Interview With Eduardo Ritegno
Eduardo Ritegno (Buenos Aires, ARG)
Eduardo Ritegno, based in Buenos Aires, Argentina, is a senior IT Manager at BNA (Argentinian National Bank). He is a specialist in Systems Development, Project Management, Audit, Governance, Risk & Compliance, mainly in the vertical finance market. He has been working across the American continent & Spain. He also held position as Director of the Argentinian Clearing House, and has been member and Chair of the CRISC Certification Committee at ISACA (Information Systems and Control Association) based in Chicago US, for consultancy work, and member of the Certification Board. Mr. Ritegno participated as a Team member in writing/reviewing COBIT5 professional series, and holds two professional ISACA certifications (CISA & CRISC), and is accredited as Quality Evaluator of the internal Audit (QAR – IIA).
One of Mr. Ritegno’s main concerns is on how we, in the corporate world, shall manage the data risk and keep the information/ data secured at the highest level. AC Mahendra K. Datu, Chairman of TaboraARGA, was able to interview him during their meeting in the US recently.
Mr. Ritegno, as far as we have learned, you’ve been in the IT industry for quite some time, and you have been witnessing the ups and downs of the companies due to their IT security standard practices in terms of security. What is your opinion in regard to the awareness of the industry players globally on the importance of putting more attention to their information security?
Independently of the kind on industry or country, I think that the main issues we must never disregard are the following:
– Confidentiality—ensure that transmitted and stored data cannot be read by unauthorized parties
– Integrity—detect any intentional or unintentional changes to transmitted and stored data
– Availability—ensure that users can access resources using all available channels and mobile devices whenever needed.
These are universal concepts that must be always taken into account, no matter what is the technology adopted and the cost of implementation. Today many international regulations and frameworks valid for different industries are putting emphasis in these concepts.
“Information is a key resource for all enterprises, and from the time that information is created to the moment that it is destroyed, technology plays a significant role. Information technology is increasingly advanced and has become pervasive in enterprises and in social, public and business environments.” (Cobit 5 introduction excerpt)
Having learned from NSA case in the United States that triggers much of the global concern on privacy and data security (and that’s included the Big Data), what is your recommendation to handle such issues – both individually and in the corporate level?
Individually: Awareness. There is a maxim that says that a person is a “slave of its words (written or spoken) and the owner of his silence (or thoughts)” but given the need to use electronic media/tools to communicate between ourselves, my advice is to be always cautious when we express ourselves with due respect and to be trustworthy.
At the corporate level: Training. Human resources are the most important asset of the company. We usually oversee this aspect not giving the proper training to our employees, to help them counter-attack the threats that they are being subject to. On the other hand, employees who are not trained in security best practices, and for example have weak passwords, visit unauthorized websites and/or click on links in suspicious emails or open email attachments are an open gate for receiving all kind of attacks. Regarding corporate data (also historical bulk data or Big data stored in Data-Warehouse systems), companies must carefully evaluate, making a Risk assessment, what kind of information/reports is going to be kept on-premises and what is going to be transmitted electronically to third parties or external sites.
Data privacy is better kept, with good regulations (internal and external), internal training, and complying with those regulations. Thus, solid internal policies, revised and updated regularly are one of the key factor to counter attack those risks.
Most companies, especially small and medium-scale enterprises are heavily dependent on the role of social media (Facebook, Twitter, Path, etc.) to increase the impact of their marketing strategy. What do you say about this trend? And, what are the safest ways in using social media to do so?
No doubt that nowadays the use of social media is a very powerful marketing, and social relationship tool for companies, and are also part of the myriad of electronic channels available. Besides the technology needed to support social media, the most important factor is to set up an internal area and arrange a team of employees having a good knowledge of the mission and vision of the company, products, corporate/reputational Risk and compliance. This training must also include writing skills, in one or more languages, to help them to answering and communicate properly. Also establishing at least one authorization level before approving and releasing answers/news to the public. Companies can outsource the technology, but must never outsource this specific area. On the other hand will never be able to transfer the risk, for anything that is improperly communicated on behalf the company through this channels. In other words, they will be always accountable.
Finally, this electronic channels, being part of the sort of electronic channels available, must keep the look and feel of the corporate image, colors, and products, as shown on other electronic or classic channels of the company.
Big Data is currently as big as the issues it brings about, especially when it relates to privacy and security. Some companies make more money by selling customers’ data involuntarily, or without full customers consent. Each country has different policy and regulations globally on this matter, so it is more difficult to tackle such case individually country by country. For instance, you can sell millions of banks’ customers’ information/ personal particulars in one country to another without hassle, on done through advanced digital avenues. What’s your recommendation – or rather opinion – for corporate world to avoid such case to occur in their ‘households’?
You are right, today the more a business knows about an individual, the more can personalize all kind of services. And people love personalized services, they feel important, they want targeted offers according to their tastes and customs. The sad reality is that in the backend, they are collecting data from many online sources, analyzing and reselling this information. Of course customers’ fears that this information is going to be lost or misused has also increased.
In the particular case of Banks, that are highly regulated entities, they usually have very strong security systems in place and regular monitoring that can prevent external attacks. Many concerns about Banking customers data privacy, is related to customer education to help them identify the low tech threats that can pose a high risk, like phishing (counterfeit sites linked in an email asking data to the customer that a Bank never asks online) or Social engineering. Also when adding new customers, Banks are very careful to comply with AML/BSA regulation having strong processes and watch lists along with the KYC policy.
I think that sometimes the enemy is inside, like in the case of disgruntled employees, also considered one of the main 6 Risks for companies today. Internal attacks are one of the biggest threats facing your data and systems, especially members of the IT team with knowledge of and access to networks and data centers and admin accounts, can cause serious damage. Regular review of the privileged account and credentials, “need to know basis” access rights management, logging and tracking account activities, and employee termination are policies that must be carefully followed.
Also as a standard practice, implementing DLP (Data Loss preventions) tools are good technical solutions available for controlling sensitive information leaving the company.
The trend of letting employees to subscribe BYOD policy (Bring Your Own Device) for the same of efficiency has invited another challenge in data/ information security. Companies embarking on this kind of policy will need extra caution on keeping some sensitive data secured. Any suggestion about this remark?
One of the highest risks in the BYOD is data leaking, when subscribing that policy, the boundaries between work and personal technology are dissolved. Even though the use of personal technology can considerably enhance the business, it also creates a more fragmented technological environment. Currently Mobile devices (BYOD) is one of the top 6 security Risks for companies. And data theft is one of the highest vulnerabilities of portable devices. Moreover, it turns very hard work for the IS areas at companies to apply consistent security policies and to manage those devices when we admit multiplatform (multi-brand, multi-OS) with a single team of agents.
Some companies do not allow the BYOD policy and instead of that, they distribute their own portable devices configured with the necessary security according to the policy. Besides the technical implications, if BYOD is accepted in a company, they must be sure to have a carefully written BYOD policy. With a good BYOD policy in place, employees are better educated on how to use devices and the companies can better monitor the documents that are being downloaded to employee-owned devices
What is likely the trend of data insecurity in the years to come, and how shall we get prepared?
Technology is continually evolving, and the online information systems are getting more sophisticated bringing the customer a better user experience. This is a continuous race, where the hackers are also getting more sophisticated. In this context, data security is and always will be one of the main issues. Notwithstanding how sophisticated are the counter measures adopted by companies to protect their own information systems against any attack, the weakest link is still the human being.
Again, awareness and training are necessary ways to prepare ourselves to mitigate data insecurity. Careless or uninformed employees that are not trained in security best practices are also on the top 6 biggest risks for companies today. Training our customers and internal staff is basic, starting internally with the Human Resources, and having solid policies in place and enforce compliance. To train employees on cyber security best practices and offer ongoing support is a need. For example some employees may not know how to protect themselves online, which can put sensitive data in danger.
About the ‘Cloud Computing’ trend, what is your opinion?
Cloud Computing is also considered one of the main 6 risks for Companies nowadays. Cloud computing is going to grow in certain industry verticals, but will go much slower in others, for example the finance industry. When adopting Cloud Computing, service level and data breaches or data losses are the main concerns. We are talking about security and privacy, thus what information systems are going to be outsourced and what kind of information (sensitive or not sensitive) is going to be posted in the cloud must be carefully evaluated. Risk Assessments and BIA analyses, along with processes maturity are the best ways to make the right decision on Cloud Computing.
Regarding the decision to adopt this technology, depending on their size and complexity, some companies opt for using different architectures, such as private or hybrid clouds. Companies must keep in mind that Cloud computing poses new risks, and the must be able to manage and to mitigate some of the inherent risks of Cloud Computing. This new risk scenario, that is inherent to the cloud model, in some way forces security and risk practitioners to rethink their data security practices and solutions.
One of the best technical defense against a cloud-based threat, is to defend at the data level using strong encryption. For example AES 256-bit, recognized by experts as the crypto gold standard. Also to retain the keys exclusively to prevent any third party from accessing the data even if it resides on a public cloud is a good measure.
Insights: Power For Facing Crisis
By Javier Manendez (San Bernardino, CHILE)
What can we do when there are some threating events for our lives, physical or emotional well-being?
1. Do what you can do
When a financial crisis arises there are some things that you can do: review your budget, rationalize some expenses, etc. When family crisis come, there are some things you can do to help to contain the situation: if there is a relational problem, talking to the other part involved to find a way to solution, show love, etc.
2. Don´t try do what you cannot do
Don’t waste your energy trying to change the things that are beyond your control. You can do something to control your budget, but you couldn’t do anything to control something like the real estate crash of 2011 in the US.
In the financial, familiar, work wreck, the main question it´s not “are you doing something to solve it?” (I hope you do!), but the main question is “¿are you filling guilty for things you cannot control?” may be somebody in your team broke your trust and shared something he didn’t supposed to with the competition. Or in the familiar you are facing some wrong decisions of your son / daughter and you can`t do anything to change his/her mind.
There are things you can control. Those are problems to solve. But others you cannot. Those are facts to accept. We have to know the difference between both because this is key to maintain our mind and soul healthy in times of crisis.
If you are passing through situations that causes anxiety and you think you can do something to solve, do it, but don´t let yourself be lead into panic if your efforts are not enough.
I have a friend who grew up in a farm. His father had a barn where along with the grains, he kept half of the machinery he used for the farm. One night the barn took on fire. The work of 6 months was gone along with the money invested in the machinery as well. Firemen came to control the spread of the fire but it was too late to save something of the barn. “My father could have said: well that’s it! – my friend said- We lost everything” and regret and get depressed for the lost. The fire was something that he couldn´t control. But there was something he could. The next day he called his neighbors, explained the situation and he offer to buy grain to credit and rent some of their machinery to lift up the farm again.
3. Keep your vision in front
A stumble, even a fall in the business doesn’t mean what you do it´s not correct or it doesn’t have any future. Re focusing in times of crisis often leads to keep your vision simple. In times of crisis, if you give assignments to your team accordingly (something they can do), probably that will create a good environment for work, until you regain momentum.
4. Affirm and challenge your team
In times of crisis the most that a team needs is the affirmation of the leader. Assure them in the best of your knowledge that you will do YOUR BEST, to keep them in job. Don’t rise up false expectations, but if they see and hear from you that you need them and you will do all possible to keep them, that affirmation will give relief to them, even if the future looks uncertain.
5. Faith
Believing it`s not something merely religious. It`s the expectation that there`s a reward for the good actions and motivations even when the panorama looks obscure at this point. For those of us who believe in the supernatural, we know that there is a God who sees everything and who is able to intervene in our favor during times of crisis. Never forget there is a reward for those who proceed with integrity and good motives in life. May be not now immediately but it`ll come if you keep faithful in the crisis.