Niel Harper:\u00a0 Precise figures are hard to provide due to the fact that many companies in Barbados and the wider Caribbean do not report breaches.\u00a0 This can be due to numerous reasons, ranging from the reputation (regulatory consequences and service outages) and financial (share prices hits or revenue decreases) risks associated with the compromise of private information, to the fact that there are no pervasive legislative frameworks which mandate that firms report breaches to government or to their customers.<\/p>\n

However, I would say that approximately 60% of organizations in the region have had at least one security incident over the last 1\u20132 years. This is mainly due to the growth in online data, as well as the increasing sophistication and organization of attackers. Other key factors are poor security practices, insufficient training and support, and the continuing use of unpatched or out-dated software. Comparatively, the statistics for personal users may be even higher given the significantly weaker or non-existent security controls present in many home computing environments.<\/p>\n

ICTP: \u00a0Based on your experience, what are some of the common misconceptions that organisations have about network security?<\/strong><\/p>\n

NH:\u00a0 The most common misconception about network security is that technology alone can provide adequate, effective and sustainable protection for information assets. An effective network security program encompasses people, process and technology. In the context of staffing (people), it is all about how you rationalize your IT security skill requirements to effectively address evolving security threats. This rationalization should allow for the creation of a baseline which characterizes, at a bare minimum, the core competences that IT security practitioners should possess to perform specific roles and responsibilities. These roles should be created, properly staffed and subject to on-going training.<\/p>\n

Aside from security practitioners, end-users should be exposed to education programs which foster awareness of the importance of security, as well as promote constant vigilance to prevent online fraud. From the process standpoint, there should be policies, procedures and guidelines in place which serve to govern the use of information and communication technologies. These processes should be explicit (non-ambiguous), consistent and enforceable. And finally, the technology that exists to prevent, detect and to some degree, correct security attacks is becoming more and more advanced. However, without a focus on people and process to compliment the technology, a firm\u2019s network security posture can be tantamount to having a gate with no sentry.<\/p>\n

ICTP:\u00a0 Are there any hardware and\/or software solutions that you believe might be more effective in addressing cyber intrusions?<\/strong><\/p>\n

NH:\u00a0 I tend not be an advocate of any particular vendor solution or software product, especially given the rampant commoditization in the industry. However, what I will zero in on is the importance of \u2018defence-in-depth\u2019<\/em>. This is in essence the layering of security technologies to provide a more comprehensive array of controls to better protect an organization\u2019s information assets.<\/p>\n