Why enterprises need to adopt 'need-to-know' security. Issue 12 (December 2019)

• Record Type: Journal Article
• Authors: Rangel, Aaron
• Is Part Of: Computer fraud & security. Issue 12(2019)
• Page Start: 9
• Page End: 12
• Publication Date: 2019-12
• Subjects: Computer crimes -- Periodicals; Computers -- Access control -- Periodicals; 364.168
• DOI: 10.1016/S1361-3723(19)30127-7
• Languages: English
• ISSNs: 1361-3723

Abstract

Abstract : A host of different cyber attacks – including phishing and ransomware, advanced persistent threats conducted by nation-state actors, zero-day exploits and more – are forcing security professionals to bring their 'A game' to work every day. In addition to these attacks, information security professionals must manage information in compliance with data privacy regulations such as the General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA) or else face stiff fines. Massive data breaches and large penalties imposed by regulatory bodies show no signs of abating and continue to make headlines across the world. To thwart new attacks and prevent breaches, you need to develop a new mindset that challenges the status quo and nurtures new ways of thinking, especially when it comes to protecting information assets. Traditional approaches are being rendered ineffective by social engineering attacks, globalisation and the Internet of Things. In the face of these and other challenges, a multipronged approach with a 'need-to-know'-based security model at the foundation is an effective strategy to secure enterprise information and prevent a breach, explains Aaron Rangel of iManage.