Tag Archives: breach

Despite what you may think, IT security “is” your business

Many executives feel that IT security is only an issue for the IT department.  The problem is IT security is a bigger issue than just your IT department.  Everyday your company faces viruses, lost devices, stolen data, and intellectual property walking away with recently dismissed or disgruntled employees.  According to the DataLossDB project, 126,749,634 medical records, bank account numbers, names, and addresses were stolen or accidently leaked in 871 separate incidents in 2011.  Costing companies an estimated $26 billion in 2011.  Now you might say, “We aren’t in the business of IT or security.  We make widgets.  We maximize investor returns by buying, selling, and trading subsidiaries to create wealth.”  The fact is currently, for an organization to ignore IT security is clearly risky.   As reported in Forbes magazine on January 2, 2012 “If data loss continues on its current trends, it will cost the U.S. economy $290 billion by 2018”. As most cases go unreported, check out the cases that made headlines in 2011:

  • RSA
    The security division of data storage firm EMC was hit by a hack that compromised their popular SecurIDcryptographic keys, forcing them to offer replacements to their clients.  The stolen information was later used in an attack on defense giant Lockheed Martin.  RSA has provided a useful working definition of the term advanced persistent threats, or APTs, as “military-grade cyber-attacks on commercial entities.”  In the face of APTs, businesses need a new defense doctrine, which is under discussion by an increasing number of corporate chief information security officers.
  • Texas Comptroller
    A server mistakenly left open to the public contained the Social Security Numbers of 3.5 million teachers and other state employees.  No hacking was necessary to access this server.
  • Sony
    In nine different incidents, the conglomerate lost names, addresses, and credit card and bank account numbers as hackers pillaged its online game, music, and movie divisions.  Hackers made off with 77 million names, e-mail addresses, and passwords after breaching Sony’s PlayStation network.  The Sony breaches followed several similar data breaches by online service suppliers such as Play.com and Lush, so what effects are they likely to have on the online services industry?
  • SK Communications
    A complex attack on the Internet company netted the personal information of 35 million South Korean users.  That’s in a country of 50 million people.
  • SAIC
    A few of the defense contractor’s backup tapes were stolen out of an employee’s car.  The tapes contained the medical records of more than 5 million military patients.
  • Sutter Medical Foundation
    A stolen laptop from the health-care provider contained 3.3 million names and other identifying information, along with 943,000 patient diagnoses.  This incident brought on a class action suit, alleging negligence in securing data.

Can you afford to have your company on this list?  I did not think so.  All of us have a role to play in a more secure internet and it is clear  we have a problem and need to get on with fixing the issues as quickly as possible.  If your company has customer information, takes credit cards or has computers that use passwords then IT security is in fact your business.

 

 

Data Breaches Cost Companies over $26 Billion in 2011

According to the DataLossDB project, 126,749,634 medical records, bank account numbers, names, and addresses were stolen or accidently leaked in 871 separate incidents in 2011.  That’s an increase of incidences by over 37.4% and of records by 370% compared to 2010.  According to research conducted by the Ponemon Institute in 2010, the average cost of a data breach was roughly $209 per comprised record.  That brings the price tag for 2011 of over $26 billion. The following is an analysis of the incidents:

Types of Breaches

Hacking – deliberately breaking into computers – became the most common means of breach last year.

Top Incidents

  • RSA
    The security division of data storage firm EMC was hit by a hack that compromised their popular SecurID cryptographic keys, forcing them to offer replacements to their clients.  The stolen information was later used in an attack on defense giant Lockheed Martin.  RSA has provided a useful working definition of the term advanced persistent threats, or APTs, as “military-grade cyber-attacks on commercial entities”.  In the face of APTs, businesses need a new defense doctrine, which is under discussion by an increasing number of corporate chief information security officers.
  • Texas Comptroller
    A server mistakenly left open to the public contained the Social Security Numbers of 3.5 million teachers and other state employees.  No hacking was necessary to access this server.
  • Sony
    In nine different incidents, the conglomerate lost names, addresses, and credit card and bank account numbers as hackers pillaged its online game, music, and movie divisions.  Hackers made off with 77 million names, e-mail addresses, and passwords after breaching Sony’s PlayStation network.  The Sony breaches followed several similar data breaches by online service suppliers such as Play.com and Lush, so what effect are they likely have on the online services industry?
  • SK Communications
    A complex attack on the Internet company netted the personal information of 35 million South Korean users.  That’s in a country of 50 million people.
  • SAIC
    A few of the defense contractor’s backup tapes were stolen out of an employee’s car.  The tapes contained the medical records of more than 5 million military patients.
  • Sutter Medical Foundation
    A stolen laptop from the health-care provider contained 3.3 million names and other identifying information, along with 943,000 patient diagnoses.  This incident brought on a class action suit, alleging negligence in securing data.

Incidents by Business Type

Cybersecurity was one of the top buzzwords for 2011 as commercial organizations increasingly found themselves up against advanced and persistent attacks to the degree previously seen only in military organizations.  Information security has moved up in the agendas of most corporations and other businesses, but government too is placing increasing emphasis on the topic, backing national cybersecurity efforts with dedicated budgets.

Incidents by Offending Party

While more and more companies are becoming aware of the problem, few have taken action.  As the above analysis demonstrates, the need to take action has never been so persuasive.

To learn how to protect your organization, download our complimentary Executive Guide to Data Security.

 

The Human Element of Information Security

With all of these security breaches making the news headlines on a weekly (sometimes daily) basis, one can imagine that there is (or should be) a renewed focus on how organizations secure their information assets.

There are many products available on the market which can assist with this task – newer application-based firewalls, Intrusion Detection and Prevention devices, Internet access gateways, Security Information and Event Management (SIEM) and the list goes on.  However, these products will not adequately protect the environment unless they are paid attention to by an information security professional.

In the absense of human attention the symptoms become apparent; Unpatched systems, security breaches going unnoticed, misconfigured access control lists and a lack of documentation are just a few issues resulting from the lack of human oversight.  When a breach occurs, it is often revealed to be simple enough that even a novice security person could have identified them as a potential issue.  It becomes obvious that sufficient resources were not available to properly review these systems or pay attention to the overall security posture of their environment.

It’s hard to believe this bit of common sense is so often overlooked, however I firmly believe the biggest threats to security today are not deficiencies in  electronic security countermeasures but shrinking IT budgets, with the acquisition of additional security personnel required to ensure the security of the organizations assets falling by the wayside. 

In the public sector, a perception exists that investing in information security offers no value to the business.  However, this mindset has been rigorously tested over the last year with company reputations being (perhaps irreparably) damaged when a security breach occurs, a cost which far exceeds the amount that could have been spent on properly securing their environment.