Category Archives: cybersecurity

cybersecurity, Data Loss, Data Protection, Information Security, insidertrading

How to ruin the reputation of your (118 year old) company, lose your job and your liberty

Unfortunately there are so many cases I can use to illustrate this. Most topical at this time at the start of autumn (fall) 2017 is Equifax.

They provide credit scoring services to the public and businesses in 14 countries, including Canada, UK and USA. Many financial organisations use them to assess the credit-worthiness of individuals and companies.

This company has been around for more than 100 years, they have an operating revenue of over 3 billion USD and over 9000 employees.

Their bread and butter is information. Personal information. Including name, addresses, social security number, income and loans amongst others. Stuff classed as sensitive PII by most if not all data protection agencies.

They hold data on more than 820 million individuals and 91 million businesses.

In May 2017, they lost the details of which 145 million people in the USA, at least 400000 in the UK and 100000 in Canada.

Heads Roll

Within Equifax, the chief information officer Susan Mauldin and chief security officer David Webb were retiring and within two weeks Richard Smith, the CEO said he was stepping down after having to explain the breach to a US Congress committee in October.

The market is not impressed

Their share price was trading around 140 USD, then plunged to a low of 94 USD a few days after the disclosure, which is comparable to Talktalk’s share price drop.

The actual financial impact to Equifax is unknown at this time, as it’s still so recent.

It gets worse

During a congressional hearing, it transpired that the CIO, Jun Ying had sold 950k USD of company shares. June 2019, he was found

guilty of insider trading and sentenced to 4 months in prison

and ordered to pay restitution amounting to 120M USD, as well as a 55K USD fine.

As of 13/05/19: This incident has cost the firm 1.4 B USD so far

 

IT Pro article

Moneysavingexpert article

cybersecurity, Data Loss, Hacked, Information Security

The value of patching, The cost of not patching

(One) Major cause of data breaches

Over 50% of data breaches are due to published exploits where fixes or patches are available.

The actual percentage varies to which study you refer to. The vulnerabilities may be through the OS, platforms like Java and Flash or applications.

Secure Configuration is essential, one such aspect is patching. Making sure that you’ve employed the most up-to-date software.

The reality is that many organisations do not adequately patch their software and hardware. For many it is an onerous task. They may be worried about introducing issues to their production services or it may be the lack of resources.

The risk is real, whether it is risk to production from using different (updated) software or from crackers exploiting vulnerabilities.

Regression and user-acceptance testing is essential here. There are other mitigation schemes where a staged patching is adopted, where a proportion of servers or instances of the software is patched and then used in production. It could be a test or development units.

I’ve just talked about the value and reasons for patching.

The other considerations are the cost of not patching.

There are many examples, but I’ll just share a couple with you.

Talktalk looses data

Talktalk, a communications company in the UK mobile telephone, TV and broadband market. They lost 157000 customer details in 2015. The vulnerability was on a website that had not been patched for 3.5 years. In the aftermath they lost of more than 150000 customers. Their share price dropped 30%.

Promotions and incentives cost them 35M GBP. Their 2016 profits dropped by 56%. They were also fined 400000 GBP by the ICO. Under GDPR the fine imposed could’ve been more than 70M GBP.

Equifax looses even more data

Moving to a more recent data breach, Equifax. They provide credit scoring services to the public and businesses. Many financial organisations use them to assess the credit-worthiness of individuals and companies.

They hold data on more than 820 million individuals and 91 million businesses.

In 2017, they lost the details of which 145 million people in the USA, at least 400000 in the UK and 100000 in Canada.

Heads Roll

Within Equifax, the chief information officer Susan Mauldin and chief security officer David Webb were retiring and within two weeks Richard Smith, the CEO said he was stepping down after having to explain the breach to a US Congress committee in October.

The market is not impressed

Their share price was trading around 140 USD, then plunged to a low of 94 USD a few days after the disclosure, which is comparable to Talktalk’s share price drop.

The actual financial impact to Equifax is unknown at this time, as it’s still so recent.

The breach was likely to be from a vulnerability that had been publicised and known for months and not mitigated.

The fallout from this incident is yet to settle. There are likely to be class action law suits in the USA and Canada. The respective regulators are likely to be sifting through the post mortem reports and deciding on what punitive measures to take.

Further reading and references

 

cyberhygiene, cybersecurity, howto, Information Security

Effective Cyber Security for the work place and home …

I have summarised a few tips that’ll help you along that route. It isn’t set and forget, it’s a continual process.

Business Essentials for successful Cyber Defence

Simple to say …

  • Top-level commitment to good information security management system – ISMS.
  • Information Security baked into company vision for success.
  • Robust policies backed up by process.
  • The right people and sufficient resources to run the ISMS.

Further reading for businesses

https://www.ncsc.gov.uk/guidance/10-steps-cyber-security

10 Step Summary

10 Step Executive Summary infographic

From the America Bar Association

Good Cyber Hygiene At home

  • Keep passwords simple to remember and difficult to guess, write them down if necessary.
  • Don’t reuse passwords for important services.
  • Switch on auto-update on your devices.
  • Email is a common method to spread malware, be aware of phishing.
  • Malware and confidence scams are also sent by SMS text, other messaging services and by plain old telephone.
  • Challenge telephone calls from people who purport to be from your bank, the council etc. Get their name and obtain the number from an independent source. Phone them back.
  • Shred documents containing important information (anything that identifies you, your family, your home, financial details).
  • Check your credit history regularly.

More Consumer Advice

https://www.getsafeonline.org/