How to Safeguard Your DMS: FTC Enforces Against Georgia Dealer Because of "P2P" Software Exposed Consumer Data

Transcription

1 How to Safeguard Your DMS: FTC Enforces Against Georgia Dealer Because of "P2P" Software Exposed Consumer Data With Erik Nachbahr, President of Helion Technologies Moderated by Mike Bowers, Executive Editor of DealersEdge 1

2 Erik Nachbahr is President and Founder of Helion. He functions as Chief Information Officer to Helion's clients and brings over 14 years of information technology systems management experience. Erik provides technology direction and vision to the Helion team and to client partners. During an internship at the Ritz-Carlton, Erik learned that outstanding service is fundamental to a positive client experience. He believes that managing and solving our clients technology challenges is best done by a passionate, competent and friendly staff. Since 1997 he has fostered long term relationships with staff, vendors and client partners. A graduate of Loyola College in Maryland, Erik knew as an undergraduate that a BA in History would not pay the bills. He took two years off to earn a culinary degree from Baltimore International Culinary College. After earning a AA in Professional Baking and Cooking he returned to Loyola to complete his BA in History. After graduation he held technical positions with an ISP, a technology training company and a large insurance underwriter. Erik lives in Baltimore with his wife Meredith and two children, Kees and Tess. World Headquarters: 1965 Greenspring Drive, Timonium, MD or

3 THE FTC & DEALERSHIP SECURITY

4 ABOUT HELION / ERIK NACHBAHR 13 years working with Auto Dealers 70+ IT Professionals, many with BS and MS Computer Science degrees and advanced industry certifications 450+ Dealerships supported with 15,000+ end users Focused on security, compliance and productivity threats 4

5 SECURITY & COMPLIANCE CHALLENGES 5

6 WHAT IS P2P SOFTWARE? Typically used to share copyrighted music, videos and files Installed by an employee on their PC Automatically shares some or all of the computer s files to the Internet Legal liability and security risk but low on the list of threats 6

7

8

9

10

11

12 DATA STEALING MALWARE 82% of malicious websites are hosted on compromised servers 55% of data-stealing malware come from websites 92% of spam contains a website link Malware in mobile apps is increasing 12

13

14

15 15 FTC SPECIFICS

16 FTC CHARGE FTC has charged [a dealer].with illegally exposing the sensitive personal information of thousands of consumers by allowing peer to peer file-sharing software to be installed on their corporate computer systems. 16

17 VIOLATION SPECIFICS the company did not have an appropriate information security plan failed to assess risks to the consumer information it stored did not adequately train employees did not use reasonable measures to enforce compliance with its security policies such as scanning its networks to identify any P2P file-sharing applications operating on them did not use reasonable methods to prevent, detect and investigate unauthorized access to personal information on its networks 17

18 FINANCIAL INSTITUTION Because [the dealer] is a financial institution, the alleged security failures violated the Gramm-Leach- Bliley (GLB) Safeguards Rule as well as Section 5 of the FTC Act. 18

19 19 SOLUTIONS

20 REMOVE LOCAL ADMIN RIGHTS Single largest security threat in Dealerships Allows for downloading of viruses, malware, Users install unlicensed software and applications that disrupt business Users remove Antivirus and Antimalware applications 20

21 CONTROL BYOD (BRING YOUR OWN DEVICE) Historically controlled and discouraged by IT Departments Consumer products now commonplace in corporate environments (i.e. Smartphones) Unresolved data security and ownership questions Wireless is a prime area where control is needed (Milton Edge 7200 is an excellent solution) 21

22 ENDPOINT MANAGEMENT Tie computers to Microsoft Active Directory Deploy an RMM (Remote Monitoring and Management) Tool Control unwanted software applications Push and enforce policies, security and Antivirus to machines Regulate Windows patching 22

23 WEB FILTERING Prevents access to malicious websites or questionable content Robust solution such as Websense or Smartfilter Tie web usage back to user of the computer via server-based Active Directory Restrict access to non work related sites 23

24 END USER TRAINING / POLICIES All employees sign an acceptable computer use policy (cover software piracy/use here too) Samples: (password is policy ) Give access to online video training or a training manual to all new employees Ensure that managers / HR encourage proper computer use and security as the corporate culture 24

25 SECURITY ASSESSMENT / COVERAGE Recommended for all Dealerships Insurance risk coverage typically bound to security questionnaire Detailed assessment performed by CISA or CISSP Understand which holes need to be plugged 25

26 INTRUSION PREVENTION SYSTEM (IPS) IPS inspects traffic at the application level Allows for blocking of traffic such as P2P Looks for threat signatures WebSense has endpoint data management / security Cisco has strong ASA integration IPS solutions 26