Blue Lance InfoSec Blog

Federal Reserve Employee Arrested for Using Stolen Identities to Get Loans

Curtis Wiltshire, a former information analyst for the Federal Reserve Bank of New York, and his brother Kenneth Wiltshire were arrested last week on charges related to a series of fraudulent loans obtained with employee data stolen from FRB-NY.

The theft was discovered in February 2009 when an FRB-NY investigator examined a USB flash drive found attached to Curtis Wiltshire's computer.  The investigator found application data from two student loans in the names of two individuals whose identities had been stolen, and a fraudulent driver's license with the photo of an FRB-NY employee.  The loans were obtained in 2006, with values totaling approximately $73,000.

Kenneth Wiltshire was discovered separately through an investigation into fraudulent loans which led them to Wiltshire's rented mailbox, which was opened using a fraudulent driver's license using the photo of another FRB-NY employee.  Stolen data had been used to obtain a boat loan, along with a fake income tax return in the name of the FRB-NY employee.

Curtis Wiltshire was charged with bank fraud, fraud accociated with identification documents and aggravated identity theft.  His brother Kenneth is charged with mail fraud and identity theft.

View the press release.

Employees Steal More Than 100,000 Files From Starwood Hotels

Starwood Hotels & Resorts announced it has filed a lawsuit against Hilton Hotels Corporation and senior executives Ross Klein, Global Head of Hilton Luxury & Lifestyle Brands and Amar Lalvani, Global Head of Hilton Luxury & Lifestyle Brand Development, who are former Starwood employees.  Klein, former President of the Starwood Luxury Brands Group and Lalvani, former Senior Vice President of Starwood Luxury Brands were recruited to Hilton in June 2008.

The suit alleges Klein and Lalvani, aided by Hilton, stole more than 100,000 electronic files including strategic development plans, financial information, negotiation strategies, marketing and operational materials.  The materials were all related to the development of Starwood's W® luxury brand, which Starwood had spend the last 10 years and tens of millions of dollars to develop.

The theft was discovered almost by accident.  According to the press release,

In November 2008, Starwood initiated arbitration with Klein over the non-solicitation provisions in his employment contract and separation agreement, and put Hilton on notice to preserve relevant information. Three months later, and just days before Hilton announced the launch of its new lifestyle brand, Starwood received from Hilton eight large boxes of hard copy documents as well as computer hard drives, zip drives, and thumb drives containing more than 100,000 electronic files downloaded from Starwood computers, much of it highly proprietary. It was at this point that Starwood first became aware of the theft.

After delivering the materials, Hilton notified Starwood that Klein and other former employees had brought the materials they had developed or acquired during their employment at Starwood and had additional materials at home.

Kenneth Siegel, Starwood’s Chief Administrative Officer and General Counsel, said: “The wholesale looting of proprietary Starwood information, including a step-by-step playbook for creating a lifestyle luxury hotel brand, unfairly enabled Hilton to launch a new brand in only nine months instead of the usual three to five years.”

Hilton issued the following statement on Tuesday:

Hilton Hotels Corporation today acknowledged receipt of a federal grand jury subpoena from the United States Attorney’s Office for the Southern District of New York requesting documents relating to Hilton's employment of former employees of Starwood Hotels & Resorts Worldwide, Inc. and materials which Hilton returned to Starwood in February of 2009.

On April 16, Starwood filed a civil complaint alleging its former employees, Ross Klein and Amar Lalvani, and Hilton, unlawfully obtained and used Starwood information. Hilton has placed Mr. Klein, Mr. Lalvani and their luxury and lifestyle team on paid administrative leave pending Hilton’s review of the situation. At this time, further development of the Denizen Hotels brand has been temporarily suspended.

This is another example of the massive financial damage malicious insiders can cause when user activity is left unmonitored.  Had Starwood been monitoring file and user activity, they would have been able to notify the authorities prior to the loss of the data to Hilton. 

HHS Issues HITECH Act Notification Guidance

The Department of Health and Human Services on Friday issued guidance for breach notifications as required by Subtitle D of the Health Information Technology for Economic and Clinical Health (HITECH) Act.

The guidance specifies the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.  According to the announcement,

This guidance relates to two forthcoming breach notification regulations – one to be issued by HHS for covered entities and their business associates under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Sec. 13402 of HITECH) and one to be issued by the Federal Trade Commission (FTC) for vendors of personal health records and other non-HIPAA covered entities (Sec. 13407 of HITECH).  HITECH requires these regulations to be published within 180 days of enactment.  If the entities subject to the regulations apply the technologies and methodologies specified in the guidance to secure information, they will not be required to provide the notifications required by the regulations in the event the information is breached.

The HHS also issued a request for information (RFI), asking for public comment of the breach notification provisions.  Once published, comments may be submitted through www.regulations.gov.

Update: Investors Abandon Mitsubishi UFJ Securities After Breach

An update to a previous post...

According to a Tradingmarkets.com report, dozens of investors have already cancelled securities orders after news of a security breach in which almost 50,000 customer records were sold by an employee. 

Read the full story

Mitsubishi UFJ Securities Employee Sells Stolen Customer Data

Mitsubishi UFJ Securities announced earlier this month that an employee had stolen its entire customer list of nearly 1.5 million accounts.  The employee then sold the information for 49,159 of those accounts, exposing the data to thirteen companies. 

According to a report from the Mainichi Daily News, further investigation revealed that the information had been sold and resold to a total of 80 companies.  According to Mainichi,

"Retrieving the customers' information has proved difficult, and the securities company is considering buying back the information and paying the customers compensation."

There have been no cost estimates announced yet, but as is the case in most security breaches resulting in the loss of customer data, the costs associated with the incident will far outweigh the cost of enforcing the information security plan by auditing controls and user activity.

COBIT 4.1 Solution Brief Now Available

Blue Lance released its LT Auditor+ Solution Brief today for compliance with the COBIT 4.1 Framework.  The document illustrates how LT Auditor+ maps to the COBIT controls as documented in the framework.  The document is one of several solution briefs being developed on IT security regulations and frameworks including GLBA, FISMA, and Sarbanes-Oxley.

Summary
LT Auditor+ is an important step on the path to compliance with COBIT.  The tools provide detailed audit trails for Novell NetWare and eDirectory as well as Microsoft Windows file systems, Active Directory and Group Policy.  It allows security and compliance teams to monitor, report and alert on access and changes to sensitive files and configuration settings.

The COBIT 4.1 Solution Brief is available now through the LT Auditor+ User Center.

Former Employee Arrested in Fox Data Breach

A former employee of Fox Entertainment Group was arrested last week for stealing the confidential information of approximately 10 other employees of the company.  The data included names, social security numbers and compensation information.  The employee had worked in the benefits department at Fox.

After becoming aware of the breach, Fox notified law enforcement, who subsequently arrested the former employee.  The data was recovered in the former employee's home during the execution of a search warrant.

In the Notice of Security Breach submitted to the New Hampshire Attorney General's Office, Fox Vice President Timothy Lykowski stated "We have no evidence to suggest that this personal information was disseminated by the employee to any third party or otherwise misused."

Kaiser hospital fires 15 for snooping through medical records

A Kaiser Permanente hospital in Bellflower, CA has recently fired 15 employees and reprimanded 8 others for accessing the medical records of Nadya Suleman.  Suleman is the California woman who gave birth to octuplets back in January of this year.  The access of information by the employees in question was unnecessary and evidently done out of personal curiosity, and violated California laws designed to protect the privacy of health care data.

This breach and others like it are attributed by professionals in the industry to have been caused by “primitive” security controls that haven’t been updated in decades.  Large hospitals do not rely on role-based access controls, allowing large numbers of employees to have access to thousands of patients’ personal data.  Most of these employees have no need to access much of the data available to them.  The lack of role-based access prevents the application of least privilege assignment, or separation of duties (SoD).

The data breach was discovered by a monitoring tool employed around the time Suleman entered the hospital’s care in order to protect her privacy.  At the time of this publication, Suleman has no plans to sue Kaiser.

For more information about LT Auditor’s solutions for auditing access to your important data, visit www.bluelance.com.

FISMA Solution Brief Now Available

Blue Lance released its LT Auditor+ Solution Brief today for FISMA Compliance.  The document illustrates how LT Auditor+ maps to the FISMA controls as documented in NIST SP 800-53.  The document is one of several solution briefs being developed on IT security regulations and frameworks including GLBA, and COBIT.

Summary
LT Auditor+ is an important step on the path to compliance with FISMA.  The tools provide detailed audit trails for Novell NetWare and eDirectory as well as Microsoft Windows file systems, Active Directory and Group Policy.  It allows security and compliance teams to monitor, report and alert on access and changes to sensitive files and configuration settings.

The FISMA Solution Brief is available now through the LT Auditor+ User Center.

7 Ways to Reduce your Risk of Insider Threat

Mitigation of insider threat is a complex and intensive process.  The following steps to reduce risks associated with insiders do not encompass all one can do, but do address 7 of the most important processes to maintain security.

1.  Screen before you hire
Performing a background check can be helpful in weeding out potential candidates for insider theft during the hiring process.  Thirty percent of employees who committed insider theft, according to a recent CERT study, had a previous arrest history.  18% were arrested for violent offenses, 11% for drug or alcohol related offenses, and 11% for non-financial/fraud related theft offenses. 

2.  Monitor employee behavior
Changes in employee behavior or financial status should be recognized and evaluated.  Disgruntled employees will inevitably show their dissatisfaction, and proactive measures should be taken to address their issues.  Employees who have recently encountered financial problems should be monitored as they are more likely to commit insider theft for financial gain. 

3.  Create and enforce clear security policies and procedures
Assessing risk factors specific to an organization and implementing the proper security policies and procedures lessens insider threat risk.  These policies and procedures will vary by organization, but some essential security basics are appropriate throughout.  Monitoring of file use, user privileges, logons, and downloads to removable storage devices should be in place for any employee with access to anything not in the public domain.

4.  Educate employees on IT security
IT security policies mean nothing if the employees in an organization are unaware of them.  Upon hiring, employees should read and sign documentation addressing company security policies.  Periodic re-training should take place to ensure that all employees are up to date on the current policies and procedures.  Security awareness is not like riding a bike; it can be forgotten or pushed to the edges of one’s memory.  Security training updates help employees keep company security at the forefront of their thoughts while conducting business.

5.  Enforce separation of duties
Giving users the least privileges necessary to perform their job duties is necessary to maintaining a secure environment.  It is equally important to maintain least privileges when employees are promoted, demoted, or make a lateral move in the company. 

6.  Remove user access following termination
Once an employee has been terminated, it is of the utmost importance to retract all access privileges immediately and repossess all company devices (e.g. Blackberry devices and laptops).  In certain instances where termination occurs amicably, further access may be allowed for a specified period of time for the ex-employee.  Though this practice is not recommended, should a business feel that it is appropriate, it would be wise to monitor this user’s access heavily to ensure safety of proprietary information and critical system or data files. 

7.  Audit, audit, audit!
Auditing is possibly the most valuable prevention and detection method regarding insider threat.  Any signs of misappropriation of information can be seen through the proper auditing tool, if used well. 

Any good auditing tool should be able to monitor file/folder/directory access and manipulation, changes to user privileges or group policy changes, USB storage device downloads, logons and logoffs, including failed logon attempts, and native event logs.

Reporting capabilities are important to an auditing tool.  Windows logs can provide most information necessary to discover illegitimate activity; however, the logs are cryptic and take a lot of time and resources to cull pertinent data into a sensible report manually.  Auditing tools should provide reporting that is clear, concise, and easily readable.

Real time alerts are quite useful when configured to alert the appropriate party to certain actions that would require immediate attention.  They should be able to be sent to any number of parties, and different parties depending on the incident being reported.

If all of these steps are practiced, your risk of insider threat will be dramatically decreased.  Don’t forget, as William Osler once said, that, “The search for static security – in the law and elsewhere – is misguided.  The fact is security can only be achieved through constant change, adapting old ideas that have outlived their usefulness to current facts.”  With these seven practices in mind and Mr. Osler’s words reminding us of the ever-changing state of information technology, we can proceed to protect our assets with intelligence and vigilance.