Day: April 13, 2016

Spawned from a humble white paper titled “Control Objectives” and developed into broader guidance on control objectives, the COBIT framework is celebrating its 20^th anniversary this year.COBIT was first published in April 1996 and is now in its fifth version. Initially, COBIT was intended to provide guidance for auditors. As it gained use, there were calls for greater guidance for internal control.

The next iteration, COBIT 2, was published in 1998 and offered additional guidance for controls. As an audit and controls guidance framework, COBIT 2 gained broader exposure. The marketplace then began asking ISACA to provide greater assistance in managing the entire IT function. Additional guidance was developed and COBIT 3^rd Edition was released as a management framework in 2000.

IT governance is more inclusive than management, and the marketplace needed still greater guidance on aligning IT strategy with management. Thus, COBIT 4.0 was released as an IT governance framework in 2005. Market feedback indicated that the structure of the control objectives was more complicated than necessary, so two years later COBIT 4.1 was released with a reduced set of control objectives.

The latest evolution of the framework, COBIT 5, was published in 2012 and provides a comprehensive business framework for the governance of enterprise IT. COBIT 5 presents a model for the alignment of overall enterprise strategy with IT strategy, operates on a relatively simple foundation of five principles with seven enablers, and is aligned with several significant internationally recognized standards bodies, such as ISO/IEC and ITIL. More than 800 people provided input into the design of COBIT 5, which required nearly two years to develop and is now available in 16 languages.

COBIT user surveys have shown that COBIT 5 is very beneficial in helping enterprises manage their risks and more clearly demonstrate the delivery of value to stakeholders. In a recent survey of COBIT 5 purchasers and downloaders, more than 9 in 10 said they would recommend COBIT 5 to others.

Because governance guidance must reflect the needs of practitioners, and as the technological and threat landscapes evolve, COBIT also will continue to evolve to best serve its users.

To access infographics, testimonials and information on COBIT’s history—or to submit your own COBIT stories and photos—click here.

Peter Tessin, Technical Research Manager, ISACA

[ISACA Now Blog]

The unprecedented leak of 11.5 million files from the database of the world’s fourth biggest offshore law firm is riveting. As details continue to emerge about the Panama Papers leak, the money laundering and secretive tax regimes and high-profile clientele make for a juicy story. But from an enterprise data security perspective, here at Code42 we’re shaking our heads.

It’s hard to imagine a situation where the stakes for data protection could be higher. This is an organization whose entire “empire” is built on “secret” data. And it was an all-or-nothing game: Mossack Fonseca will likely never recover to earn the trust of a future client—tax evader or otherwise. If there ever was an organization that warranted exceptional network security tools and data security measures, Mossack Fonseca was it.

A data security wake-up call for honest law firms everywhere
If a massive international law firm dealing exclusively in extremely sensitive data is this easily hacked, how vulnerable is your average, above board law firm?

According to the statistics, the answer is “very.” John McAfee penned an article for Business Insider in which he concludes that “law firms are easy pickings for hackers.” Bloomberg found that 80 percent of large U.S. law firms were hacked in 2015. Even more alarming, in the 2015 ABA Technology Survey, 23 percent of firms surveyed said they “don’t know” if they’ve experienced a breach, and only 10 percent have any sort of cyber liability coverage. For a cohort that knows a thing or two about liability lawsuits—and certainly knows that “ignorance of the law” is a poor defense—this is surprising.

Data protection is a high-stakes game for every law firm
And while a data breach at your average law-abiding law firm isn’t likely to result in indictments for fraud, the stakes are still extremely high. “The implications of law firm breaches are mind boggling,” Philip Lieberman, president of Lieberman Software, told Computer Business Review.

Most clearly, a firm stands to destroy every shred of trust with its clients—a reputation bomb that will be tough to recover from. In many cases, a leak could compromise legal proceedings and eliminate advantages by placing litigation strategy and privileged information out in the open.

Even if a firm’s clients and reputation escapes unscathed, data loss of any kind can trigger significant financial impact. A damaged laptop, or ransomware that holds data hostage, can leave an associate without access to critical information. The loss of billable hours quickly adds up. Add to that breach reporting requirements and potential fines, and the ROI of modern enterprise data security tools is easily apparent.

It will be interesting to watch the continued fallout from the Panama Papers, and we’re happy to count this as a win for the “good guys.” But as it dominates headlines and newsfeeds, we hope it’s also a major reminder for law firms—and enterprises in every industry—to re-examine what they’re doing to protect their data.

Download The Guide to Modern Endpoint Backup and Data Visibility to learn more about selecting a modern endpoint backup solution in a dangerous world.

Rick Orloff, Chief Security Officer, Code42

[Cloud Security Alliance Blog]