Privacy Awareness Week, Day 1: What is privacy and changes to the Act

 This week (5^th -10^th May) is Privacy Awareness Week (PAW) and CQR has partnered with the Office of the Australian Information Commissioner (OAIC) to help promote Privacy Awareness amongst the community.

So what is Privacy?

Privacy is about the protection of an individual’s personal information.  We are all responsible for protecting our own identity and that of others.  Think about it:  We expose or own personal information on a daily basis.  When we use social media, contact our utility companies and shop online we provide a large amount of our own personal data.  You may make the assumption that the person or website you are sharing your information with will take care of it, ensure it is secure and not share it with anyone else.

This to a degree is true and most companies will have a privacy policy in place to demonstrate a level of commitment to protecting your personal information, but this isn't a fool proof solution.

The person who is actually responsible for your personal data at the end of the day is you!  What is the best way to safeguard yourself and look after your own identity?  Have you ever taken the time to think about it?

To help you understand, Australia an independent Government agency responsible for privacy functions that are conferred by the Privacy Act 1988 (Privacy Act) called the Office of the Australian Information Commissioner (OAIC).  The OAIC provides advice and guidance to the public, Businesses and Government agencies on how they are to handle personal information. 

The changes to the Privacy Act on 12^th march 2014 brought about a heightened awareness of the message that we should be protecting our own privacy and together with PAW CQR has put together a program of Blogs covering:

-          How you can protect your privacy online;

-          What you can do to protect your privacy when using mobile apps;

-          Business obligations to privacy; and

-          How to manage breaches to personal information.

We hope that you will keep a keen eye out on blogs, get engaged in conversation and most importantly retweet the messages to colleagues, family and friends to share the importance of Privacy.

You can find more information on your privacy rights and Privacy Awareness Week from the OAICwebsite

Yvonne Sears

Senior Security Specialist

@yvonnesearsCQR

www.cqr.com

3 new certified QSA's reporting for duty.

In March, 3 of our Australia based employees became certified as Qualified Security Assessors (QSA’s) which doubles the number of QSA’s working for CQR covering Australia and New Zealand.

CQR have been a QSA company for a number of years and prides itself on having available QSA resources in each of their Australian offices.

Being certified as a QSA means that the PCI Security Standards Council has assessed each candidate to meet the requirements to perform a PCI data security assessment, and are able to validate a client’s adherence to the PCI DSS.

Why comply to PCI DSS?

For vendors who are responsible for the safe handling of cardholder information the PCI Data Security Standard (PCI DSS) is a key part which provides an actionable framework for developing a robust payment card data security process, including prevention, detection and appropriate reaction to security incidents.

Undertaking a PCI Security Standard can seem like a lot of effort, especially for those with smaller organisations, but the benefits out way those doubts. In an environment where data is valuable, showing compliance to PCI DSS lets customers know that your systems are secure and they can trust you with their sensitive payment card information. That trust allows your customers to be happy doing business with you and making confident customers they are more likely to become repeat customers or recommend you to others.

For other organisations doing business with you it shows that you are conscious about security and are active in looking after your data and that of others. Compliance is an everyday process and ensuring that you are up to date and meeting the standards guidelines is just as important. Being compliant can also help with other regulations that are out there.

Being compliant not only gives your customers and business partners confidence and peace of mind but it will also help your company to avoid the negative effects of compromised data, including loss of sales, relationships which can lead on to insurance claims, cancelled accounts, payment card and government fines. None of which any organisation wishes to encounter. This shows that the benefits of having a robust PCI DSS can benefit all organisation who deal with cardholder information.

CQR have proven success in supporting businesses through stages of their PCI journey and having additional PCI QSA’s ensures that the extra skills are available to achieve this.

Contact CQR today to see how we can help you achieve compliance today.

Sarah Taylor
www.cqr.com

CQR Insights: Organisation compliance with New Privacy Laws

From 12 March 2014, the Federal Government’s new privacy laws will introduce a new set of Australian Privacy Principles. The reforms introduce new enforcement powers and remedies for investigations that the Commissioner commences on their own initiative. The Commissioner will be able to make a determination, accept written undertakings that will be enforceable through the courts, or apply for civil penalty orders which can range from $340,000 for individuals and up to $1.7 million for companies.   

Mandatory reporting of data breaches is not part of the new laws (yet) but clearly the new enforcement powers and remedies for investigations is putting everyone on notice as regards the protection of personal information.

How will the new the privacy laws impact your organisation?  Well it is really all about managing risk.

An article by  Alec Christie, partner at DLA Piper in The Australian suggests companies undertake a “mini privacy audit”.

http://www.theaustralian.com.au/technology/companies-not-ready-for-privacy-laws/story-e6frgakx-1226782545881

I have put together a list of ten questions to ask yourself:

1.       Do you manage a register of risks relating to your  critical business systems  that store and use personal information?

2.       Do you have procedures for staff & contractor access control to these systems – granting, revoking and privilege levels?

3.       Do you know where personal data is stored?

4.       Do you have a procedure for the removal or de-identifying  personal data from databases and archive systems where this information is no longer required?

5.       Do you have change control procedures for  network, system and application changes which may impact business systems holding personal information?

6.       Does your organisation have an Information security policy and associated procedures?

7.       Does your organisation have a resource who is responsible for information security management?

8.       Do you have procedures for managing and applying operating system and application  patches and  upgrades?

9.       As highlighted in the Privacy Commissioner’s recent AAPT breach investigation (link below), do you have service level agreements in place with third party providers  regarding responsibilities for  protecting personal information and importantly a  means of monitoring compliance?

10.   Do you perform annual vulnerability assessments of internet  infrastructure and applications?

If you answered  yes to all of these questions then you are probably doing ok.

What help does CQR  offer for  the new privacy laws?

As part of our ISMS/ISO27001 business practice we have a  packaged program which runs over a 4-week timeframe where we work with a client to:

1.       Identify business systems that are in scope;

2.       Perform a gap analysis against existing information security procedures and processes;

3.       Highlight risks and maturity of controls in place;

4.       Rate the adequacy of existing procedures;

5.       Provide a draft implementation plan of  activities to effectively manage the risks associated with your information assets.

As part of our technical services CQR can perform vulnerability assessments of your internet facing  infrastructure and services.

AAPT’s data breach investigation which gives some insights into where things can go wrong.

http://www.oaic.gov.au/news-and-events/media-releases/privacy-media-releases/aapt-breached-privacy-act

If you would like further information on how CQR can assist with getting inline with the new privacy laws then contact CQR at www.cqr.com or enquiries@cqr.com

 

Greg Starkey
Business Development Manager, Government & Commercial
www.cqr.com

10 years of CQR

We have just celebrated our 10th anniversary of the founding of CQR, and this gives us an opportunity to look back at the way the world was when we started the company, and compare it to the world we find ourselves in today.

In late 2003 almost everyone working in the information security industry in Australia either worked for a system integrator, who sold consulting services as a sideline to their hardware and software business; or for a large accounting firm who were branching out from their IT audit practices.  In both cases the advice given by the security consultants wasn't independent, it was seen as a vehicle to upsell their core services.  If you had a problem with network security, you were much more likely to be told that you needed a new firewall - one that was sold by the system integrator of course - than that you needed to improve your firewall configuration.

The four founders of CQR independently realised that there was a need in the market for genuine product-independent security advice, and that business focussed technical risk assessment was something that no-one else was offering.  A decade later this is still as true as it was back then, and we even see regression as independent security firms are being rolled back into system integrators and defence contractors.

It's one thing to have a vision, but quite another to put it into practice.  To make it happen required belief and commitment.  Belief that there was a need for the services that we were providing, and commitment to give up well paid jobs for 25% of a startup with no expectation of any pay for at least the first 6 months.  We have never wavered in the belief and commitment, and it has been rewarded year after year by our loyal clients and partners.  Our first year stretch target is now well below our average month.

Of course we had our detractors, who said that we would be out of business in a month.  Then three months.  Then a year.  When displacing an existing service delivery model, those displaced can either roll with the changes and grow, or waste time and focus looking at their competitors and stagnate.  Companies that were once our competitors are now no longer in business, new companies have sprung up following our lead, and we have adapted to meet the challenge.  But we have never taken our eye off our vision of being the largest independent security consultancy in Australia.

We were the first business in Australia to certify our operations to the international standard for information security management (then AS 7799, now ISO 27001).  We believed then, as we believe now, that we should be the number one client for our own advice.  We have never advised our clients to do what we say, but not do what we do.

Our success in our home town of Adelaide allowed us to open offices in Sydney and Melbourne to better service local businesses with local resources, rather than rely on a fly-in fly-out model which doesn't meet the flexibility needs of our clients and doesn't scale.  We also went international, opening an office in the UK which has now expanded to deliver services throughout Europe, Asia and the USA.

In 2013 we see cyber-security stories in the paper every day, there are nation-states spying on our companies, and information security certifications are seen as critical to the trust model of doing business.  Information security is no longer a nice-to-have, but a fundamental part of sustainable business practice.  The need for independent information security advice has never been greater.

In the next 10 years, we have detailed plans for the Australian operation to expand to open local offices to cover the rest of Australia as well as have a permanent presence in New Zealand and Singapore; while the UK operation will be delivering services both locally and in Europe and the USA.

I'm proud to have taken the risk to quit my job.  I'm proud to say that I've been involved in building CQR up from nothing to its dominant position today.  I'm proud to be making the world a safer place.

Phil Kernick Chief Technology Officer
@philkernick www.cqr.com

Cyber-Warfare Battlezone

In 1980 Atari came out with an amazing video game named Battlezone.  In it you drive a wire-frame tank around a landscape, shooting enemy tanks, UFOs and missiles.  The US Army even commissioned a version of the game as a training simulator!  I remember spending many hours and a significant amount of my pocket money trying to defend against the enemy onslaught.  Today I do much the same thing, but now it’s done by educating businesses on the cyber-threats that they face, and helping them develop the best-practice process and technology required  to safeguard their people, productivity and profits.

Good security practices are no longer optional or just “nice to have”.  The age of naivety has well and truly passed, and businesses that continue to operate with a head in the sand attitude are not able to effectively maximise the returns on their assets – assets that are increasingly digital, portable, and greedily desired by competitors and developing nations alike.  A recent Akamai “State of the Internet” report has shown that the combination of Indonesia and China represent 71% of the global attack traffic.  This is not stereotypical dysfunctional teenaged hackers, this is targeted, industrialised intellectual property theft.

One of the biggest blockers to effective security management is the belief that it is an IT problem, and that IT will solve it.  If this were true, then there would be no spam, no viruses, and no cyber-crime.  Yet 20 years of the best minds in the best IT companies, developing the best products has left us where we are, heading upstream without a paddle.  Security is a people problem, and until it becomes just business-as-usual, integrated into every business process, we will make little headway.  We already know how to deal with safety: safety is everyone’s problem.  We just haven’t realised that information security is business safety, and is also everyone’s problem.

The security foundations are able to deal with yesterday’s problems – patching, antivirus and firewalls – but they are no longer enough to keep us safe from today’s problems.  Today we live in a portable world, where the ability to work anywhere, anytime and have complete connectivity whilst doing so has meant that the implied protections of the past no longer exist.  Home networks are not as well protected as business networks.  Portable devices are left unprotected in airport lounges.  Social networks allow us to connect to our attackers in unimaginable ways.  Every protection we have built can and will eventually be bypassed.  It is no longer “if” but “when”.

The planned Data Breach Disclosure legislation in Australia will help us to help ourselves.  The intent is not to blame the victims, but instead give businesses incentives to protect their own assets, and break the culture of silence.  A company director is more likely to support a security improvement programme if they are the one who will be held personally liable for a data breach, the average cost of which in Australia was $2.13M last year.

Just like the Battlezone game, we need a radar to tell us when attackers are approaching, not discover it when having to clean up the mess.  Most businesses spend too much on protecting from attack, and not enough understanding the threat landscape they operate in, and detecting when the protections have failed.  In a video game we can just insert another coin, press start and try again.  We don’t have that luxury with our businesses.

Phil Kernick Chief Technology Officer
@philkernick www.cqr.com

CQR insights: Security Awareness Training Video’s

This year at CQR we were proud to launch a new service with the development of our Security Awareness Training Video’s. It is exciting to be the only company within Australia who can offer this method of information security training. The videos have been designed and developed using the knowledge from experts in their field who work here at CQR.

The video’s are designed to help all staff at organisations large or small to understand the importance and sensitivity of the information they handle and need to protect. The videos also provide the tools and tricks on how to be ‘Security Smart’.

It is a common misconception that staff already know how to protect their information not only within the office but at home and on the move. Too often this is not the case which can lead to go breaches occurring. Each video incorporates visual animation and human speech, with expert advice from our Information Security Guru who gives practical advice to assist in avoiding those simple mistakes.

There are 14 video’s available covering a spectrum of information security topics including Protecting your Digital Identity, Safe Internet Use, Workplace Security, BYOD and Social Media. They are each a maximum of two and half minutes in length and are available in a variety of presentation formats suitable for online delivery.  CQR will also provide a Q&A document for each video for staff training assessments.

For further information please check out our training section on our website www.cqr.com/information-security-training and get in touch with us either through the website or by calling our office on 1300 277 001.

Sarah Taylor
@cqr www.cqr.com