Blue Lance InfoSec Blog

Study Shows Cost of Canadian Data Breaches Skyrocketing

From a TELUS press release:

According to the study which surveyed more than 600 IT security professionals across the country:

• IT security breaches cost the average Canadian organization an estimated $834,000 in 2009 – a 97 percent increase from the $423,000 reported by the study last year.
• Similarly, the average number of reported IT security breaches also increased 276 per cent to 11.3 per organization in 2009 – compared with an average of three in 2008.

While every type of organization incurred an increase in breach costs during 2009, the increases were different across sectors:

• Government organizations more than tripled their average annual cost of breaches to $1,000,000 in 2009, up from $321,000 in 2008.
• Private companies more than doubled their cost of breaches to $807,000 up from $294,000 in 2008.
• Publicly traded companies reported a moderate increase of only six per cent year-over-year.

 “The significant increase in reported breaches is sobering, however there are several reasons for this activity and some of them are actually positive,” said Dr. Walid Hejazi, Professor of Business Economics, Rotman School of Management. “Our research indicates that one of the contributing factors behind the surge in IT security-related losses is compliance regulations. Although this factor does not explain all instances of breach increases, it is important to note that because compliance has become a much stronger driver for private companies and government organizations in 2009, capabilities to detect and respond to security compromises have greatly improved. The result is that organizations are now detecting more security threats than ever before and consequently need to allocate more budget to address them appropriately.”

“Canadian organizations are finding it difficult to improve their security posture within the current economic climate. However, we found several organizations that performed well despite the adversity. Those organizations tended to review whether or not they were focusing on the right threats and conducted regular assessments of their capabilities to prevent, detect and respond to security concerns,” said Alan Lefort, managing director, TELUS Security Labs. “Too often organizations take a checklist approach to managing security. Without a threat-based view to security management that measures end-to-end capabilities, they are often unprepared when a new type of attack or vulnerability rises to prominence.”

The study also uncovered a rise in employee-related security breaches specifically related to intellectual property. IT security breaches by employees doubled over the past 12 months, with 36 per cent of all IT security incidents in Canada resulting from insider activity. When compared to results from last year's Rotman-TELUS study, the results from 2009 revealed:

• Unauthorized access to information by employees increased by 112 per cent.
• Theft of proprietary information increased 75 per cent.
• Laptop or mobile hardware device theft increased by 56 per cent.

The 2009 Rotman-TELUS Joint Study on Canadian IT Security Practices study also uncovered
insights in several additional areas including:

• Canadian IT security budgets.
• Top security concerns.
• IT security professional salaries and compensation.
• Security governance.
• Security outsourcing.
• Cloud computing concerns.
• Security technology investments.

For more information, or to request a copy of the study, visit www.telus.com/securitystudy.

Another Inmate Hacks Prison System

Who is guarding these people?  In the case of Douglas Havard, the answer is nobody.  Havard, 27, an inmate of Ranby Prison, near Retford, Notts, is serving six years for stealing up to £6.5 million using forged credit cards over the internet.  He was approached after prison governors wanted to create an internal TV station but needed a special computer program written. 

Havard was left unguarded and hacked into the system's hard drive, then set up a series of passwords so no one else could get into the system.   He was put in segregation as punishment, but he left the system crippled.  A prison source said, "It's unbelievable that a criminal convicted of cyber-crime was allowed uncontrolled access to the hard drive. He set up such an elaborate array of passwords it took a specialist company to get it working."

A Prison Service spokesperson said the breach was being investigated, adding, "Prisoners are not allowed unsupervised access to computers. The prisoner was not able to access records of any other prisoners."

 

Update: Gmail Account Involved in Lawsuit Deactivated

A judge ruled on September 23rd that the Gmail account to which personally identifiable information was inadvertently sent must be deactivated.  The account, which was the recipient of an errant message from an employee of Rocky Mountain Bank, was mentioned in an earlier post regarding disclosure of the data breach.  The ruling also included a clause requiring Google to release the name of the account holder and his contact information to the bank.   The bank had contacted the account holder through the email address in question, but did not receive a response.

This unprecedented ruling is viewed as rather controversial in legal circles, because it can be considered an affront to the account holder’s First Amendment rights to communicate online, as well as privacy rights.

Risky Data Disposal Procedures at the Department of Defense

Proper procedures are found not to be in place at the Department of Defense regarding data disposal.  J. Nicholas Hoover for Information Week writes:

”In an evaluation of DoD internal controls and processes, the inspector general found that several military departments didn't properly delete data and fully account for unclassified equipment before releasing it to other federal agencies, schools, and non-profit organizations.”

The lack of proper procedures in place has left a lot of personally identifiable information at risk.  Read the full article on Information Week.

Gmail Error Lawsuit must Remain Public

A federal judge in San Jose, California denied Wyoming-based Rocky Mountain Bank's plea to prevent the disclosure of information about a data breach arising from an errant Gmail message.

The judge said in his ruling, "An attempt by a bank to shield information about an unauthorized disclosure of confidential customer information until it can determine whether or not that information has been further disclosed and/or misused does not constitute a compelling reason that overrides the public's common law right of access to court filings."

The bank seeks non-disclosure due to an email message sent in error to a Gmail subscriber that was intended for a bank customer.  The message that was sent contained an attachment including confidential customer information for 1,325 individual and business accounts, according to the court's summary of the case. The information sent allegedly includes names, addresses, tax identification numbers, and loan information.  It was only supposed to contain loan information for one of the bank’s clients. 

The judge has allowed the Gmail address of the accidental recipient of the bank's data to be redacted in court documents.

Insider Inmate Hacks Prison Computers

Francis G. Janosko, a former inmate of Plymouth County Correctional Facility, pled guilty in federal court today to charges of intentionally damaging the prison’s computer network during his incarceration. 

From 2006 to 2007, Janosko and other inmates had access to a restricted computer supplied to allow the inmates to research legal matters.  Janosko hacked the computer network to send e-mail; provide inmates access to a report that listed the names, dates of birth, Social Security numbers, home addresses and telephone numbers, and past employment history of over 1,100 current and former Plymouth County Correctional Facility personnel and applicants; and access (without success) to an important prison management computer program.

Sentencing is scheduled for December 15, 2009. Under the terms of the plea agreement, both parties will recommend a sentence of incarceration for 18 months, to be followed by 3 years of supervised release, and restitution to Plymouth County in an amount yet to be determined. Janosko had been free following his release from the Plymouth County Correctional Facility, but has been incarcerated since he was arrested again in November 2008.

Data Breach at MassMutual Discovered during Postal Inspection Service Investigation

Over 70 MassMutual clients’ personally identifiable information has been acquired by an unauthorized third party from an insider at the company.  According to a letter to the District Attorney of New Hampshire, where one affected client resides:

 “On August 3, 2009, MassMutual was advised, verbally and in writing, by Postal Inspector James Morrison of the U.S. Postal Inspection Service ("Service") that during the course of an identity theft investigation, the Service discovered documents containing the personal information of certain MassMutual customers in an envelope bearing MassMutual's logo. The Service advised that they had reason to believe that at least some of this personal infoD11ation had been used for fraudulent purposes. On August 5, 2009, the Service requested, verbally and in writing, that MassMutual delay notification to impacted individuals in order to prevent a compromise of the Service's investigation.
The documents recovered by the Service appear to be "screen prints" from one of MassMutual 's administrative platforms and such documents contained, among other things, individual customer: (i) first and last name; (ii) address, (iii) Social Security number; and (iv) what appear to be financial account number(s). Each screen print also contained a unique identifier for the MassMutual employee who had access to the system at the time the document was printed. All reviewed "screen prints" appear to have been generated by one individual, who left MassMutual 's employ in March of 2008.”

MassMutual sent breach notifications to all affected parties, and has conducted an internal review which found no suspect transactions on any of the affected individuals’ accounts.  At this time, no announcement has been made regarding charges against the perpetrator.

Privacy Breach at University of Florida

In August, the University of Florida Privacy Office was notified of a privacy breach after the discovery of an unprotected computer file containing 34 names and 25 Social Security numbers. The university believes that the personal information belongs to trainers working with the Florida Traffic and Bicycle Safety Education program in 2006. The file was immediately removed. The school has been unable to identify the individuals whose Social Security numbers appeared on the list.

The file in question was last modified in September 2006 and was managed by a program director, who retired in 2008. The new director of the program was unaware of the file’s existence. University of Florida information technicians discovered the file last month during a routine security check.
The University believes that the risk of anyone using the information for identity theft or other unlawful purposes is extremely low.

The university could not verify the current contact information for the trainers on the list.

Another DuPont Employee Steals Trade Secrets

Hong Meng, a top level DuPont research scientist working from the Wilmington, Delaware location, has been accused of stealing trade secrets.  Meng, a Chinese citizen with permanent U.S. residence status, was working on development of Organic Light Emitting Diode technology, or OLED, which would allow for ultrathin computer displays.

Without informing DuPont, Meng accepted a position at Peking University, his alma mater, while continuing to work for DuPont.  The position would be directly involved in research and development of OLED technology for China. 

While scheduled to transfer to a DuPont facility in China, Meng proceeded to download proprietary information relating to OLED trade secrets onto an external hard drive.  He also was found to have an illicit connection to Peking on his computer.  This was discovered by DuPont during a routine hard drive examination performed prior to any employee transfer.

After denying any wrongdoing, Meng admitted to possessing the information in question when presented with the evidence from his hard drive.  A subsequent search of his home computer found that he had been in communication with Peking University, and started a program at the school to commercialize OLED technology for industrial applications in “direct competition with DuPont” according to the lawsuit.
DuPont asked the court to issue a permanent injunction requiring Meng and those he worked with to return all misappropriated material, as well as prohibiting Meng from working with Peking University or with any other entity developing technologies that he worked on while at DuPont.  At present, investigation of Meng is continuing. 

The Rising Risk of Insider Threat, Two Ways

Rick Caccia writes for Computerworld on how to address two types of insider threats:

“‘I read about fraud all the time -- hackers, online gangs, angry employees, etc. It seems like it's on the rise. Why is this so hard to detect and how can we prevent fraud in our organization?’
It is true that fraud is increasing, and it does seem that we read about incidents on an almost daily basis. This is a factor of the rise in the amount of sensitive information that is now online, an increased number of online applications that access this information, and the growing number of users who use online services for financial services. The result is more opportunity for fraud, with less effort, so it's no surprise criminals have moved their activities online and that insider-led fraud is on the rise.”

Read the full article here.