Alan Calder on IT Governance, information security & ISO 27001

More evidence of the increasing sophistication of online fraud. Gartner says that phishing scams are increasingly targeting wealthy web users and that the number of adults to have received phishing e-mails has nearly doubled since 2004.

“The good news is that this year fewer people think they lost money to phishers, but when they did lose, they lost more,” said Gartner analyst Avivah Litan.

It will be interesting to see whether the anti-phishing measures in Microsoft’s IE7 have much impact on this, but my guess is that the best prevention will remain education, hence my book for home and SME users, ‘The Internet Highway Code’.

I have blogged previously about how simple USB storage devices pose a serious threat to corporate IT security. This article from Computerworld shows how the issue is escalating with the advent of the iPod as THE must-have accessory. Not only is an iPod a neat way to store you music, it is potentially also a great way to remove other data without permission and to introduce malware (knowingly or otherwise).

Unsurprisingly, Apple were not prepared to comment on whether they would be stepping up iPod security in light of this. It naturally falls to companies to make sure that they have policies and procedures in place to address this gaping vulnerability. However…

Eric Ouellet, vice president of research for security at Gartner Inc. in Stamford, Conn., said that only about 10% of enterprises have any policies dealing with removable storage devices.

Oh dear.

I have talked frequently about the fact that CIOs have to change their perspective from worrying about the IT system to worrying about the business. Well, here comes the revolution: Gartner has surveyed 1,400 CIOs and found that this shift is expected to be one of the big developments of 2006. The problem will be that, while CIOs will be under pressure to become far more engaged with customers, finance and overall business efficiency, they don’t necessarily know how to talk business. Their CEOs will have to help them – which might even mean that the CEOs learn more about IT!