Data breaches could take a toll on e-commerce
77752
Consumers are becoming more worried about the potential dangers of e-commerce in the wake of data breaches that have occurred in recent years, according to a survey by the Ponemon Institute.
173385
A new report out of Hollywood suggests the data explosion could turn into data extinction through the loss of valuable digital content.
562774
(Source: Tizor)  With the severity of recent data breaches affecting brand name merchants, anxiety in the security and compliance community has reached a new high. Questions are being raised about what it means to be PCI compliant, particularly in the context of protecting sensitive data from data breaches.
726987
The loss or theft of personal data such as credit card and Social Security numbers is soaring to unprecedented levels, and the trend isn't expected to turn around anytime soon as hackers stay a step ahead of security and laptops disappear with sensitive information.
172460
TJX has revealed that a breach of its credit card transaction systems occurred a year earlier than previously disclosed and that many more customers may have been affected.
542349
New exploits could affect customers who never applied patches for known database flaws.
189807
Browser flaw may leave you vulnerable to phishing attacks.
643950
Businesses have more to worry about with end-user abuse and security lapses, research suggests.
105605
A DIRECTOR of technology for security outfit RSA Security has warned online customers are not &quot;authenticated enough&quot; and there needs to be moves towards toward a mandated identity policy.
316177
An attack combining malicious codes on Web sites and end-user laziness could compromise millions of routers still configured with their out-of-the-box defaults.
33910
The results of a survey conducted by GartnerÂ and shared with IDG News Service show that online consumers are growing frustrated with the lack of security provided by banks and online retailers, and feel that passwords are no longer sufficient to secure their online transactions.
713463
Threats to data security are mounting, especially from within organizations, but top executives aren&#39;t helping their companies keep pace, a new study has found.
218357
As growing numbers of Americans turn to the Internet for holiday shopping, experts warn that online dangers such as fraud and identity theft are increasing as well.
365929
(InfoWorld) - Using a credit card at a gas station could pose more of a risk for data theft than shopping online, as point-of-sale terminals have emerged as a weak link in the security chain, according to a Gartner analyst. When a card is swiped, point-of-sale (POS) terminals often collect and store the data held in the magnetic stripe on the back of a credit card, said Avivah Litan, a Gartner vice president and distinguished analyst. Retailers are often unaware that their POS applications collect so much information. In the hands of sophisticated hackers and counterfeiters, the data collected from the magnetic stripe is enough to create a replica card. "It's almost more dangerous to go to the gas station than it is online," Litan said at Gartner's Identity and Access Management Summit in London on Monday. "The data is just sitting there. No one even thought about what data is on a POS controller." Retailers' network configurations are partly to blame. Many are using the Internet to transmit data in place of dial-up networks, and many have incorporated wireless access points into their networks using WEP (Wired Equivalent Privacy), Litan said, which is not considered a strong form of encryption. Hackers lurk in parking lots looking for weak networks to penetrate. Since the POS terminals are linked via IP, once a hacker has accessed a network they can try out neighboring IP addresses until they locate a store of data, Litan said. Data breaches that occur offline are common. Of 160 breaches investigated for one major credit card brand, 128 took place in the brick and mortar world where the card was physically present for the transaction, rather than being used online or over the telephone, according to Gartner. To strengthen security, card brands such as Visa and Mastercard are pressuring retailers to comply with the Payment Card Industry (PCI) Data Security Standard, a code of best practices created by the card industry. The standard forbids the storing of magnetic stripe data on POS terminals, and Visa plans to start fining retailers in the coming months if they don't comply, according to Gartner. Implementing security is cheaper in the long run than having a data breach, which can be expensive and hurt a company's reputation. Gartner calculates that a data breach costs companies around $300 per exposed account because of investigations, fines and lawsuits. On the other hand, beefing up security costs around $16 per account for the first year, and that cost falls over time, according to Litan. The short-term forecast for POS security doesn't look great, however. Gartner predicts that by next year, most attacks against retailers will be directed at their POS terminals, and only 30 percent of POS software will be compliant with the prevailing security standards by 2009. "The thieves always find the path of least resistance," Litan said. Â
675654
Although online shopping has its risks, your credit-card number and other personal information are just as likely to be stolen in a very low-tech way.
367998
(InfoWorld) - Most large data breaches don't appear to lead to identity theft, and proposals that would require companies to notify customers of most breaches may lead to increased costs without significant benefits, says a report from a U.S. government agency released Thursday. The report, from the U.S. Government Accountability Office (GAO), said only four of the 24 largest data breaches between January 2000 and June 2005 appear to have resulted in identity fraud. Wide-ranging data breach notification laws that would require nearly all breaches to be reported could lead to notifications that "present little or no risk, perhaps leading consumers to disregard notices altogether," the report said. While a breach notification law would have several benefits, a law that requires notification for nearly all breaches could also create significant costs for businesses, the report added. The U.S. Congress is currently considering several breach notification bills, including some that would require notification for nearly all breaches. Instead, Congress may want to consider a notification rule based on the potential for the risk of ID theft, the report said. The U.S. President's Identity Theft Task Force has recommended a national standard for determining when government agencies and private companies should report breaches, the report pointed out. A risk-based standard "could avoid undue burden on organizations and unnecessary and counterproductive notifications of breaches that present little risk," the report said. A data breach law would create costs for businesses, including the cost of developing incident response plans and notifying customers, the report said. While it's difficult to determine costs, a Ponemon Institute study in 2006 found that 31 companies with breaches incurred an average cost of $1.4 million per breach for notifying customers, staffing call centers, paying legal fees, and other expenses, the report said. The GAO researched 24 large data breaches reported in the media between 2000 and 2005, and found that 18 of them had no ID theft or fraud identified. Three of the breaches, at CardSystems Solutions, DSW, and CD Universe, had reports of fraud associated with existing customer accounts. And a breach at ChoicePoint had reports of unauthorized new accounts opened. In the remaining two breaches, GAO was unable to determine if there had been ID fraud. It's difficult to track ID theft resulting from data breaches, the report said. In some cases, thieves don't attempt to use the data until a year or more after the breach, the report said. A breach notification law could be beneficial because it would encourage organizations to improve data security, the report said. "Care is needed in defining appropriate criteria for data breaches that merit notification," the report said. "Because breaches vary in the risk they present, and because most breaches have not resulted in detected incidents of identity theft, a notification that is risk based appears appropriate." Alan Paller, director of research at the SANS Institute, a security research and training company in Maryland, praised the report, saying some in Congress have focused too much on data breaches. Some lawmakers have "dropped the ball on the far more important area of attack-based defenses," he said. The report is important because it gives Congress more information about data breaches, added Thomas Lenard, senior fellow and acting president at the Progress and Freedom Foundation, a conservative think tank. "Itâs very good to have more data on this issue," he said. "[The report] reinforces my view that we should only adopt new regulations in this area if it can be shown that their benefits are greater than their costs."
367602
As Ken Solomon read the letter last month from a company whose software he had bought, one sentence set off alarms: "Your credit or debit card information may be at risk."