Security takes time and costs money, so you it is definitely possible to overspend on security. Finding the right amount to spend on security requires proper risk analysis. As part of that, you need to consider whether the system is likely to be targeted by hackers. Apparently, Oracle got this risk analysis wrong for the MICROS systems they acquired in 2014. I'm sure they realized that a point-of-sales terminal is a juicy target, but they didn't manage to lock this software down tightly enough. As a result, and Russian hackers broke into 300,000 Oracle-powered cash registers . Many customers I work with believe that their firewall protects them fully, and still perform rather relaxed security audits on internal systems. This is a dangerous misconception. A typical enterprise is running so many systems that it is almost certain that some of them will contain security vulnerabilities that will let hackers in. In an age of automated attack tools and internet-connected systems, you are a target. Act accordingly.
↧
