Data Breach Lessons Learned: Part 2

Continued from Friday’s post, here is more information regarding how the indictment of hacker Albert Gonzalez in connection with the biggest credit card number heist in history is significant to your business and protecting its information assets:

• As difficult as it is to announce a data breach, companies not only have the responsibility to their customers to alert authorities of a data breach, but they will also be helping the efforts of law enforcement to catch criminals like Gonzalez by announcing in a prompt manner.  Companies already implicated in highly-publicized breaches have lost immeasurable, irreparable damage to their reputations.  However, as this story develops, there has been news that Heartland may have known more about the scope of the breach than what they reported.  This may be a serious problem for the company.
• While Gonzalez is the malicious intruder in this case, the corporate victims also take a piece of the blame, whether rightfully so or not.  Securing a network is like locking your doors when you leave your house—except it takes a lot more time, effort, and money.
• With so much attention being paid lately to social engineering techniques such as phishing and the threat posed by malicious “insiders” in rough economic times, this massive data breach was executed using somewhat-traditional network hacking.  Hackers have not abandoned this tactic.
• As cumbersome as laws like the GLBA, HIPAA, PCI, and the Massachusetts Data Protection Law are, they may very well be necessary to keep individuals safe from identity fraud.

GraVoc Associates, Inc, located in Peabody, MA, serves customers in Greater Boston, New England, and beyond in the practices of information systems, information security, and professional and technological services.  The GraVoc News Blog is updated frequently to provide free information and tips to help your company’s bottom line.  For more information regarding GraVoc’s services and how they can help your company’s efficiency and security, please visit http://www.gravoc.com.

Lessons Learned in Data Breach Indictment

The indictment of Albert Gonzalez and two other co-conspirators in connection with data breaches resulting in 130 million credit card numbers stolen is massive news.  This is the largest breach of credit card numbers ever recorded, and the fact that someone was caught speaks volumes about the efforts of law enforcement officials.  However, this indictment doesn’t change the fact that the numbers were still compromised and the corporate victims—the businesses that had data stolen off of their networks—have suffered irreparable damage both in terms of regulatory compliance and corporate reputation.  There are many lessons to be learned about this incident.  The GraVoc News Blog will outline this information in a two-part series.

• Albert Gonzalez is already currently in prison for his involvement of a previous high-profile data breach involving TJX, Dave & Buster’s, BJ’s, and other companies.  In his career as a hacker, he very well may have stolen 200 million credit card numbers!  Each of these operations, while certainly sophisticated, were reasonably small.  This news shows how readily available credit card numbers can be if a network is violated.
• This attack was well-planned and well-researched.  The scope of this group’s “research and development” included driving with a computer to evaluate the security (or lack thereof) of potential victims’ networks using a variety of tools, many of which may also be used by companies like GraVoc to help companies identify vulnerabilities in a network’s perimeter.  Potential victims were also qualified by researching the means of payment processing.
• The attack was carried out with a SQL injection and installation of malware, exploiting network vulnerabilities that were previously identified and documented.  These attacks typically exploit “poorly-coded” applications, and when these vulnerabilities are initially found, they are documented and resolved in an updated version of the application.  In other words, many of these vulnerabilities are the result of a company’s lack of diligence regarding updating software versions.
• Experts agree that despite the diligent preparation for this attack, an SQL injection is not a difficult exploit to execute.  While Albert Gonzalez may be behind bars, he is hardly the only hacker in the world who can exploit the same vulnerabilities in this manner.

GraVoc Associates, Inc. of Peabody, MA, is dedicated to ensuring its clients in Greater Boston, New England, and beyond are aware of the ever-changing environment of information security.  The GraVoc News Blog will continue documenting four other “lessons learned” early next week.  For more information regarding GraVoc’s services in information security, information systems, and technological and professional services, please visit http://www.gravoc.com.