EA says corporate networks are 'undefendable'

Powered by SC Magazine
 

Security chief urges all businesses to identity crucial assets.

The security chief of the gaming giant Electronic Arts said organisations must identify their most sensitive assets with a mind that their networks are vulnerable to attack.

Spencer Mott, CISO at EA said in a keynote at Infosecurity Europe that corporate networks would be hit at some point, if they hadn't been infiltrated already. 

Complete coverage of Infosecurity Europe 2012 

“Networks are undefendable to advanced evasion techniques (AETs) and advanced persistent threats (APTs),” he said. “These types of attacks are made up of a lot of different strands so… if one technique fails, another route is taken to achieve its end goal.

“If it is not impossible, it is still difficult to defend, even if you unplug yourself from the internet due to the internal threat.”

Mott claimed all companies, regardless of size, would be hit in time.

“Eventually this threat is going to impact any significant business, although the big global brands with the most, let's say ‘interesting', things to steal are going to be the most-impacted organisations,” he added.

Despite some thinking he may have been too pessimistic, Mott believed this scare tactic was the best way for board members to realise the importance of security.

“I do think that particular statement about [every business being infiltrated] just encourages our CEOs to get more realistic,” he said. “This isn't just a role for security teams; it is about [rebuilding] business and business processes.

“In reality, it doesn't matter how big your security group is as this is no longer a central function. It is the output of every single employee and you can go wider [to customers and partners]. The reality is that it is a completely out-weighted, undefendable position to be in.”

However specific assets could still be well protected.

“Where we might not have defendable networks, we do have defendable assets,” Mott said. “We need to concentrate on what we can protect and put the measures in place for that, rather than [concerning ourselves] with the undefendable.”

The CISO concluded by saying that regardless of attacks, the best thing any company can do is understand the incoming threats and do what they can to prepare and defend.

“Be in a position as and when an attack occurs, from a brand perspective at least, to show consumers and regulators you did everything you could to defend against it,” said Mott.

“The worst thing, even if you are fully defended, is not to understand the nature of the attack and why it was successful.”

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, UK edition


EA says corporate networks are 'undefendable'
 
 
 
Top Stories
Qld Transport to replace core registration system
State's biggest citizen info repository set for overhaul.
 
Innovating in the sleepy super industry
There’s little incentive to be on the bleeding edge, so why is Andrew Todd fighting so hard?
 
Defence spends $50m to upgrade RAAF's air traffic systems
First step in long-running modernisation.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  7%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  21%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 902

Vote