From: IT World Canada

By: Howard Solomon

In this contributed opinion piece, an official of a security supplier says  Canadians have to take security more seriously

(The author is Canada  sales manager of Chicago-based Trustwave Inc. )In our recent 2013 Global Security Report, out of the more  than 450 data breaches we investigated Canada ranked third of the nations we  looked into.

Canadian organizations in general lag behind other nations in the adoption  of thorough cyber-security strategies leading to cyber-attacks which are  generally not publicized.
Why? The main reasons – lack of government regulations, low awareness  levels of the risks and costs of a breach, and a belief from the management of  organizations that Canadian companies are not targets.  Cybercriminals  prefer to target the low hanging fruit and the path of least resistance when it  comes to stealing data that, for them, can be extremely profitable.
The Office of the Privacy Commissioner of Canada’s website states, “Unfortunately, privacy breaches are  becoming more and more common. Over the last few years, hundreds of thousands of  Canadians have been affected by privacy breaches. And the consequences for  affected individuals can be significant.”

Canadian organizations  need to start taking cyber security seriously to protect their  customers’ data and to avoid costly breaches.  This includes following the  Payment Card Industry Data Security Standard, a mandate for organizations  designed to protect cardholder data from fraud, and implementing a  cyber-security strategy that protects data loss and prevents targeted  cyber-attacks.

Cybercrime is a multi-billion industry and growing. Some Eastern European  countries are relying on credit card fraud as a significant revenue stream and  will stop at nothing. These are sophisticated organized crime rings that are  determined to continue their revenue streams and are not going away.
According to our 2013 report, retail merchants were the most targeted in  2012 comprising 45% of all breaches with e-commerce websites being the most  popular target. The findings revealed criminals strongly prefer stealing  cardholder data, which they sell on a well-established underground marketplace  and is then used in fraudulent transactions.

The report also revealed that victims on  average took 210 days to realize their systems were attacked leaving plenty of  time for cybercriminals to collect their loot before anyone even  noticed.

So, how can Canadian  organizations protect themselves from becoming the next victim?

First, the perception by executives and our political leaders needs to  change. Currently, Canada lacks regulations making it mandatory to disclose  breaches, which contributes to the perception by executives of many Canadian  companies that they are not being targeted. The federal government is  currently reviewing a new regulation that would require breach  disclosures. This regulation will be a significant step to bringing Canada  in line with other nations.

Second, organizations need to use security technology, in addition to chip  and pin, or EMV technology to validate the identity of a card holder. Your  debit and credit cards  are embedded with a computer chip that complements a personal identification  number provided by you that identifies you as the cardholder. This system is  known as EMV technology. There is a misconception among organizations that EMV  technology prevents credit card breaches.
EMV only helps validate the identity of the cardholder. It does  not protect the data once it enters the merchants systems. Organizations must  also implement, either internally or with the support of a managed service  provider, the technologies that detect and manage cyber threats, prevent data  loss and comply with the Payment Card Industry Standard, as well as monitor  their systems daily for strange behavior, implement strong security policies & procedures and provide ongoing security awareness education for  employees.

Finally, although all companies processing credit cards are contractually  required to comply with the Payment Card Industry Standard, many Canadian  companies ignore or avoid becoming compliant because in many cases fines for  non-compliance are not being enforced as diligently as they are in other  countries. Executives and franchisors need to understand that by not investing  in security best practices, including complying with the Payment Card Industry  Standard, they are setting themselves up as the path of least resistance for  cybercriminals and exposing their organizations or their franchisees to  significant risks, costs and fines.   The cost of prevention is  minimal vs. the cost of a breach.

It’s time for Canadians to step up, take cybercrime seriously and become a  leader in the protection of consumer data by ensuring that the proper  technology, policies and procedures are implemented and followed. For too long,  this issue has been swept under the rug leading to destructive cyber-attacks and  financial losses from which are extremely difficult to recover. Our report  found nearly every industry, country and type of data was involved in a breach  of some kind in 2012. It’s not a question of “if”, only “when.”