Quote:

---

"ACS addresses the vulnerabilities of the individual user with access to the server (mother lode of data). Statistically and anecdotally, the access points of the vast majority of breaches have been identified as individual users, whether by digital means or social engineering.

These breaches have occurred despite all the successful updates and patches on software and despite efforts to restrict access to valuable data (sometimes referred to as "identity access management" -- IAM).

Nonetheless, the trends to accessibility and convenience, reflected in remote access and BYOD connectivity have tended to overwhelm the ability of the system managers to protect against the depredations of cyber thieves.


What I like best about the ACS solution is that it can be set as a precondition to connectivity. In effect, the administrator can require anyone who wants access to the server to install and keep updated the keylogger prevention program -- in a provable manner, too. Continued enforceability is key here, since the protection is only as good as its most recent update.


There's another value proposition as well, in this era of cyber risk management, cyber liability, and cyber insurance. First, in determining which risks to retain and which to lay off on an insurer, the endpoint protection will certainly be a substantial factor. Second, in buying cyber liability insurance, the endpoint management of ACS's program will tend to demonstrate a lower risk to the carrier, with a resulting lower premium."

​

Yan Ross

Director of Special Projects

Institute of Consumer Financial Education

and Author, Certified Identity Theft Risk Management Specialist XV course

---