Tag Archives: data breach

cybersecurity, Data Loss, Data Protection, Information Security, insidertrading

How to ruin the reputation of your (118 year old) company, lose your job and your liberty

Unfortunately there are so many cases I can use to illustrate this. Most topical at this time at the start of autumn (fall) 2017 is Equifax.

They provide credit scoring services to the public and businesses in 14 countries, including Canada, UK and USA. Many financial organisations use them to assess the credit-worthiness of individuals and companies.

This company has been around for more than 100 years, they have an operating revenue of over 3 billion USD and over 9000 employees.

Their bread and butter is information. Personal information. Including name, addresses, social security number, income and loans amongst others. Stuff classed as sensitive PII by most if not all data protection agencies.

They hold data on more than 820 million individuals and 91 million businesses.

In May 2017, they lost the details of which 145 million people in the USA, at least 400000 in the UK and 100000 in Canada.

Heads Roll

Within Equifax, the chief information officer Susan Mauldin and chief security officer David Webb were retiring and within two weeks Richard Smith, the CEO said he was stepping down after having to explain the breach to a US Congress committee in October.

The market is not impressed

Their share price was trading around 140 USD, then plunged to a low of 94 USD a few days after the disclosure, which is comparable to Talktalk’s share price drop.

The actual financial impact to Equifax is unknown at this time, as it’s still so recent.

It gets worse

During a congressional hearing, it transpired that the CIO, Jun Ying had sold 950k USD of company shares. June 2019, he was found

guilty of insider trading and sentenced to 4 months in prison

and ordered to pay restitution amounting to 120M USD, as well as a 55K USD fine.

As of 13/05/19: This incident has cost the firm 1.4 B USD so far

 

IT Pro article

Moneysavingexpert article

cybersecurity, Data Loss, Hacked, Information Security

The value of patching, The cost of not patching

(One) Major cause of data breaches

Over 50% of data breaches are due to published exploits where fixes or patches are available.

The actual percentage varies to which study you refer to. The vulnerabilities may be through the OS, platforms like Java and Flash or applications.

Secure Configuration is essential, one such aspect is patching. Making sure that you’ve employed the most up-to-date software.

The reality is that many organisations do not adequately patch their software and hardware. For many it is an onerous task. They may be worried about introducing issues to their production services or it may be the lack of resources.

The risk is real, whether it is risk to production from using different (updated) software or from crackers exploiting vulnerabilities.

Regression and user-acceptance testing is essential here. There are other mitigation schemes where a staged patching is adopted, where a proportion of servers or instances of the software is patched and then used in production. It could be a test or development units.

I’ve just talked about the value and reasons for patching.

The other considerations are the cost of not patching.

There are many examples, but I’ll just share a couple with you.

Talktalk looses data

Talktalk, a communications company in the UK mobile telephone, TV and broadband market. They lost 157000 customer details in 2015. The vulnerability was on a website that had not been patched for 3.5 years. In the aftermath they lost of more than 150000 customers. Their share price dropped 30%.

Promotions and incentives cost them 35M GBP. Their 2016 profits dropped by 56%. They were also fined 400000 GBP by the ICO. Under GDPR the fine imposed could’ve been more than 70M GBP.

Equifax looses even more data

Moving to a more recent data breach, Equifax. They provide credit scoring services to the public and businesses. Many financial organisations use them to assess the credit-worthiness of individuals and companies.

They hold data on more than 820 million individuals and 91 million businesses.

In 2017, they lost the details of which 145 million people in the USA, at least 400000 in the UK and 100000 in Canada.

Heads Roll

Within Equifax, the chief information officer Susan Mauldin and chief security officer David Webb were retiring and within two weeks Richard Smith, the CEO said he was stepping down after having to explain the breach to a US Congress committee in October.

The market is not impressed

Their share price was trading around 140 USD, then plunged to a low of 94 USD a few days after the disclosure, which is comparable to Talktalk’s share price drop.

The actual financial impact to Equifax is unknown at this time, as it’s still so recent.

The breach was likely to be from a vulnerability that had been publicised and known for months and not mitigated.

The fallout from this incident is yet to settle. There are likely to be class action law suits in the USA and Canada. The respective regulators are likely to be sifting through the post mortem reports and deciding on what punitive measures to take.

Further reading and references

 

Data Loss, Data Protection, Personal Information

Ponemon Institute – 2015 Cost of Data Breach Study: United States

US study at a glance

$6.5 million is the average total cost of data breach 11% increase in total cost of data breach

$217 is the average cost per lost or stolen record

8% increase in cost per lost or stolen record

Highlights from the report

As in the ICO (UK) Data Breach report, healthcare comes number 1 in the charts, this time for the cost of each breach.

The report is definitely worth spending time reading. It highlights the following points for minimising the cost and impact of security breaches :

  • Board-level engagement and CISO leadership
  • Employee training
  • A relevant and up-to-date incident response plan and team
  • Targeted use of encryption
  • BCM integration
  • Insurance protection

These are the fundamental building blocks of an ISMS (information Security Management System), found in ISO27001, COBIT5 and others.

The Ponemon Institute report

Data Loss, Data Protection, Personal Information

UK Healthcare sector accounted for 40% of data breaches

2014 Q4 figures released by the ICO (Information Commissioner’s Office) reveals that of the data breaches reported to them, over 40%  originated from the healthcare sector.  Local government and education are a distant 2nd and 3rd respectively.

Source : ICO Q4 2014 Data Breach figures

The vast majority of these were attributed to human error, broken down into detail in the next chart.

Source : ICO Q4 2014 Data Breach figures

Principle 7 failure originates from inadequate technical controls.

The ICO states :

Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Chun’s View

The raw figures indicate that the healthcare sector is prone to unintended personal information exposure (bear in mind these numbers haven’t been normalised),  it could be that this sector’s threshold for reporting is lower, It does reinforce the point that the majority of data leaks are due to human error.

Mitigation

Board-level sponsorship of Data Protection and Information Security training, as part of a larger learning and development regime, is essential. It must be viewed by the organisational population as worthwhile.

This must be formalised into the training strategy and woven into the Employees Handbook and Security Policy of the organisation.

As well as regular training targeting people who handle personal data, the training quality assurance is provided by the tracking of training metrics, such as completion and pass rates. With a sufficient data set, this may be correlated against the number of incidents reported. Incident rates may actually increase, as more may be reported when people are more aware of their obligations.

Parting words

Whichever sector you’re in, guarding against unintentional exposure of personal information is essential to maintaining your organisation’s reputation and avoiding the attention of the ICO.

Further reading (ICO)