<\/a> announced they will also be looking at your information security.<\/p>\n

As a business owner in this industry, I\u2019m thankful for my background in Information Security. However, you don\u2019t need to be an Information Security wizard to manage your security risk. You need to ask some basic questions and understand some basic concepts.<\/p>\n

Your firm interacts with 100\u2019s of defendants a week, representing many high-profile banks, servicers, and other commercial entities. What would it mean to your business if you got hit in a ransomware attack? How long could you be down? Once it became commonly known that you had a security breach, how many clients would you lose? Would the CFPB get involved? What if the Blackhats are smarter this time, and they install ransomware and let it become invasive, infecting your systems and your backups? The good news is that the technology to prevent malicious attacks isn\u2019t that expensive or even costly to deploy and maintain. So, where should you start?<\/p>\n

First, let\u2019s assess your \u201crisk.\u201d Your risk profile encompasses all the areas where your firm has an IT presence, like Data Centers, ISPs, and on-premises (PW, email, and other services). Many firms use a hosted case management system that is also integrated with other services that share information. Many of those platforms are hosted in the cloud, too.<\/p>\n

What is your exposure if one of those services is compromised and your Client\u2019s PII data is exposed? If your case management system\u2019s nearshore data center in another country gets hit, what is your firm\u2019s plan B? I doubt the CFPB will care that you were relying on your vendor\u2019s assertions that their data center had the latest and greatest security measures.<\/p>\n

Who is managing those security procedures? Have they been vetted? How often? Who does the vetting of the vetters?
\nIn the interest of full disclosure, I am not a big fan of \u201coffshoring,\u201d nearshoring,<\/a> or utilizing the cloud for critical applications. Why? \u201crisk\u201d.<\/p>\n

The more vendors involved, the more people, the more \u201crisk\u201d. When thinking about Information Security, common sense goes along way to help you manage your \u201crisk.\u201d I\u2019m not suggesting that we can\u2019t utilize those environments, but you do need to fully understand the additional \u201crisk\u201d and plan accordingly.<\/p>\n

Another essential thing to mention is that in my experience the ONLY reason that any vendor is offshoring anything is to lower their cost. What else are they skimping on if they are pinching pennies on infrastructure or staff?<\/p>\n

At the end of the day, your firm is going to be on the hook for whatever lapses in security exist for any vendor you use, and you need to be comfortable with assuming that level of \u201crisk.\u201d The CFPB has demonstrated on multiple occasions that they won\u2019t care what your vendor tells you.<\/p>\n

When configuring your information security posture, think about building layers of security. Much like an onion, each layer would need to be penetrated before a hacker could exploit the next layer. Utilizing a layered approach also increases the likelihood you will detect any Information Security before much damage can be done to compromise your environment. Let\u2019s look at three or four actionable items that you can do right now to help mitigate your risk.<\/p>\n

First, you should have application-aware perimeter security. Many companies are offering 4th and 5th-generation application-level firewalls. These firewalls enable security policies to be developed based on the applications that you and your staff use daily. These devices are \u201csmart,\u201d meaning they can evaluate network traffic and determine if the communication is safe or suspicious. Many have some AI or machine learning capabilities as well.<\/p>\n

This market has many players, but my favorite is SonicWall (www.sonicwall.com). They offer a complete line of firewalls and perimeter security devices. To effectively safeguard your company’s digital boundaries against sophisticated cyber threats, embracing cutting-edge security technologies is paramount. My favorite thing about SonicWALL is their support. For those with limited Information Security experience, you can purchase one of their firewalls, and for a small fee, they will configure it for you and get you up and going. They also offer a VPN client that you can install on your laptop or remote office computer to secure your remote office staff and all the services they need to be productive, like email.<\/p>\n

Without a doubt, email is the most significant risk exposure today. Email is the source of most phishing attacks, viruses, ransomware, trackers, and other junk. Why? Everyone must have an email address, and yet the solutions for securing email still need to be more robust. So, I self-host our exchange servers in our data center. This requires more technical expertise, but for me, that outweighs the risk of outsourcing my email system.<\/p>\n