Survey: Most insider-related data breaches go unreported
20079
The main reason many breaches aren't reported is that companies just don't have the resources to devote to the problem, according to Larry Ponemon, author of the survey.
18534
Boeing's announcement that a laptop theft exposed information on 382,000 current and former employees nudges the total number of exposed records in the United States past the 100 million mark. Since last year. In 27B Stroke 6.
577394
Despite having a greater awareness of the security risks posed by careless computing habits and personal Internet activity carried out on corporate laptops, many remote workers continue to do things that imperil the safety of themselves and their employers, according to a new report from Cisco.As part of its annual study on the security awareness and online behavior of remote workers -- based on interviews with 2,000 telecommuters carried out by researchers from InsightExpress -- Cisco experts said that people appear to have acquired a false sense of security when it comes to the use of their company-issued computers and other corporate IT assets.Despite the fact that the IT security community has done a much better job in recent years of keeping people informed of the latest and greatest malware attacks and social engineering schemes, remote workers keep falling for the same types of tricks as they always have -- in part because they believe that they are now protected by more advanced security technologies, said Patrick Gray, special assistant to the CTO at Cisco.In fact, in just one year's time, the number of respondents to the survey who expressed a belief that the Internet is "getting safer" increased from 48 percent 12 months ago to more than 56 percent in 2008. The trend was particularly evident in some parts of the world where Internet use is growing the fastest, and where people believe that their governments are going to greater lengths to protect individual users, such as Brazil (71 percent), India (68 percent), and China (64 percent). In Brazil, for instance, where banking-password stealing Trojan virus attacks have finally been thwarted by stricter legal penalties for those creating the threats, people may falsely assume that it is now safe to let down their guard, according to Gray."The awareness of security threats has grown across the board, but somehow, because of that, we do see the emergence of this false sense of security," said Gray. "Companies have done a great job of securing themselves at the perimeter, but where they're really falling down is with what is going on within their own networks and what is going outbound. They are blocking a lot more potential threats, but there's a lot of risky behavior on their networks as well."One of the biggest problems contributing to the situation is the fact that many workers feel it is acceptable for them to use their work computers for their personal activities, such as shopping, interacting with friends, and searching the Web for popular information, the expert maintains.By using their company-issued devices to head to corners of the Internet where attacks are more prevalent -- such as on e-commerce sites, social networking portals, and independent Web properties, workers are putting their employers at risk of exploit by malware, and other threats, he said.The report found a 3 percent increase year-over-year in terms of the number of remote workers who felt that it was acceptable to use their corporate devices for personal use, such as Internet shopping, downloading music, and social collaboration.Business versus personal use With the rise in attacks being delivered via hacked Web sites and popular destinations including social networking sites, people need to begin shifting their behavior and keeping their work machines separate from their personal lives, Gray contends."At end of day it's not their computer, it's a business tool, and people need to understand how much risk their activity poses for their employers, and that they need some level of separation in terms of their personal use," he said. "Companies may not want people going to the mall in the middle of the day when they could be doing work, but they might not want to allow them to use business tools to do things like e-commerce either."IT workers participating in the study also highlighted the issue with 55 percent indicating their belief that their companies' remote workers are becoming less diligent toward security awareness, an 11 percent increase from the year before.In addition to the growing number of threats being hosted on social networking sites like MySpace, Gray said that the personal data that people share about themselves and their employers on the sites poses a significant risk for the creation of targeted attacks.If an attacker can go to a site like LinkedIn and get a firm grasp on someone's role in an organization and figure out who they might communicate with in the firm, it could be fairly easy for them to create an attack that easily tricks the individual into opening an infected e-mail, according to the expert.However, it would appear that even suspicious e-mail arriving from unknown senders, long the favorite delivery channel for malware and links to phishing sites, continues to stand as a problem.While the numbers of workers in the United States who are willing to open strange e-mails and attachments is far lower at 27 percent, than in places like China (62 percent) and even the United Kingdom (48 percent), many people are still capable of falling for the time-honored ruse.In one interesting twist on the issue of corporate device use, Cisco's report found that more people than ever are also using personal devices that are not under the control or management of their IT departments to access their companies' networks and electronic files. Some 49 percent of those people responding to the survey admitted using their own machines to do so, an increase from 46 percent one year ago.Perhaps the only way to improve the situation will be for companies to enact stricter usage policies for their remote works regarding corporate-owned devices and embracing continued education for end-users about the nature and prevalence of threats, Cisco officials maintain."We need to continue to highlight the problems, companies are doing a much better job than they used to, but with all the blended threats, they need to reload and strengthen the human firewall, which is really the last line of defense," Gray said. "The companies that do the best job have ongoing continuing education for users that tells them that their computer is a business tool and who use monitoring tools to ensure that their security policies are being followed."
111329
A report released Thursday by the GAO indicates that just one-sixth of the 24 largest data breaches reported between January 2000 and June 2005 resulted in actual identity theft. The report could give support to those who want breach-notification rules eased.
226902
How bad is the Monster.com data breach? Bad enough. Did the crooks get their hooks in deep? Remarkably deep. Gregg Keizer has the details on what has gone wrong so far in the Infostealer.Monstres attack.
438947
Despite growing fears about online fraud, a new study finds that most cases of identity theft originate offline.
415569
With privileged access and technological knowledge, IT workers can unexpectedly find themselves in ethically sticky situations. Do they blow the whistle or look the other way?
761336
In July Pfizer discovered a data breach that took place last year, informed employees only recently.
415810
More than one-third of the largest transportation and logistic firms shared customers' personal data without their permission, according to a survey by The Customer Respect Group Inc. And one-fifth of the companies didn't even have privacy policies in place.
609370
Businesses may be spending millions on expensive security technologies aimed at thwarting data leakage and compliance violations, but many companies are still failing to sufficiently address access controls for protected information and IT systems.According to the latest report from Ponemon Institute, most IT workers readily admit that their companies are doing a sub-standard job of keeping tabs on the level of access available to employees, temporary workers, and independent contractors.In Ponemon's 2008 National Survey on Access Governance, based on interviews conducted with roughly 700 IT professionals, 78 percent of those people surveyed reported that their employers are not regularly reviewing policies or tools that control admittance to their systems or information.The situation has resulted in an environment where many workers retain the ability to view sensitive data or manipulate IT systems that they should not be able to access based on their job responsibilities, researchers said.Some 69 percent of those interviewed said that their companies' access policies were either enforced poorly or not at all, with only 30 percent of respondents stating that their organizations go to the trouble of validating their guidelines.The overwhelming lack of proactive efforts to keep a handle on issues of access are somewhat shocking based on all the attention being given to data security and compliance issues over the last several years, and many business could greatly improve their overall standing simply by improving their policies and enforcement capabilities, said Larry Ponemon, chairman and founder of research firm."Traditional approaches, including homegrown technologies and manual management processes, have proven to be fraught with failure and risk. Unless enterprises acknowledge business as usual is failing, we believe rampant access mismanagement will continue to plague organizations," Ponemon said. "When it comes to access rights, companies don't want to constrain workers and make their jobs harder, but they have to manage things in a more systemic way that look at the risk versus the benefits, and many organizations are obviously having difficulties with that."Approximately 55 percent of those participating in the survey said that their employers' ability to grant access based on a worker's role and job function is either poor or nonexistent, including 42 percent who said that their companies have no policy to manage things in such a manner.The rapid pace of change in the responsibilities among today's workforce is one of the biggest hurdles that companies struggle to overcome, said executives with Aveksa, a maker of access control software that sponsored the Ponemon report."This entitlement drag issue is a major problem. IT organizations are under pressure and often either valued or devalued by business based on how quickly they deliver access," said Brian Cleary, vice president of Marketing for Aveksa. "Clearly, the findings here show that that while companies are doing a good job of providing initial or changed access, there is no automated way to go back and make a determination to understand if a workers' current level of access is appropriate."Lessons learned from Jerome Kerviel Issues of access control are of fundamental importance to corporate risk management, perhaps best exemplified by the recent reports of the activities of Jerome Kerviel, a stock trader at French firm Soci?t? G?n?rale who is accused of losing nearly $8 billion of his company's capital in unapproved transactions carried out by circumventing rules built into the brokerage's IT systems.Had Soci?t? G?n?rale been actively monitoring the access controls for its transactional systems, Kerviel likely would have been caught long before he gambled away such a stunning amount of money, the experts contend.A major factor contributing to the continued loopholes in access management is a lack of support for improving policies and applying technologies used to govern the issue by senior management in many companies, according to the report. Some 74 percent of respondents indicated that senior management in their companies does not view access governance as a strategic security imperative. "It seems that the perception is that it's still tough to get senior executives to sign off on the necessary funding, but situations like Soci?t? G?n?rale may help prove how big of concern this really needs to be," said Ponemon.Another major contributor to the problem is the need for cross-organization collaboration, which complicates issues of access dramatically.And while 83 percent of those people responding to the survey said that collaboration among business units, audit and compliance groups, and IT security departments is vital to keeping their operations in line with government regulations, 57 percent said those teams never partner to oversee access issues."This has to be an area of great concern, because if companies consistently score poorly on compliance audits it's been proven that this actually starts to diminish their reputation and brands," Ponemon said. "And as more organizations suffer losses, there will likely be new regulations put in place that make it even harder to operate; most businesses I know don't want more regulations, but if more people fail to create their own controls, more regulators will get involved."
224580
(InfoWorld) - IT systems integrator Unisys Corp. is under fire for allegedly failing to detect the hacking of U.S. Department of Homeland Security computers, an incident that resulted in data being sent to a Chinese-language Web site. Unisys is now under investigation by the U.S. Federal Bureau of Investigation, according to an aide for the House of Representatives' Committee on Homeland Security, which started investigating the DHS and Unisys in April. The committee sent a letter to the DHS on Friday asking for its inspector general to open an investigation, the aide said. The letter said DHS had 844 "cybersecurity incidents" during fiscal 2005 and 2006, which the committee called "high and unacceptable." The data breach adds to the growing chorus of complaints from countries such as France, Germany and the U.K. thatÂ hackers in China have stepped up their game, hunting for sensitive information on government computer systems. In 2002, Unisys won a US$1 billion contract to manage computer systems belonging to the DHS and the Transportation Security Administration, which were created after the Sept. 11, 2001, terrorist attacks to shore up the nation's defense. Unisys received a $750 million contract in early 2006 to continue the work. Under the contracts, Unisys installed six intrusion-protection devices, said Lisa Meyer, Unisys spokeswoman. Those devices, which can detect unauthorized activity on a network, were not installed properly, alleges the committee. Three months passed before clues emerged that malicious software capable of copying and transferring files had been installed on 150 DHS computers. The data, although unclassified, was transferred late at night or early in the morning to a Chinese-language Web site, according to committee evidence and testimony. Two U.S. representatives also accused the DHS and Unisys of ignoring warning signs of the hacking. In a statement , Unisys denied the intrusion protection devices were improperly installed and that the company reported security incidents. Meyer said Unisys has not been notified by either the FBI or the committee of an investigation. She said she could not comment further on specific security incidents. The FBI referred questions to DHS officials, who could not immediately be reached. Â
5343
Blog: Auditors say only a fraction of largest intrusions in recent years showed clear evidence of resulting identity theft, but they admit that's not always easy to gauge.
11163
(InfoWorld) - Hard drives full of confidential data are still turning up on the second-hand market, researchers have reported. Investigations carried out on behalf of BT by the University of Glamorgan in the U.K., Edith Cowan University in Australia, and Longwood University in the U.S., found that 37 percent of drives surveyed had traces of personal data on them. Damningly, this figure is much the same as it was for the same surveys undertaken by the universities in each of the last two years, suggesting that either companies are ignoring the issue or simply lack the tools to adequately wipe data before resale. Sensitive information retrieved included salary details, financial data of specific companies, credit card numbers, medical data, visa applications, details of online purchases, and inevitably, online pornography. The sample totalled 350 hard drives acquired in online auctions. "Given the level of exposure that the subjects of security and identity theft has received in recent times, and the availability of suitable tools to ensure the safe disposal of information, it is difficult to understand why disks are still not being effectively cleaned before they are disposed off," said BT's security research head, Dr Andy Jones. "When organizations dispose off surplus and obsolete computers and hard disks, they must ensure that adequate procedures are in place to destroy any data and also to check that the procedures that are in place are effective -- whether they are handled by internal resources or through a third party contractor," he said. The full report -- which has yet to be made publically available -- reveals that buying second-hand disks is an unreliable way to get hold of storage. Of the 133 disks bought in the U.K., 44 percent of them didn't even work. But of those that did, 19 percent had enough information on them to identify the organization from which they had come, 65 percent had enough data to identify named people, and 17 percent contained "illicit" data. Techworld is an InfoWorld affiliate.
619128
(InfoWorld) - The anonymous researcher who claims to have crafted a Mac OS X worm said Tuesday that he or she will report his findings to Apple Inc., but added that the Cupertino, Calif. company "has a very long way to go" on security. Identified only as the researcher behind the Information Security Sell Out blog, he or she on Sunday announced that a still-unpatched bug in mDNSResponder, a component of Apple's Bonjour automatic network configuring service, could be exploited by a worm. Apple's May security update, dubbed 2007-005, included a fix for the mDNS bug. "[My worm] is in the same code base, obviously, but that is where the similarity to the recently patched issues ends," said the Info Sec researcher in an e-mail interview. "When Apple fixed the previous issues, they did not take care of the entire code base and there are a lot of bugs there...some are exploitable, like the one I am using, while others are not. But the fact remains that Apple did a horrible job in fixing this package." According to Info Sec, the worm is fully automated and ready to use. "It would be considered a fully weaponized exploit and fully automated," said the researcher. "This is really no different than other worms we have seen [on the Windows platform]. Other than that, I am not able to give any more details." Another researcher, however, questioned whether Info Sec crafted the worm in only a few hours, as claimed. "Writing the exploit in one day...unlikely for anything other than a stack overflow," said Dave Aitel, the chief technology officer at Immunity Inc., the Miami Beach, Fla.-based security company best known for its CANVAS penetration testing ("pentest") software. "So most likely he found a stack overflow in mDNS, which is perfectly possible. It is open source, after all." Info Sec didn't detail the vulnerability, but did emphasize that writing the exploit was a breeze. "The hard part is finding the bug," he or she said. "Once you have found it, it is very easy to exploit. The Bonjour (mDNS) service is UDP [User Datagram Protocol, one of the core Internet protocols] Universal as well, making it even more fun for things like worms." But like other researchers who have grown tired of claims that Mac OS X is more secure than rival operating systems, Info Sec saved a last shot for Apple. Although he/she will report the new-found vulnerability to Apple at some point, there is no timetable for the moment. "I do believe in being responsible and working with vendors," said Info Sec, "but I also feel that some vendors need to be treated like children and learn lessons the hard way. Apple has a very long way to go when dealing with security issues in their products." Aitel leaned a bit the same way. In a posting to his DailyDave mailing list Monday in which he pointed out the Info Sec exploit, Aitel said: "I note that 'Infosecurity Sellout' is claiming there is another bug in mDNS which is wormable. This is obviously untrue, since there are no more remote bugs in OS X." That last line was firmly tongue in cheek, Aitel clarified today in an e-mail. "No, I'm just being funny. OS X is horribly insecure," he said. In an e-mailed statement, Apple spokesman Anuj Nayar rebutted. "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users," he said.
726987
The loss or theft of personal data such as credit card and Social Security numbers is soaring to unprecedented levels, and the trend isn't expected to turn around anytime soon as hackers stay a step ahead of security and laptops disappear with sensitive information.
542349
New exploits could affect customers who never applied patches for known database flaws.
277701
Complex interception laws confuse Feds and ISPs An internal audit has discovered that the FBI overstepped the mark in intercepting communication records at least 1,000 times since 2002.â¦