Database Security 3.0

Are Financial Services Organizations Protecting Themselves Better?

Interesting article by Linda McGlasson of Bank Information Security tracking the biggest breaches of 2009. The Identity Theft Center is reporting 356 total data breaches in 2009, 46 or which occurred at financial services organizations.

Of the 46 financial services breaches, IDTC categorized them:

Insider theft: 12 breaches;

Skimming: 8;

Missing paper documents: 10 of the breaches

Exposure of data on the Internet: 4;

Accidental breaches: 2;

Stolen or missing hard drives/laptops: 5;

Outside network intrusions: 2;

Unknown cause: 3.

So between IDTC reporting that fraud cost consumers $1.8 billion and the classification of breach method, doesn't it beg the fact that the thieves are scoring this data from somewhere?

Wait, can you hear that? It sounds like a database being cracked open to steal that information that lead to all that theft. And isn't it more important to protect data where it resides as opposed to focusing on the conduits?

263,379,546?

As of this morning, Privacyrights.org has documented over 263 million records breached ranging from simple laptop thefts to full fledged attacks. The scary thing is this number does not include all the undocumented breaches.

If you are looking for some specific breach examples to build a business case for a database security, risk and compliance solution, check out Privacyrights.org. The site lists just about every documented data breach since 2005.

Information Security: Why Cybercriminals Are Smiling - Knowledge@Wharton

Just came across this great article on how hackers are getting more sophistcated.

Information Security: Why Cybercriminals Are Smiling - Knowledge@Wharton Shared via AddThis

Will the Real Cyber Security Czar Please Stand Up?

Does it strike anyone as odd that even months after the Obama administration announced its cyber security czar, they either can’t find anyone, or no one wants the job?

 

Melissa Hathaway, who was the interim cybersecurity czar, resigned citing personal reasons this week, leaving the job vacant for now.

Are our problems with cyber security simply too large for a dedicated czar to step up and take the reigns? Is it more lucrative to consult to organizations who’ll pay exorbitant amounts of money to expensive advisors to help develop an uber-security posture?

 

Or maybe it’s a matter of politics? Hathaway was one of the holdovers from W’s administration.

 

And let's face it, well, it’s certainly easier to sit on the sidelines and comment. So that’s what we’ll do here.

But we’ll throw out the three qualities Obama should want in the candidate, and see if they stick to the wall – and no, it’s not someone ‘with the right mix of political know-how and deep security expertise.’ C’mon, that’s ridiculous. Here’s some food for thought on what they might want to think about for whoever they get for the job…..

1. Someone who knows the tricks of the trade – someone with a white hat who knows exactly how to break into corporate networks, steal confidential data and not leave a trace. Oh, and they know how to reverse-engineer every step, every piece of code. They know exactly how the most sophisticated attackers get the data they’ve worked hard to get to. Why is this key? Well, they should REALLy understand what they're dealing with, and how knowing these techniques cold can help fight international espionage and global terrorism.

2. Someone not political. Not at all. Who cares if they’re responsible for setting policy? If this individual has the know-how and a broad enough background on the corporate or consultant side, maybe that’s what is need to shake things up. That might just uncover what a lot of people AREN’T doing with regard to this initiative after an initial inventory. Jeez, Barack should have gone to Black Hat in Vegas last week, a perfect recruiting site for this vacant post!

3. Someone who isn’t just a figurehead. They can’t be mired in the muckiness, and they certainly can’t be tethered by both the National Security Council and the National Economic Council. They should head up this group, period. Sure they should be able to deliver a speech to report progress publicly, but they need to come in and get stuff done. Is that too much to ask given the threat landscape and links to terrorist activity that a lack of a cyber security policy presents?

It's so simple, right?