question about corporate IT security

[steve2470]

I keep reading these reports of hacker breakins at large companies (i.e, Sony, Target, etc).

Why do these keep happening ? Is it a money issue ? Is it truly impossible, no matter how much resources you throw at it, to prevent unauthorized entry into corporate systems ? I know there are some excellent criminal hackers out there.

Should they go completely offline as much as humanly possible ? I'd hate to be a corporate CIO, especially with inadequate resources.

Thanks in advance, sincere question as always.

Steve

[hobbit709]

1. Rule 1: ANY computer that connects to the outside world is vulnerable.

All you can do is hope that no one does anything stupid. Too many places cut corners and don't keep their security up to date.
Any real sensitive data shouldn't be on the company wide network to start with in my book.

[lpbk2713]

2. Most businesses have historically been reactive instead of proactive.

They don't take adequate security measures until they are taught they really need to until it is after the fact. They budget their IT departments way too low in dollars and in talent. Then when they get hit as bad as Target and many others we will never hear about how they found out the costly error of their business decision.

[ProdigalJunkMail]

3. sensitive data should be encrypted to the point that

it is no longer profitable to try to steal it, ie. it cost more to try to decrypt it than it is worth. encryption is available in several forms... i don't know why data isn't encrypted. if someone stole the physical hard drive out of my computer, it wouldn't worry me in the least. anything worth a dern is encrypted... the only people that would practically be able to access it is the government and if they did, they would be bored.

sP