Data Loss, Data Protection

Passwords – Not fit-for-purpose, misused and Ugly

It’s a perennial subject, but one worth reiterating, as old habits die hard. “Popular Passwords”, from the numerous loss and publication of unencrypted password lists, a league table has been created. The data is from 2014, but I very much doubt much has changed, so the message goes out again. Please avoid using regular names, sport teams and standard mis-spelling of dictionary words, such as P455word1, it’s better than 12354567 or qwertyuiop, but no way is it secure.

Is your password below ?

popular passwords

Source : www.informationisbeautiful.net

There are password guessers which substitutes 5,$ etc for S. The dictionary used covers the main languages used for commerce, English, French, Spanish, German and more commonly now Korean, Japanese and Chinese.

The safest password is one which is randomly generated or at least not a dictionary word. Using password managers is one strategy that people and organisations use, but that means putting your trust in that product and relying on you remembering your password to unlock that, but it is a better solution than many others.

Guidelines

  • Use 10 characters or more
  • Avoid dictionary words
  • Don’t reuse passwords across different services (for sensitive or high value services)
  • Don’t just rely on common substitutions
  • Write them down (keep the book/paper safe)

I know the last one is contentious. Better to write it down than to forget it or rely on another piece of software of technology that can be compromised. Your smartphone can be hacked anywhere in the world, your paper notebook is much, much harder to access.

 

Rank Password Change from 2013
1 123456 No Change
2 password No Change
3 12345 Up 17
4 12345678 Down 1
5 qwerty Down 1
6 123456789 No Change
7 1234 Up 9
8 baseball New
9 dragon New
10 football New
11 1234567 Down 4
12 monkey Up 5
13 letmein Up 1
14 abc123 Down 9
15 111111 Down 8
16 mustang New
17 access New
18 shadow Unchanged
19 master New
20 michael New
21 superman New
22 696969 New
23 123123 Down 12
24 batman New
25 trustno1 Down 1

 

Source : splashdata.com

Data Loss, Data Protection, Hacked, Personal Information

Another day, another Data Breach – OPM – US government’s Office of Personnel Management

I’m sure you’ve seen this one in the news already. I have resisted commenting immediately, so that we can all take a step back and avoid knee-jerk, reactive comments.

21.5m USA federal employees and associates PI lost

Breach occurred over 12 months

In a nutshell, the personal data of 21.5m US government personnel was pilfered for more than 12 months. This included names, addresses, social security number (similar to the UK National Insurance number), position in the government and biometric data. Foreign contacts were also in the data haul. Background checks for the last 15 years, of friends, associates and information required for security clearance roles were lost. This information may potentially expose federal employee’s to unfavourable actions.

There were either no or insufficient controls in place to protect the data, control access, detect data leakage or detect malware. Apparently it was only due to a security tool demonstration that the breach was discovered at all.

Source :  http://www.prweb.com/releases/2015/06/prweb12787823.htm

The fallout has been severe; Katherine Archuleta, The Director of the US Office of Personnel Management has resigned in the wake of further revelations about the scale of the hacking attack on the agency. She had been in the role for two years. The insecurity of OPM services was already known and documented in an earlier audit by the US Inspector General as unsafe, some as far back as 2007. The Director accepted the risk and kept the servers running without sufficient mitigation. Other findings included using servers that were unable to employ encryption and inadequate authentication.

Audit recommendations not properly mitigated

Although there was an upgrade plan underway, her mitigation strategy was not-fit-for-purpose and did not reflect the risk and vulnerabilities at the OPM.

This has echoes of the 2014 Target Breach, where management were aware of serious issues, but under-played and ignored advice. This neatly highlights the fact that you can have independent audit, but if the risk is not owned by the board, properly interpreted and mitigated, you are leaving your organisation (or indeed country) open to threats.

I have also deliberately avoided the more political aspects of this breach; It is the duty of all countries to spy on another, for gain, for war and for peace. Blaming one country or another for your own failings is disingenuous at best and totally blinkered to the realities of our world.

Further reading

https://www.opm.gov/cybersecurity/

http://www.nytimes.com/2015/07/10/us/office-of-personnel-management-hackers-got-data-of-millions.html?_r=0

http://www.cio.com/article/2947453/data-breach/how-opm-data-breach-could-have-been-prevented.html

http://www.cio.com/article/2945425/data-breach/the-opm-lawsuit-will-only-make-the-lawyers-rich.html

Data Loss, Data Protection, Personal Information

Ponemon Institute – 2015 Cost of Data Breach Study: United States

US study at a glance

$6.5 million is the average total cost of data breach 11% increase in total cost of data breach

$217 is the average cost per lost or stolen record

8% increase in cost per lost or stolen record

Highlights from the report

As in the ICO (UK) Data Breach report, healthcare comes number 1 in the charts, this time for the cost of each breach.

The report is definitely worth spending time reading. It highlights the following points for minimising the cost and impact of security breaches :

  • Board-level engagement and CISO leadership
  • Employee training
  • A relevant and up-to-date incident response plan and team
  • Targeted use of encryption
  • BCM integration
  • Insurance protection

These are the fundamental building blocks of an ISMS (information Security Management System), found in ISO27001, COBIT5 and others.

The Ponemon Institute report

Data Loss, Data Protection, Personal Information

UK Healthcare sector accounted for 40% of data breaches

2014 Q4 figures released by the ICO (Information Commissioner’s Office) reveals that of the data breaches reported to them, over 40%  originated from the healthcare sector.  Local government and education are a distant 2nd and 3rd respectively.

Source : ICO Q4 2014 Data Breach figures

The vast majority of these were attributed to human error, broken down into detail in the next chart.

Source : ICO Q4 2014 Data Breach figures

Principle 7 failure originates from inadequate technical controls.

The ICO states :

Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Chun’s View

The raw figures indicate that the healthcare sector is prone to unintended personal information exposure (bear in mind these numbers haven’t been normalised),  it could be that this sector’s threshold for reporting is lower, It does reinforce the point that the majority of data leaks are due to human error.

Mitigation

Board-level sponsorship of Data Protection and Information Security training, as part of a larger learning and development regime, is essential. It must be viewed by the organisational population as worthwhile.

This must be formalised into the training strategy and woven into the Employees Handbook and Security Policy of the organisation.

As well as regular training targeting people who handle personal data, the training quality assurance is provided by the tracking of training metrics, such as completion and pass rates. With a sufficient data set, this may be correlated against the number of incidents reported. Incident rates may actually increase, as more may be reported when people are more aware of their obligations.

Parting words

Whichever sector you’re in, guarding against unintentional exposure of personal information is essential to maintaining your organisation’s reputation and avoiding the attention of the ICO.

Further reading (ICO)

Data Loss, Data Protection, Personal Information

World Leader’s PI leaked

The personal details of all 31 leaders at the recent G20 summit in Australia have been accidentally leaked by the Australian immigration department. Despite being notified of the high-profile breach four months ago, it neglected to inform anyone.

The details included passport numbers, visa details and other particulars of each leader at the summit.

Tony Abbott and Vladimir Putin cuddle koalas before the start of the first G20 meeting in November 2014. Photograph: Andrew Taylor/G20 Australia/Getty Images

In a letter obtained under Freedom of Information requests, it’s been revealed that a staffer at the G20 leaders summit staged in Australia last November mistakenly mailed a list of the leaders’ personal details to an official at the Asian Football Cup Local Organising Committee.

Although the information hasn’t been publicly exposed and is unlikely to be of use for nefarious purposes, not many people are likely to pretend to be Vladimir Putin or David Cameron. The damage is reputational and is certainly embarrassing for the Australian government. Ironically it had just recently passed controversial mandatory metadata retention laws.

Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2015

International Business Times article on the new Australian Bill and obligations of ISPs

The Guardian’s article on the new Australian Bill

 

 

 

Data Loss, Data Protection, Hacked

2014 – The Year of 1 Billion Data Record Losses

Gemalto the digital security services company and Safenet have released a report titled “2014 – Year of Mega Breaches & Identity Theft”

2014 Data Breaches Gemalto Infographic

The headline numbers make for sober reading. The number of data records loss jumped 78%, from about 575 million in 2013 to more than one billion in 2014.

In terms of time, in 2014 some 2,803,036 data records were lost every day, 116,793 every hour, 1,947 every minute and 32 every second. So figure in about the time it took to read the previous sentence, about 400 data records would have been stolen or lost based on the 2014 data breach statistics.

Despite the widespread availability of commercially and indeed open source encryption solutions as a means for protecting  information and privacy, only 58 of the data breach incidents in 2014, or less than 4% of the total, involved data that was encrypted in part or in full.

In short, companies and organisations are still not taking protection of data seriously. It’s likely to take the commensurate loss of revenue or regulatory fines, up to and including gaol time for things to start improving.

One catalyst for this may well be the EU General Data Protection Regulations, but there’s a lot of lobbying and compromises between the proposals and actual legislation. It may still revert back to being an EU Directive. Meanwhile our Personal Information is being  shared, sold and aggregated ad infinitum, that’s before it’s leaked and stolen !

Gemalto’s 2014 Data Breach Report

Data Loss, Data Protection, Hacked

Significant data theft from Anthem – one of USA largest health insurers

anthemlogo

Anthem, the US’s second biggest health insurer with about 70 million people on its books across the country, admitted late on 4th February 2015, that it was the target of an external cyber attack.

These attackers gained unauthorised access to Anthem’s IT system and have obtained personal information from our current and former members such as their names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information, including income data.Tens of millions of records are likely to have been obtained illegally as a result of the hack, Anthem warned.

Health plans branded Anthem Blue Cross; Anthem Blue Cross and Blue Shield; Blue Cross and Blue Shield of Georgia; Empire Blue Cross and Blue Shield; Amerigroup; Caremore; Unicare; Healthlink; or DeCare, are at risk.

It is not clear when the company’s databases were compromised – just that it was discovered some time last week.  Anthem is offering free credit and identity monitoring cover to those affected by the breach.

Up to 80 million Americans (current and ex-insurees), are now being warned that they’re being targeted by scammers who are trying trick the victims into revealing additional personal information. Scammers are running email phishing campaigns, and even placing phone calls to affected customers, Anthem says.

The identity of the perpetrators hasn’t been disclosed yet, the FBI are are investigating the. Mandiant, a well-known cybersecurity firm, to look into vulnerabilities of its computer system.

Anthem’s statement

An interesting viewpoint from Kreb’s 

Chun’s view

It’s way too soon to speculate on the whys and what happened, only that your organisation is neither too big or too small to be vulnerable.

Good policies and good housekeeping are the backbone of any ISMS. Having a comprehensive plan to deal with breaches and data loss will go a long way in containment and minimising the damage.

 

Data Loss

First post of 2015 – Insider Threat – Data theft from 350000 Morgan Stanley’s clients

A Morgan Stanley employee, Galen Marsh stole sensitive information from 350000 wealth management clients in December 2014, of which 900 client’s data was posted on Pastebin, an internet expose site with a link for interested parties to purchase more information.

http://dealbook.nytimes.com/2015/01/05/morgan-stanley-fires-employee-saying-data-on-350000-clients-was-stolen/?_r=0

http://www.morganstanley.com/about/press/articles/7f189537-f51c-40b0-a963-fc0dc6c65861.html

Protecting from external threats is relatively simple, the insider threat is much more difficult to mitigate and potentially a lot more damaging.

A robust security policy with regular employee security awareness and obligations training, allied to a well tuned data loss detection and protection is essential. Post-incident response and lessons learnt completes the cycle.