- Related Stories
-
Who says security breaches are small potatoes?
May 23, 2007 -
TJX says 45.7 million customer records were compromised
March 29, 2007 -
AT&T hack exposes 19,000 identities
August 29, 2006 -
Loan company reports loss of data on 1.3 million
June 1, 2006 - Related Blogs
-
TJX agrees to settlement in class action suits
September 25, 2007 -
TD Ameritrade's 6 million customers hit with security breach
September 14, 2007 -
Report: Retail systems still vulnerable
August 27, 2007
After a massive security compromise at TJX earlier in the year (still the largest on record), some hoped it might signal the end of large-scale data breaches. That turned out to be not the case. Breaches later were reported at Disney, Western Union, Fidelity Information Services, Monster.com and TD Ameritrade. Millions of personal identifiable information records were pilfered, and then used to facilitate spamming, malicious software and spyware distribution, credit card fraud, and identity theft.
The authorities have begun to take measures designed to stanch the outbreaks. Some 39 states have enacted privacy breach notification laws. These regulations mandate that the organization where the suspected breach occurs must notify all affected individuals. But the rise in the profile and severity of breaches nonetheless continues.
That's because companies are being actively targeted for data theft. Personal information gets stored in too many places, creating opportunities to steal. At the same time, the nature of "hacking" has also changed. Organized crime now targets information that can realize financial gain for its perpetrators. The means at their disposal are substantial. If previously, unprotected data had a low risk of being spotted by the wrong people, gaps in data protection nowadays are constantly being probed and exploited.
If the data gets exposed, it will be stolen. If criminals cannot get to the data from the outside, they try to find an insider to do the job for them. Many of the recent breaches followed such a scenario, with insiders selling stolen data to spammers and criminal elements.
Most enterprises are ill-quipped to handle this threat, and until they upgrade their security procedures and tools, breaches will continue. While it is impossible to hermetically seal the enterprise, there are measures that can be taken to improve the situation, and leading companies are taking them.
First, databases, the systems that hold the bulk of sensitive data, have been neglected in terms of security. While the network is protected by firewalls and other systems, databases remain vulnerable to outside as well as inside threats. Last year, according to the annual survey by the CSI/FBI, financial loss from data theft outgrew losses from viruses, but IT budgets do not reflect that.
Moreover, while insiders originate the majority of attacks and breaches, few companies have the right procedures and systems to cope with this. Enterprises have focused on securing the perimeter--preventing intruders from coming in--and only now are starting to focus on securing internal systems as well.
An additional, obvious and easy way to prevent large-scale damage from data breaches is to avoid storing unnecessary data in the first place. Many educational institutions, for instance, used to assign Social Security numbers as ID numbers for students, and even kept them in their alumni records. This is risky and utterly unnecessary.
It may be impossible to secure enterprise data completely, but as the threat landscape changes, enterprise security has been slow to catch up. For some, new standards such as the credit card industry's PCI-DSS served as a wakeup call. Yet many companies that have gone through the process of complying with new security standards still remain far from securing themselves.
Biography
Dan Sarel is the vice president of products at Sentrigo, a database software security company.
See more CNET content tagged:
breach,
insider,
enterprise security,
credit card,
threat
"The dummies have it hands down now and forever."
They have begun... but the data piracy begun back in 1999.
Bottom Line: 8 years after they were warned, and millions of data stolen along the line... most of it in the last 3 years... they're finally getting the idea that they need to do more than what they thought was enough!
THAT IS THE PROBLEM!
THAT is what this story SHOULD have been about!
Why are they only beginning to move 8 years after they were warned?
Who was responsible? Who's the irresponsible party? Why haven't they moved quicker?
Now that would be NEWS WORTHY from my stand-point!
Walt
The organization CSI and the FBI freely admit the thieves are 3 steps ahead of any technology they can develop. Frightening... But I truly believe the core problem is "education." I am President/CEO of IDTEL (www.idteli.com) and I also lecture and teach workshops. When I began to meet students in a face-to-face environment, in 1.5 years, only ONE person said they actively research identity theft. Even though news reports on ID theft is in the news daily, most I've encountered have little knowledge of how it happens which further compounds the problem which puts companies at risk.
There are tools that are great in the protection of network and data security. However, as you pointed out, insiders are a contributing problem, and I would venture to guess, employees sit right next to the perpetrators and are totally unaware.
Workforce education is key and there are laws that require training yet few companies see this as a priority. Why? Because the laws and corporate responsibility carry little enforcement. As I see it, if you aren't part of the solution, you are part of the problem. If you don't recognize educating your employees so they are more AWARE, you cannot hope to enlist them in your prevention efforts.
No one can stop identity theft yet you hear companies claiming they can do so. The best we can do is improve our "best practice" and ENGAGE managers in creating a positive environment conducive to awareness and not fear within their respective organizations.
If employees are left to believe that identity theft is prevented at the IT level within the workplace, companies will continue to experience problems. Employees cannot do their part if no one provides them with comprehensive education and training.
We can and must implement tools to enforce accountability (track access back to individuals), and those who propose and approve security budgets must learn they can and will be held accountable for underestimating the need for security resources to protect valuable information under their authority. SOX says they are accountable, but the accountability profession is still wrestling with understanding what that means and how to make it work.
Start with matching the toolset in place and available with the known threats. Then start filling the gaps.
My $.02. CHL