Using COBIT 5 for data breach prevention
1 ISACA JOURNAL VOLUME 5, 2013 High profile information security breaches have become a steady feature, creating increased pressure on firms to harden their networks and take a more aggressive security posture. However, it is often not clear which security initiatives can offer firms the greatest improvements.1 Security and privacy remain in the top 10 of key issues for information security executives, as they have been since 2003.2 In this respect, information security has become a critical issue for information systems (IS) executives3 and crucial to the continuous well being of modern organizations,4 with the result that organizations need to protect information assets against cybercrime, denialof service attacks, web hackers, data breaches, identity and credit card theft, fraud, and other forms of internal threats.5 A firm's informationrelated assets are now among its most valuable assets6 so the ever increasing mobility of the workforce and the convenience of working with company information inside and outside the organization through different portable and online media have amplified any threat to a critical level. Information is a fundamental asset within any organization, thus its protection through the process of information security is of high importance.7 The application of existing technical IS security frameworks and IS controls has been effective in preventing attacks from external entities into the organizational networks, but the mobility of the organizational staff and the IT assets along the extended networks have posed serious risk to organizational data. This is substantiated by the fact that six out of 10 employees between the ages of 18 and 35 use a personal device at work and that the average corporate worker sends and receives 112 emails per day.8 A careful analysis and review of the trends and statistics in data breaches in the last three years (2010 to 2012) reported in CSI computer crime surveys and Identity Theft Resource Center (ITRC) studies point out that hackers circumvent the organizational network defenses by targeting the data and the media that are at rest, in use, and in motion inside and over the extended network. Moreover, errors, mistakes and accidents on the part of the employees using data have worsened the situation such that conventional technical and sociotechnical controls are not adequate preventions. In this respect, it is imperative for organizations to categorize and protect data that are at rest, in motion and in use. COBIT(r) 5 enablers and management practices can be used to prevent malicious activities and data breaches within organizations and extended networks. The detailed identification and analysis of 10 high profile data breaches and intrusions in 2012, sourced from the ITRC database, identifed, analyzed and highlighted the vulnerabilities and missing controls that led to the breaches. The analysis revealed that 70 percent of the breaches occurred due to missing or overlooked nontechnical IT controls; that is, 30 percent of the breaches could have been prevented using technical mechanisms. For the identified vulnerabilities, corresponding IT management practices of COBIT 5 have been selected and mapped to demonstrate not only how the identified breaches could have been prevented using COBIT management practices, but also how to effectively monitor these practices using three COBIT monitoring management processes. This article recommends a security framework based on a set of essential COBIT 5 management practices and industry specific relevant frameworks that are required to adequately protect organizations from external and internal intrusions.