Cyber Security

<html><body>
There has been an arrest following the data breaches at property valuation firm Landmark White earlier this year.
The NSW Police Force Cybercrime Squad were acting on the <a href="https://www.urban.com.au/news/94968-landmark-white-limited-reports-property-valuations-data-breach" target="_blank">cyber security hacks </a>that occurred in February <a href="https://www.urban.com.au/news/99840-landmark-white-s-viability-in-doubt-after-second-saboteur-valuation-leak" target="_blank">and June</a>. 
In June detectives from the NSW State Crime Command’s Cybercrime Squad established Strike Force Vide to investigate unauthorised access to the main database and document store of the company.
With the assistance of company staff, investigations identified that unauthorised access was gained into the company’s database and more than 170,000 data records including personal information and valuation documents were uploaded to the dark web and the internet.
Following extensive inquiries, strike force detectives arrested a 49-year-old man in Sydney’s CBD about 8am today.
<img src="https://res.cloudinary.com/dz9xllyip/image/fetch/c_scale,w_580,q_auto:good/https://s3-ap-southeast-2.amazonaws.com/po.images/2019/10/2/Landmark%20White%20NSW%20Police.jpg" alt="">
Shortly after the arrest, detectives, assisted by the Public Order and Riot Squad, executed a search warrant at a home at Rozelle, and a crime scene warrant at a business data centre at Ultimo.
The man, who is a software contractor, has been taken to Surry Hills Police Station, where he is expected to be charged.
Investigations under Strike Force Vide are continuing.
Timothy Rabbitt, CEO of LMW, said “the arrest was a great relief for the business and our staff, and would help ease the stress many of our staff have felt over the last six months”. 
“The arrest was also a vindication of LMW’s stance that this was a serious crime committed against the company. We are grateful that the person arrested was not an employee.
“We hope today’s arrest will bring closure to these data incidents and will give confidence to LMW’s clients, partners and staff, that we can continue to provide a secure long-term work environment for our staff and a quality service to our clients.”
LMW’s team, including appointed digital forensic advisors and privacy consultants, have been working closely with the Cybercrime Squad since the incident occurred.
 Investigations have revealed that the breach was carried out by an individual external to LMW with trusted inside access
Landmark White, who estimated that the breaches <a href="https://www.urban.com.au/news/98248-landmark-white-data-breach-to-cost-over-6-million" target="_blank">cost the company over $7 million</a>, have since <a href="https://www.urban.com.au/news/104174-landmark-white-get-anz-back-on-board-after-data-breaches" target="_blank">got ANZ back on board</a> as they try and rebuild. 
The company has undertaken a significant investment in IT security and other system enhancements, engaging external network security experts.
“The enhancements to our network security allow us to demonstrate via third-party audit that our IT systems represent a best-practice, secure platform," Rabbitt says.
"In driving these ongoing enhancements, our goal is always to provide services to our clients in an efficient, cost-effective and secure manner,” 
Rabbitt said the incident had caused significant disruption to its business and caused a great deal of stress and angst to our staff, but that the events of this year had made the firm stronger.
“A number of financial institutions with whom we’ve had long-term relationships have reinstated LMW to the panels of valuation providers, which is fantastic.
"We are also extremely grateful to our 300 loyal staff, who have continued to work with us to put our clients first,” Rabbitt said. 
“We have been a trusted member of the industry for over 40 years, and we look forward to putting this incident behind us and getting back to work with all our clients and partners across Australia.”
 
</body></html>

jrobinson-rf4aSBido9

NSW Police make arrest of alleged Landmark White dark web cyber hacker

<html><body>
The property valuation platform Landmark White are making steps to get back on track after two data breaches earlier in the year.
They were dropped by all of the big four banks after a <a href="https://www.urban.com.au/news/94968-landmark-white-limited-reports-property-valuations-data-breach" target="_blank">cyber security breach in February.</a> There was a <a href="https://www.urban.com.au/news/99213-landmark-white-reports-more-private-valuation-files-posted-online" target="_blank">later breach in May.</a>
They have managed to get ANZ back as a client, according to the Australian Financial Review, however Westpac, NAB and CBA are yet to sign back up.
John Wise, chief financial officer of LMW, told the AFR they anticipate their reinstatement in of the company in the near future.
In their full year statutory accounts submitted to the ASX, LMW advised revenues were hit between $6 million to $7 million, with an after tax loss of $15.1 million for the year to June.
They advise their $5.44 million capital raising "will enable the business to restructure its operations in line with an anticipated lower ongoing revenue base following the data disclosure incidents.
"This will enable the business to return to profitability and positive cashflows," LMW stated.
LMW returned to the ASX in August with <a href="https://www.urban.com.au/news/103244-landmark-white-shares-fall-to-9-cents-on-return-to-asx" target="_blank">shares plummeting to 9¢</a>.
Early morning trading has been at 12¢ a share. 
Timothy Rabbit, who has been the acting chief executive since March <a href="https://www.urban.com.au/news/96461-landmark-white-chief-chris-connan-quits-following-dark-web-data-security-breach" target="_blank">when Chris Coonan stepped down</a>, has been announced as the permanent CEO.
Rabbit joined LMW in late 2018 following the acquisition of Taylor Byrne, a leading regional property valuation firm with 26 offices across Queensland and New South Wales.
"The progress of the company since Timothy's appointment as acting CEO is a testament to his ability to developer a cohesive group across LMW's business units," company chairman Keith Perrett said.
 
 
</body></html>

Landmark White get ANZ back on board after data breaches

<html><body>
Landmark White's second suspension from the valuation panels of major lenders was having "a major impact on the business and its viability", acting chief executive Tim Rabbitt told staff last week in a leaked email.
The troubled valuation firm, hit by two unauthorised valuation data leaks on the web, told staff it is considering a sale of "the whole or parts" of the business.
It acknowledged reinstatement by its major lenders was not likely "immediately." Nor any quick reinstatement onto the ASX.
It added that having used up a significant portion of its cash reserve during its first suspension period in January, the current second suspension which began in early June was having "a major impact on the business and its viability."
The <a href="https://www.urban.com.au/news/97201-landmark-white-see-westpac-return-after-dark-web-data-privacy-breach" target="_blank">initial breach</a> cost up to $7 million.
"Without an immediate reinstatement from our clients, the business is likely to be in trouble in the very near term," Mr Rabbitt said in the email seen and quoted by the Australian Financial Review Weekend issue.
"The company is still working on reinstatement, but the directors (as is their responsibility to do now) have to consider alternative options for the business including the potential sale of the whole or parts of the business."
Landmark White has been unable to convince its lenders, which include three of the country's largest banks (with the exception of Westpac) to turn work back on in the wake of a second theft of information.
The saboteur posted a range of documents posted to file-sharing site SCRIBD.
LMW warned lenders that the cutting off lines of work posed a threat to the viability of the valuation industry as a whole which earned a rebuke from its own industry body.
Landmark White chairman Keith Perrett on Friday said he was proud of his staff for the commitment they had shown the company in the wake of the second information theft.
"Our management team is working closely with staff to ensure they are informed and supported as we work through the challenges the business currently faces," he said.
"We're communicating with our employees on the state of the business every day, and will not apologise for being open and transparent about the incident and impact on our business."
"LMW has been a successful business for almost 40 years, one that employs more than 450 people across Australia including in regional and remote areas," he said.
I<a href="https://www.urban.com.au/news/99213-landmark-white-reports-more-private-valuation-files-posted-online" target="_blank">t maintained the latest data breach</a> did not constitute a notifiable breach under law as only limited private information was contained in the documents posted onto document sharing site SCRIBD.
Earlier this month Landmark White had previously disclosed CBA and ANZ were among a "small number of clients" who had dropped LMW from their valuation panels.
 
</body></html>

j.ballantyne1990-6AQqhLzZaK

Landmark White's viability in doubt after second saboteur valuation leak

<html><body>
Property valuation and consultancy firm LandMark White have said revealed the data breach from their servers in February will cost the company up to $7 million.
The first sales of shares when re-opened on the ASX this morning were trading at 20¢. At late morning they were trading at 25¢, a 34% drop since its last trade in March when trading was halted.
In a notice to their shareholders submitted to the ASX, LandMark estimated a loss of revenue of around $5 million to $6 million.
They also cited further losses of around $1 million of revenue likely to be lost between now and the date of full reinstatement by the remaining financial institutions and restoration of more normal revenues.
NAB, Commonwealth Bank and ANZ <a href="https://www.urban.com.au/news/95286-landmark-white-valuation-data-breach" target="_blank">all dropped LMW</a> following the breach which saw around 250,000 individual records and 137,500 unique valuation records stolen and <a href="https://www.urban.com.au/news/95371-landmark-white-valuation-data-available-on-dark-web-forum-after-privacy-breach" target="_blank">put on the dark web</a>. 
LandMark White are set to post a net loss after tax of $2.3 million in the year to June.
<img src="https://res.cloudinary.com/dz9xllyip/image/fetch/c_scale,w_580,q_auto:good/https://s3-ap-southeast-2.amazonaws.com/po.images/2019/5/LMW-Chart.jpg" alt="">
LMW's shareholders are set to take the brunt of the hit.
"In order to enable LMW to rebuild its cash reserves, the Broad of LMW do not expect to declare a dividend for FY2019", the submission to the ASX read.
"The Company will be reviewing its position for the re-commencement of dividends at the appropriate time.
Both <a href="https://www.urban.com.au/news/95371-landmark-white-valuation-data-available-on-dark-web-forum-after-privacy-breach" target="_blank">Westpac</a> and <a href="https://www.urban.com.au/news/96628-commbank-resumes-landmark-white-valuations" target="_blank">Commonwealth Bank</a> have resumed their services with LMW.
"LMW has secured further support from its corporate bankers to enable the company to trade through its monthly receipt and payment cycles whilst its cash reserves build."
 The Board predict a return to normal levels in FY2020, should LMW be reinstated to all key former clients.
 
</body></html>

LandMark White data breach to cost over $7 million

<html><body>
The Australian Property Institute (API) is rallying to support the property industry in the wake of recent cyber attacks on Australian organisations.
The announcement comes after property valuation firm Landmark White (LMW) saw data sets stolen and listed <a href="https://www.urban.com.au/news/95371-landmark-white-valuation-data-available-on-dark-web-forum-after-privacy-breach" target="_blank">on the dark web</a>.
The Landmark White case saw its boss, Chris Coonan, <a href="https://www.urban.com.au/news/96461-landmark-white-chief-chris-connan-quits-following-dark-web-data-security-breach" target="_blank">step down from his role</a>.
Amelia Hodge, CEO of API, said any enterprise can be caught by cyber crime.
“Cyber attacks are criminal acts, and recent cybercrime by unknown perpetrators on a range of Australian private and public sector entities demonstrate that any enterprise of any size can fall victim," Hodge said.
“Our concern is obviously for our members and the clients impacted by these criminal acts. 
"We are here to fully support those impacted in any way we can. We have just under 400 API families directly impacted by the suspensions and it is important to move to a business as usual state as quickly as possible.” LMW is not alone. In February, the Federal Government announced that the Australian Parliament and political parties had also been subject to cyber attacks. 
Hodge said that in the case of LMW, the company has reported that the personal information disclosed ranges from relatively benign and publicly available, to, in a small number of cases, more detailed category identification information.
“We are further informed that the breach was isolated, that it has been fully investigated by the relevant authorities and there is no evidence of misuse of any of that personal information,” Hodge said. LMW have been working with independent cyber security consultants, along with the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner, to ensure client information and LMW’s network is secure.  “Cyber attacks represent just one of the risks businesses face simply because they are in business,” Hodge said.
“Because they are criminal acts, no business is immune. While it is not possible for enterprises to completely remove all cybercrime risk, it is possible to prepare for the possibility, mitigate the risk, contain and remediate any damage following a cyber attack and, in the interests of all, be able to return to business-as-usual as soon as the risk is satisfactorily resolved.”
</body></html>

jonathanchancellor-7SQnKwU6yx

Australian Property Institute rallies to support industry in wake of cybercrime

<html><body>
Chris Coonan, the chief executive of Landmark White, has resigned from his post following the cyber security breach that saw thousands of records posted on the darkweb.
Coonan had spent over 14 years at the embattled property services company, who have <a href="https://www.urban.com.au/news/95286-landmark-white-valuation-data-breach" target="_blank">lost a string of major clients</a> including CBA, NAB and ANZ since a dataset containing property valuation and personal contact information <a href="https://www.urban.com.au/news/94968-landmark-white-limited-reports-property-valuations-data-breach" target="_blank">stolen last month</a>.
He was named CEO in 2016, having previously been the national director for residential valuations.
Landmark White have been under fire from all angles since the dataset was <a href="https://www.urban.com.au/news/95371-landmark-white-valuation-data-available-on-dark-web-forum-after-privacy-breach" target="_blank">listed on the dark web</a> in February.
"We can now share that on 30 December 2018, we received a message through the 'Live Chat' messaging service on our website, providing us with a link to the dark web," the company advised at the time.
"An unknown criminal has maliciously accessed a LandMark White’s system."
"We do not know the identity of the individual," it added.
Its investigations reveal that the dataset contained:
<ul>
<li>approximately 137,500 unique valuation records, and approximately 1,680 supporting documents.</li>
<li>approximately 250,000 individual records in total but a lot of records are duplicates.</li>
<li>The date of the documents range between approximately 4 January 2011 and 20 January 2019. </li>
</ul>
The board has also announced that co-founder of LMW, Glen White, and Frank Hardiman will stand down as a Non-Executive Directors of the company.
<div title="Page 2">
<div>
<div>
<div>
Glen established the Queensland practice that became Landmark White in 1982 and served as a Non-Executive Chairman between December 2015 and May 2018.
Frank was the Chief Financial Officer and Company Secretary of LMW between 2011 and 2016, before being appointed a Non-Executive Director of the company.
<div title="Page 1">
<div>
<div>
<div>
The board acknowledged Chris’ tireless efforts in his role, but agreed that the changing nature of the business and market conditions – combined with major reputational challenges caused by the recent cyber-attack – had changed the requirements for the executive leadership of LMW.
In the interim, it announced the appointment of Timothy Rabbitt as Acting Chief Executive Officer of LMW.
<div title="Page 1">
<div>
<div>
<div>
In October 2018, LMW announced a merger with Taylor Byrne to further cement LMW's position as the largest, locally owned ASX-listed valuation property services business.
<div title="Page 2">
<div>
<div>
<div>
Founded in 1982 and listed on the Australian Stock Exchange in 2003, LMW has over 400 staff.
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body></html>

Landmark White chief Chris Coonan quits following dark web data security breach

<html><body>
EXPERT OBSERVER
Why is the manufacturing industry a target for cyber criminals?
In two words, money and information. Most cybercriminals want cold, hard cash or access to trade secrets.
In its <a href="https://www.verizonenterprise.com/verizon-insights-lab/dbir/" target="_blank">2018 Data Breach Investigations Report</a>, global telecommunications and technology company Verizon reveals that financial motives are behind just over half of all data breaches in the manufacturing sector, while espionage makes up most of the other incidents as spies seek to gain confidential information from companies.
The findings show what the cyber crooks are after, with personal information (32 per cent), company secrets (30 per cent) and credentials (24 per cent) topping the list. With the latter, stolen credentials can be used to ramp up cyberattacks and access other data types.
Chris Tappin, Principal Consultant at the Investigative Response team for the Verizon Threat Research Advisory Centre, points out that first-mover advantage is crucial in the manufacturing sector, so cyber criminals are hell-bent on trying to pinch companies’ best ideas. “If they can obtain trade secrets, such as plans and R&amp;D information, and then use these to bring an idea to market first, they can potentially make big financial wins,” he says.
Whereas organised crime gangs are responsible for most attacks on retailers, accommodation, food services groups and financial services companies, state-sponsored hackers carry out the greatest percentage of manufacturing attacks. These rogue governments want intellectual property as a means to score trade success and often see manufacturers as an easy target because old IT systems are difficult to update and protect. Better still, they know that many manufacturers’ supply chains are large and exposed, giving them an opportunity to infect many suppliers and businesses at the same time.
What are some high-profile examples of attacks on manufacturers?
One of the best known is the attack on networks of defence contractor Lockheed Martin, and the world’s largest aerospace manufacturer Boeing, in a series of strategic data breaches on top-secret plans and information around a decade ago.
Authorities were stunned at the scale of the espionage in which hackers accessed designs and data on the F-35 Lightning II joint strike fighter jet, the B-2 stealth bomber, the F-22 jet, space-based lasers, missile navigation and tracking systems, and more.
Following the FBI’s 2014 arrest, and the subsequent jailing, of a businessman reportedly working with the Chinese military, the hackers’ modus operandi was revealed to involve phishing emails to employees at the target companies and installing malware on their systems which allowed remote access to directories containing the trade secrets, along with other sections of the companies’ networks.
How do cyber criminals typically target manufacturing companies?
Traditionally, it’s via phishing campaigns to gain unauthorised access to systems and data, tricking executives and employees into revealing login credentials and other private information. Networks, as a result, become highly exposed.
“The initial vector of intrusion is often not that sophisticated,” says Simon Ezard, a Senior Security Consultant at the Verizon Threat Research Advisory Center. “Unsophisticated cases involve attackers sending phishing emails, sometimes to thousands of people and in the hopes that a percentage of those will fall victim.”
Verizon’s research indicates that in most cases manufacturers can expect the cyberattacks to come from outside the business. In about nine out of 10 data breaches, external players are to blame, with employees responsible for just a small percentage of incidents.
What action should manufacturers take to limit threats?
With crucial company data, trade secrets and business reputations at stake, it is incumbent on manufacturing leaders and innovators to protect their intellectual property.
There are some basic means to combat cyber criminals, including being vigilant, educating employees about the dangers of phishing scams, keeping anti-virus software and patching up to date, encrypting data and using multi-factor authentication to limit the chances of attacks.
According to Verizon, manufacturers should also be taking three overarching actions to mitigate risks:
<ol>
<li>Separate highly sensitive and secret data from the rest of their networks, and restrict access to only those individuals who absolutely require it to do their jobs.2.</li>
<li>Implement data-loss-prevention controls to identify and block transfers of data by employees, and especially those who are terminated or resigning.</li>
<li>Ensure that employees quickly report phishing attacks so they can be better understood and combatted.</li>
</ol>
“Make people your first line of defence,” Ezard says. “Give your employees cybersecurity and social engineering training. Help them learn how to spot a phishing email and empower them to speak up to their IT department if they become suspicious.”
</body></html>

How can manufacturers beat cybercrime?

<html><body>
GUEST OBSERVATION
A warning about a “new” international scam targeting Chinese students in Australia <a href="https://www.afp.gov.au/news-media/media-releases/scam-warning-fake-%E2%80%98virtual-kidnapping%E2%80%99-scam-targets-chinese-australians" target="_blank">was issued by the Australian Federal Police</a> on May 14, 2018.
In a typical scenario, students are contacted by someone pretending to be from the Chinese Embassy or Consulate telling them that they have been implicated in a serious crime in China or Taiwan, and asking them to collaborate with investigations.
The target is told to hide themselves for a few days and cut off all contact, including with family members in China or Taiwan. The families then receive calls telling them their child studying in Australia has been kidnapped, and a ransom demand is made.
International scams of this nature are hard to investigate, but there are things you can do to avoid falling victim to them.
The evolution of a scam
Chinese and Taiwanese people have been victims of telecommunication scams like this for decades.
Crime syndicates would provide notes to their members, teaching them how to mask their caller IDs and what to say. The criminals usually collect personal information such as the student’s name, birthday, university attended and where they are originally from. This information, though basic, is essential to build trust with the victims.
The scam starts in Taiwan
The first generation of the kidnapping scam started in Taiwan in the late 1990s.
Organised crime syndicates would call parents and tell them that their child had been kidnapped and demand a ransom. During the call there would be sounds in the background of someone crying and screaming, saying “Help me, Mum/Dad!” Sometimes they might have the name of name of the child and, occasionally, will have researched the background of the family. Lots of Taiwanese were caught in the scam and paid the ransom.
Since the sim cards in use at the time were usually pre-paid cards, and the mobile phones usually cloned, criminal investigation was difficult. This pushed Taiwanese Government to tighten the rules on purchasing pre-paid cards.
And then moves to China
Before too long organised crime syndicates with members from both Taiwan and China started to use this method to scam people in China.
Criminals set up their crime base on Kinmen Island (an island belonging to Taiwan located close to the Chinese mainland). From there they could connect to the signals provided by a Chinese service provider and scam people in China. Conversely, crime bases were set up in Xiamen, the China territory opposite Kinmen, using signals provided by Taiwanese service providers to conduct scams on Taiwanese people.
In both situations they could avoid being arrested as there was limited collaboration between Taiwan and China on criminal investigations. Collaboration between the two jurisdictions only began when the Chinese government realised the seriousness of the scam.
The scam comes to Australia
With the commencement of cooperation between Taiwan and China against the telecommunication scam, a number of cases were successfully cleared and suspects were repatriated between Taiwan and China for prosecution. To minimise the risk of prosecution, organised crime syndicates then moved to their operations to Eastern Europe, East Africa or Southeast Asia (including Australia, Cambodia, Indonesia, Kenya, Thailand and the Philippines) in the past few years.
Moving the call centre to a third country not only made it more difficult to investigate the crime, it also made a successful prosecution more difficult.
Old scam, new tech
What is innovative in the recent scam compared with the earlier ones is that they have chosen to target international students from China and Taiwan who are away from their family. International students are more likely to be a successful target since it’s harder for parents based overseas to check whether the event is real.
With the advance of technology, people are now putting more information online. At the same time, student data is a popular target for hackers and a hot product on the online black market. Criminals are able to target parents, build trust with them and persuade them the scam is real using the detailed information they have about the family and the “kidnapped” child.
In the reported cases, the students followed the instructions of the criminal syndicates and hid themselves. When concerned parents cannot get in touch with their child, they tend to believe the scam is real and pay the ransom.
Criminal investigation is difficult
The transnational character of the crime has made investigation difficult. The victims – students and parents – are in different countries and, to make progress on an investigation, the Australian authorities need cooperation with Taiwanese or Chinese authorities. As the victims are not resident in the country where the syndicate is based and from where the scam is conducted, the police in the third country are usually reluctant to collaborate.
Furthermore, members of the crime syndicates are highly mobile and it is often too late to secure evidence and arrest criminals by the time the police in Australia have received and actioned a request for investigation assistance. Or it might turn out that the call centre is not in Australia but in a third country.
What students and families can do
With scams like this it is important to encourage reporting to the police and to raise public awareness. In this case, the Australian Federal Police, and the Chinese Embassy and the Taiwan Cultural and Economic Office in Canberra have all issued an alert to students about the scam.
Students and parents should have diverse ways of making contact with each other. For example, students could share with their parents the contact information of their close friends so that the parents have another way to contact their children. They also should have a special way or code to indicate to each other when they really are in danger.
<img src="https://counter.theconversation.com/content/96910/count.gif?distributor=republish-lightbox-basic" alt="The Conversation" width="1" height="1">Finally, everyone should be vigilant about securing personal data. This includes: schools securing their systems to avoid leaks of student information; students being careful not to put too much personal information online; and all parties being alert when adding new friends on social media.
Lennon Y.C. Chang, Senior Lecturer in Criminology, Monash University
This article was originally published on <a href="http://theconversation.com" target="_blank">The Conversation</a>. Read the <a href="https://theconversation.com/new-virtual-kidnapping-scam-targeting-chinese-students-makes-use-of-data-shared-online-96910" target="_blank">original article</a>.
</body></html>

New 'virtual kidnapping' scam targeting international Chinese students makes use of data shared online

<html><body>
Outwitting hackers with sophisticated software makes for the stuff of spy novels. But in the real world, simple physical security measures also have a huge role to play to keep critical data in the right hands.
That’s not to dismiss the need for some technical wizardry in the digital age. Cyber-attacks have increased in both frequency and intensity in recent years, with the average cost of a data breach up 23 percent since 2013.
Experts say, however, that many of these breaches could be prevented, with good old fashioned physical security. After all, an unauthorized visitor, a contractor or less-than-loyal employee is much better positioned to steal sensitive information than a high-tech hacker a thousand miles away. And a lot simpler to stop.
“With the focus on anti-virus software, access controls and other forms of automated information security protection, it’s tempting to be lax about physical measures,” says Bill Todd, senior facility manager, JLL. “Yet, a few smart moves can go a long way toward fending off harm to an organization. It’s important to fight cybercrime both in the virtual world—and in the actual facilities where the information is stored or accessed.”
Buildings designed to be secure
One strategy is to design the workplace with security in mind. Separating the reception or elevator lobby from workspace, for example, limits access to areas containing sensitive data.
“For multi-floor corporate tenants in large office buildings, keeping a locked door between the elevator lobby and the workplace has become a standard practice,” says Todd. “Where possible, it’s also smart to keep high-visitation areas, such as conference rooms, on a separate floor from access points to highly sensitive data.”
Data centers and telecom closets should also be subject to video security; highly sophisticated cameras are more affordable than in the past, and can serve two valuable functions. First, their very presence will deter would-be wrongdoers who prefer an easier target. Second, cameras allow for a forensic review if incidents do occur and make it easier to catch the culprit.
Controlling access to restricted areas is a must. State-of-the-art security measures such as smart cards, tokens, or biometric scans which record the identity of each person who enters not only keep outsiders outside, but also prevent access by employees who have no business being in areas containing sensitive data. For extra security, encrypted security badges are preferable to simpler electronic badges that can be stolen during an elevator ride or standing in line for coffee.
Managing facilities to maximize security
Even sophisticated safeguards to keep intruders out are not the be-all and end-all of the physical protection of an organization’s sensitive data. That’s mainly because such systems often can’t keep a determined insider from stealing a hard drive or a password written on a sticky note attached to a computer.
“Given the number of passwords we all use each day, it’s no wonder that it is a common practice for employees to keep them visible and near the equipment they use,” says Todd. “Facility managers can help enforce a clean-desk policy that not only keeps passwords secure, but also helps prevent theft of sensitive printed information left out in the open.”
Todd suggests that even the most sophisticated organizations may overlook these simple, low-cost measures—that facility managers are uniquely positioned to make happen:
<ul>
<li>
Don’t leave computers unattended in unsecured areas. An unauthorized intruder can use any computer connected to a network to access information. Vulnerable computers include workstations in the reception area, at unoccupied desks or in empty offices. Equip computers that must remain in the open with technology like smart cards or biometric readers to limit access.</li>
<li>
Disconnect or remove computers that aren’t being used. Even in secured areas, an unused computer can present a risk. When an employee is out on vacation or out sick, their desktop computer should be secured. If the computer is in an office, lock the door.</li>
<li>
Use case locks to prevent hard drive theft. Some of the most highly publicized data breaches have resulted from hard drive theft or theft of an entire computer. A related step: disable USB drives and optical drives to prevent unauthorized downloads.</li>
<li>
Keep printer areas clean. Many offices have a shared printing and copy room, where busy employees may inadvertently expose sensitive information in unneeded print-outs. Again, facility managers can reduce risk by enforcing proper disposal of documents.</li>
</ul>
The sharpest criminals have an eye for physical weaknesses in a workplace. Building in security measures and controlling employee habits around data security can help an organization stay in control of who sees sensitive information.
This article appeared in <a href="https://www.jllrealviews.com" target="_blank">JLL Real Views</a>
</body></html>

Cyber Security

Editor's Picks

Have something to contribute?

Developments

New apartments

New townhouses

News

Cyber Security

Editor's Picks

Receive the latest news stories to your inbox

Have something to contribute?

Developments

New apartments

New townhouses

News