It wasn’t that long ago that security mostly involved alarm systems, locks and security guards. For decades, even after we entered the computer age, almost all fraud was perpetrated on site or by very sophisticated professional hackers. Fraudsters had to either physically – or at least electronically, enter the building.
Today, as you know, everything is stored online – financials, intellectual property, employee’s personally identifiable information, customer data. There are substantial benefits to this – more users can access more information any time. I recall how nice it was to be able to drive to the bank after hours and check my balance and one of those new computer “ATM” machines. Now, I can check it anytime and almost anywhere from my laptop, cell phone, tablet, etc. That’s good news for business – who can get more done in less time and in more places. But, where I used to have to drive to the bank building and enter a card, now all I need is a password and the ubiquitous Internet. That’s risky. – the data is by nature in a more accessible place.
All of this is both a result of and a cause for technology.
-It’s technology that allows for the increased efficiency in the first place
-On the other hand, the bad guys have developed technology that puts all that to risk
-A solution for fighting fraud is also in development of new technologies.
This is the kind of cat and mouse game we’re all facing.
Outsiders
-Hackers have technology that makes it harder to detect
-applications and controls allow you to run queries that could identify fraudulent activity earlier. Ie A company can purchase databases that contain valid domains and valid US-based addresses that can be used to prevent online fraud.
-Identify a problem that can be solved by testing
-as more technology is rolled out, more continual testing is
required for tight integration.
-But sometimes it’s the testing that is the problem. I’ve had two recent cases with the application developers were using a test environment, with non production servers, non production software, etc., taking necessary steps to ensure the production environment is not used … except they were using live data in the development environment. Both times those systems were compromised and real data taken. One such case was the Atlantis ID Theft, where personal data from 55,000 of the resort’s customers, including social security numbers and bank account data, was stolen when an outsider breached their test systems.
Insiders
While breaches from outside get a lot of play in the press, I worry about the “trusted” “superstar” employees more then outsiders. Outsiders are looking for the “keys to the kingdom,” but the insiders already have them. They may know the software and controls you have in place…. And worse…
- Those that want to circumvent controls may also be able to
overwrite the transaction
- Less manual oversight because transactions are automated. In
some cases, millions of transactions a day. How do you identify the
potential fraud.
- How do you know that your employees are not taking the data?
Can you trust all of your employees?
- How do you control all of the data and maintain the technology
during every occurring corporate restructuring, merger, etc.?
Conclusion
I’m sure you understand the cat and mouse game that’s going on; it will not stop anytime soon. The only way to stay effective is to keep up-to-date on what the mice – and other cats – are doing. So let’s get started.
Share on Facebook
Tweet This Post
