Data breaches: Very little good news in 2007
43470
While some statistics suggest improvements have been made, others point to disturbing developments--and to the weakest link in the security chain.
660657
For the first time, the general public is hearing almost daily reports of theft and exposure of sensitive nonpublic personal information.  What can we do to eliminate data insecurity?  Download this white paper to learn how emerging internal and external threats bypass traditional perimeter security measures to gain access to the crown jewels-enterprise data.
96763
Lousy code, PHP and shell script attacks and search engine hacking tools lead to vulnerabilities, study says.
658432
The Story: Even when there?s good news on the security front, there always seems to be bad news to balance it out. And while we think this news is important for you to know, it?s not an exception to the Good News/Bad News Syndrome.[ Slideshow: 2007's top underreported tech stories ]                                                    The use of e-mail-borne executable virus attachments dropped sharply in 2007. In particular, spammers have dialed back their use of so-called image spam, which tricks filters by embedding text within an attached image.According to IronPort Systems, outbreaks of viruses embedded in e-mail attachments totaled 860 in 2006 and 844 in 2005. But as of mid-October 2007, attacks totaled just 360. Dave Mayer, an IronPort product manager, said it?s likely that outbreaks will total 450 by the end of the year ? a drop of 47 percent. It appears that evildoers are moving on: ?Traditional viruses have been around for years, a long enough time to harden defenses against malicious attachments,? he said.Earlier in the year, IronPort, Symantec, and McAfee all noted that image spam, which appeared about two years ago, is waning, now that defenses have improved. Filters have now gotten better at scanning the contents of the attachments, leading spammers to link instead to images elsewhere.Mayer, whose company specializes in e-mail and Web security, says spammers are now placing those images on free photo-sharing sites ? the ones people use to send vacation photos to friends and family ? and embedding links to those images in their junk messages. These are difficult for spam filters to block because the same sites are used for legitimate photos as well.But as the abuse of e-mail attachments has declined, other types of threats have escalated. For example, outbreaks of macro viruses, aimed at Office-type applications, have risen by 50 percent to 60 percent while URL viruses climbed by at least 250 percent this year, IronPort found.The Bottom Line: It often seems as if the number of threats that you must be on guard against only increases, stretching your resources past the limits. But the truth is that threat profiles change over time, and some things you may be investing in are no longer as great a threat or are now handled by the tools you have in place. So, although you can?t get lax about security, you can focus more on newer threats.Complete list of 2007 underreported tech stories: 1.? Java is becoming the new Cobol 2.? Sun Microsystems is back in the game 3.? Hackers take aim at Mac OS X 4.? There are some threats you can worry less about 5.? Companies may have found a way around H-1B visa limits 6.? Open source?s new commercial strategy 7.? End-to-end Ethernet finally arrives 8.? Blade servers arrive for the masses 9.? BI is dead; long live BI 10. Balance of power shifts to software buyers
537741
As the TJX Companies data leakage incident seeped its way further toward becoming the Exxon Valdez of corporate information spills this week, researchers reinforced the notion that businesses continue to make a mess of electronic data security because they fail to foster adequate internal communication.A new report from Ponemon Institute -- which has produced a series of studies into corporate data leakage over the last several years -- concluded that the various people in charge of collecting, protecting, and managing sensitive information inside large businesses typically don't collaborate sufficiently. Those constituencies also have widely differing views regarding their respective roles in safeguarding the content, the report contends.Echoing comments made by a number of security policy experts in recent months, the study highlights the fact that companies are likely failing to protect data based on broken business processes -- at least as much as they may be succumbing to complex technological challenges.Just as many software developers complain that their applications are left vulnerable to attack because business teams refuse to wait long enough for the programs' underlying code to be made secure, the results of Ponemon's survey of 3,600 IT security and marketing executives -- located in the United States, the United Kingdom, and Germany -- illustrate a distinct lack of organizational coordination in the name of protecting data.For instance, only 30 percent of the marketing workers interviewed for the study said they actually consult security teams before collecting and using sensitive information, while 80 percent of the IT security employees surveyed indicated a belief that they are typically involved in such decision-making.In addition, while only 53 percent of IT security workers surveyed said their companies have well-coordinated data protection policies, only 32 percent of those workers who handle the information said their employers are doing an adequate job. Some 45 percent of security workers don't feel that their data-handling rules get in the way of business objectives, while only 21 percent of the people using the content feel that such policies represent roadblocks to their productivity.And in yet another blow to the perceptions of security workers, only 21 percent of the marketers using sensitive information interviewed by Ponemon said that security teams play a leading role in defending the content.At the heart of the matter is the issue of poor collaboration between all the involved parties, according to the research firm. Only 29 percent of those interviewed said their companies' current policies would be adequate to handle a major breach within 24 hours of its occurrence.Based on the results, Ponemon contends that organizations with substandard data protection collaboration policies were twice as likely as to have had a data breach within the last two years.Therein lays the ultimate proof of collaboration's impact on data protection, said executives with Microsoft, which sponsored the research report."We expect the data threat environment to continue to evolve, and at the same time, clearly, there's a long way to go based on where we are today," said Brendon Lynch, director of privacy strategy at Microsoft. "There's this major issue around the degree to which marketing professionals consult with these other involved parties; they see the policies as getting in the way of business objectives, and they're not interacting with security or privacy specialists based on that, which undermines the process change that companies are already attempting to enact."As part of its connection with the study, Microsoft is pushing the notion that companies should merge their security and data privacy operations to simplify the process of interaction between the various constituencies.Some 80 percent of all respondents to the Ponemon study said that they would support further combination of those teams to improve coordination of their data defenses."We feel that most companies need to be more holistic and bring these types of roles together," said Lynch. "All of these workers are critically important to better locking down the data, so they need to look at developing appropriate-use cases, and how to better fulfill business objectives while maintaining protection."The study is just the latest expert opinion to highlight the fact that despite the ever-expanding range of security technologies available to enterprises to protect sensitive data, many organizations could be well served to start with a review of their internal policies.In addition to getting business teams to work more closely with security and privacy pros, some experts contend that organizations could improve security risks quickly by merely retrenching the settings of their network and IT systems.Many critical infrastructure systems are installed with the idea of getting an operation up and running first, with plans to bolster security after the fact, and never readdressed, said Paul Williams, chief technology officer at IT security services provider Global Security Management.Reviewing networking gear settings to ensure that they have been sufficiently obscured, along with tweaking the features of other systems crucial to protect external attack is another way that companies can significantly bolster data security with little to no capital investment, he said."Before you learn how to defend a network, you have to take a walk on the wild side and see how you can break in yourself," said Williams. "Most networks can be made more secure by simply taking the time to go back and see how things were installed and whether or not the settings were changed in a way that promotes security; people typically look to technology solutions to address these problems, but they could begin helping themselves significantly at relatively no cost."In a presentation delivered at the Gartner IT Symposium earlier this month, analyst Neil MacDonald told attendees of the show that they could save money on their security projects if they continue to push for a more thorough, process-driven approach to data protection on a high level within their organizations."This can't be about managing a set of projects, it has to be about improving process," MacDonald said. "At the end of the day, the idea of tagging every piece of data in an enterprise for the sake of protecting it is unfeasible; it sounds great on paper, but the problem is a monumental effort with new information coming in all the time, it's not a process that's sustainable."
235442
Graceful breakup announcements, photogenic small animals, outrageous slurs: a look back at 2007.
207163
Thousands of credit card numbers and other personal data may have been compromised.
222872
Be afraid: There's no such thing as a secure network.
56532
People have long been the weakest link when it comes to protecting computers. The same applies to mobile phones, a security expert says.
469624
A year after the U.S. Department of Veterans Affairs disclosed a huge data breach involving the theft of personal information on 26.5 million vets and active-duty military personnel, federal agencies have moved to prevent such a breach from happening again. Here are five steps taken along the way.
537202
The U.S. Department of Veterans Affairs hasn't finished implementing most of the IT security improvements recommended by federal auditors after a laptop containing sensitive data was stolen from an employee's home in May 2006.
367998
(InfoWorld) - Most large data breaches don't appear to lead to identity theft, and proposals that would require companies to notify customers of most breaches may lead to increased costs without significant benefits, says a report from a U.S. government agency released Thursday. The report, from the U.S. Government Accountability Office (GAO), said only four of the 24 largest data breaches between January 2000 and June 2005 appear to have resulted in identity fraud. Wide-ranging data breach notification laws that would require nearly all breaches to be reported could lead to notifications that "present little or no risk, perhaps leading consumers to disregard notices altogether," the report said. While a breach notification law would have several benefits, a law that requires notification for nearly all breaches could also create significant costs for businesses, the report added. The U.S. Congress is currently considering several breach notification bills, including some that would require notification for nearly all breaches. Instead, Congress may want to consider a notification rule based on the potential for the risk of ID theft, the report said. The U.S. President's Identity Theft Task Force has recommended a national standard for determining when government agencies and private companies should report breaches, the report pointed out. A risk-based standard "could avoid undue burden on organizations and unnecessary and counterproductive notifications of breaches that present little risk," the report said. A data breach law would create costs for businesses, including the cost of developing incident response plans and notifying customers, the report said. While it's difficult to determine costs, a Ponemon Institute study in 2006 found that 31 companies with breaches incurred an average cost of $1.4 million per breach for notifying customers, staffing call centers, paying legal fees, and other expenses, the report said. The GAO researched 24 large data breaches reported in the media between 2000 and 2005, and found that 18 of them had no ID theft or fraud identified. Three of the breaches, at CardSystems Solutions, DSW, and CD Universe, had reports of fraud associated with existing customer accounts. And a breach at ChoicePoint had reports of unauthorized new accounts opened. In the remaining two breaches, GAO was unable to determine if there had been ID fraud. It's difficult to track ID theft resulting from data breaches, the report said. In some cases, thieves don't attempt to use the data until a year or more after the breach, the report said. A breach notification law could be beneficial because it would encourage organizations to improve data security, the report said. "Care is needed in defining appropriate criteria for data breaches that merit notification," the report said. "Because breaches vary in the risk they present, and because most breaches have not resulted in detected incidents of identity theft, a notification that is risk based appears appropriate." Alan Paller, director of research at the SANS Institute, a security research and training company in Maryland, praised the report, saying some in Congress have focused too much on data breaches. Some lawmakers have "dropped the ball on the far more important area of attack-based defenses," he said. The report is important because it gives Congress more information about data breaches, added Thomas Lenard, senior fellow and acting president at the Progress and Freedom Foundation, a conservative think tank. "Itâs very good to have more data on this issue," he said. "[The report] reinforces my view that we should only adopt new regulations in this area if it can be shown that their benefits are greater than their costs."
388261
(InfoWorld) - An overwhelming percentage of businesses still fall far short in their efforts to comply with industry data-handling regulations and reduce their likelihood of experiencing a serious leakage incident, according to a new survey. In a report to be published by the IT Policy Compliance Group on July 18, the consortium of IT compliance and security experts concludes that some 90 percent of all businesses still do not have sufficient policies in place to meet data governance regulations and adequately limit the risk of a breach. In the survey of 475 companies, a third of whom reported revenues of more than $1 billion last year, the industry group found that an overwhelming majority of the firms expect to deal with at least six business disruptions related to major data incidents per year along with five or more instances of information loss or theft. While businesses continue to invest policy enforcement software, and other technologies aimed at helping them meet data-handling regulations, said James Hurley, managing director of IT Policy Compliance Group, most are still struggling to fill all the gaps left in their systems that leave them open to potential incidents. Hurley is also a senior research manager at security software maker Symantec, a member of the compliance policy think tank, along with such organizations as the Computer Security Institute, Institute of Internal Auditors, ISACA, and IT Governance Institute. Along with well-known federal guidelines, such as the Sarbanes-Oxley Act, many companies are having trouble responding to new statewide data protection measures crafted after the California 1386 bill, which requires businesses to make public notice of severe data incidents, he said. "When it comes to protecting data, a lot of organizations still find information all over the place that they may not even have control over," Hurley said. "People are finally discovering this is a difficult problem and that the controls they thought they have in place may not be adequate; that they need to rethink those controls and find out where the data inventory actually is because in most organizations, it's not under control." In addition to gauging what percentage of companies remain at risk for a data breach, the survey also attempted to measure the impact of such an event on the average company. Based on its respondents' replies, businesses that are forced to report major incidents publicly can expect to experience an 8 percent loss of their stock price and an equal 8 percent of their customers. Companies can also expect to report an 8 percent falloff in their quarterly revenue along with additional costs for litigation, customer notification, and subsequent settlements averaging $100 per each record they lose. In a nod to the increased challenge of meeting regulations and lowering data leakage within enterprises, the report concludes that larger companies are more likely to have incidents, based on its research. Organizations with less than 1,000 workers average roughly 8 percent in revenue and customer losses per event, whereas companies with more than 100,000 employees can expect to lose 12 percent of their sales and clientele. While some researchers have tried previously to divine the overall expense of having a major data breach, such as the one reported by retailer TJX Companies in early 2007, it has been hard to guess just how much such an event truly costs said Mike Money, associate director at Protiviti, an auditing services specialist that is also participating in the consortium. "We finally have some data on this because of the state laws that have gone into effect, so hopefully some companies see this report and understand the extent of the problem," Money said. "People are finally starting to focus on the issue because they see the newspaper headlines every day, and until you've been through one of these types of events, it's hard to understand all the implications." Unsurprisingly, the report also finds that companies that allocate the highest budgets for compliance automation technologies are faring better in their efforts than those who spend less on the issue. In a shift from previous studies completed by IT Policy Compliance Group, however, it appears that most organizations are realizing they need to adjust their budgets to account for the tools, Hurley said. "The difference is that these state regulations have put this on the front of the radar screen, and they are realizing that they need to spend money to solve security problems that benefit compliance goals," said Hurley. "There's a clear linkage between having better controls and experiencing fewer data losses and business disruptions, as obvious as that may seem."
562118
In the first column of this year, I discussed computer security outlook and hopes for 2008. I forecast more of the same that we saw in 2007: more spam, more malware, more bad guys basically owning the Internet and our connected computers. I don't see any trends or new leaders with significant power to change the status quo.
761336
In July Pfizer discovered a data breach that took place last year, informed employees only recently.
5343
Blog: Auditors say only a fraction of largest intrusions in recent years showed clear evidence of resulting identity theft, but they admit that's not always easy to gauge.
569218
InfoWorld - In the first column of this year, I discussed computer security outlook and hopes for 2008. I forecast more of the same that we saw in 2007: more spam, more malware, more bad guys basically owning the Internet and our connected computers. I don't see any trends or new leaders with significant power to change the status quo.