Transparency is usually considered a good thing. But when it means your company is an open book, it’s gone too far.
Unfortunately, some companies are making far too much of their information visible to the world without realizing it. Clean laundry, dirty laundry – the works.
One of these instances came to light recently when vpnMentor, a firm that bills itself as an “ethical hacking group,” discovered an alarming lack of e-mail protection and encryption during a web-mapping project regarding an international piping, valve and fitting manufacturing organization.
I’m going to shield the name of the company in the interest of “discretion being the better part of valor,” but the company’s data that was found to be visible is amazingly broad and deep. Reportedly it included:
Project bids
Product prices and price quotations
Discussions concerning suppliers, clients, projects and internal matters
Names of employees and clients
Internal e-mail addresses from various branch offices
Employee IDs
External/client e-mail addresses, full names and phone numbers
Information on company operations
Travel arrangements
Private conversations
Personal e-mails received via company e-mail addresses
Basically, this company’s entire business activities are laid out for the world to see.
The vpnMentor research team was able to view the firm’s “confidential” e-mail communications. Amusingly, the team saw its own e-mails it had sent to the firm warning about the security breach (that the company never answered).
“The most absurd part is that we not only know that they received an e-mail from one of the journalists we work with, alerting them to the leak in this report, but we [also] know they trashed it,” as one of the team members noted.
The company in question isn’t some small, inconsequential entity. It operates in 18 countries including the biggies like Germany, France, Germany, the United States, Canada and Brazil. So the implications are wide-ranging, not just for the company in question but also for everyone with which they do business.
The inevitable advice from vpnMentor to other companies out there:
“Review your security protocols internally and those of any third-party apps and contractors you use. Make sure that any online platform you integrate into your operations follows the strictest data security guidelines.”
Are you aware of any security breaches that have happened with other companies that are as potentially far-reaching as this one? It may be hard to top this particular example, but if you have examples that are worth sharing, I’m sure we’d all find them interesting to to hear.
Perhaps it’s the rash of daily reports about data breaches. Or the one-too-many compromises of protection of people’s passwords.
Whatever the cause, it appears that Americans are becoming increasingly interested in the use of biometrics to verify personal identity or to enable payments.
And the credit card industry has taken notice. Biometrics – the descriptive term for body measurements and calculations – is becoming more prevalent as a means to authenticate identity and enable proper access and control of accounts.
A recent survey of ~1,000 American adult consumers, conducted in Fall 2017 by AYTM Marketing Research for VISA, revealed that two-thirds of the respondents are now familiar with biometrics.
What’s more, for those who understand what biometrics entails, more than 85% of the survey’s respondents expressed interest in their use for identity authentication.
About half of the respondents think that adopting biometrics would be more secure than using PIN numbers or passwords. Even more significantly, ~70% think that biometrics would make authentication faster and easier – whether it be done via voice recognition or by fingerprint recognition.
Interestingly, the view that biometrics are “easier” than traditional methods appears to be the case despite the fact that fewer than one-third of the survey respondents use unique passwords for each of their accounts.
As a person who does use unique passwords for my various accounts – and who has the usual “challenges” managing so many different ones – I would have thought that people who use only a few passwords might find traditional methods of authentication relatively easy to manage. Despite this, the “new world” of biometrics seems like a good bet for many of these people.
That stated, it’s also true that people are understandably skittish about ID theft in general. To illustrate, about half of the respondents in the AYTM survey expressed concerns about the risk of a security breach of biometric data – in other words, that the very biometric information used to authenticate a person could be nabbed by others who could use it the data for nefarious purposes.
And lastly, a goodly percentage of “Doubting Thomases” question whether biometric authentication will work properly – or even if it does work, whether it might require multiple attempts to do so.
In other words, it may end up being “déjà vu all over again” with this topic …
For an executive summary of the AYTM research findings, click or tap here.
It’s common knowledge by now that the data breach at credit reporting company Equifax earlier this year affected more than 140 million Americans. I don’t know about you personally, but in my immediate family, it’s running about 40% of us who have been impacted.
And as it turns out, the breach occurred because one of the biggest companies in the world — an enterprise that’s charged with collecting, holding and securing the sensitive personal and financial data of hundreds of millions of people — was woefully ill-prepared to protect any of it.
How ill-prepared? The more you dig around, the worse it appears.
Since my brother, Nelson Nones, works every day with data and systems security issues in his dealings with large multinational companies the world over, I asked him for his thoughts and perspectives on the Equifax situation.
What he reported back to me is a cautionary tale for anyone in business today – whether you’re working in a big or small company. Nelson’s comments are presented below:
Background … and What Happened
According to Wikipedia, “Equifax Inc. is a consumer credit reporting agency. Equifax collects and aggregates information on over 800 million individual consumers and more than 88 million businesses worldwide.”
Founded in 1899, Equifax is one of the largest credit risk assessment companies in the world. Last year it reported having more than 9,500 employees, turnover of $3.1 billion, and a net income of $488.1 million.
On September 8, 2017, Equifax announced a data breach potentially impacting 143 million U.S. consumers, plus anywhere from 400,000 to 44 million British residents. The breach was a theft carried out by unknown cyber-criminals between mid-May 2017 until July 29, 2017, which is when Equifax first discovered it.
It took another 4 days — until August 2, 2017 — for Equifax to engage a cybersecurity firm to investigate the breach.
Equifax has since confirmed that the cyber-criminals exploited a vulnerability of Apache Struts, which is an open-source model-view-controller (MVC) framework for developing web applications in the Java programming language.
The specific vulnerability, CVE-2017-5638, was disclosed by Apache in March 2017, but Equifax had not applied the patch for this vulnerability before the attack began in mid-May 2017.
The workaround recommended by Apache back in March consists of a mere 27 lines of code to implement a Servlet filter which would validate Content-Type and throw away requests with suspicious values not matching multipart/form-data. Without this workaround or the patch, it was possible to perform Remote Code Execution through a REST API using malicious Content-Type values.
Subsequently, on September 12, 2017, it was reported that a company “online portal designed to let Equifax employees in Argentina manage credit report disputes from consumers in that country was wide open, protected [sic] by perhaps the most easy-to-guess password combination ever: ‘admin/admin’ … anyone authenticated with the ‘admin/admin’ username and password could … add, modify or delete user accounts on the system.”
Existing user passwords were masked, but:
“… all one needed to do in order to view [a] password was to right-click on the employee’s profile page and select ‘view source’. A review of those accounts shows all employee passwords were the same as each user’s username. Worse still, each employee’s username appears to be nothing more than their last name, or a combination of their first initial and last name. In other words, if you knew an Equifax Argentina employee’s last name, you also could work out their password for this credit dispute portal quite easily.”
The reporter who broke this story contacted Equifax and was referred to their attorneys, who later confirmed that the Argentine portal “was disabled and that Equifax is investigating how this may have happened.”
The Immediate Impact on Equifax’s Business
In the wake of these revelations, Equifax shares fell sharply: 15% on September 8, 2017, reducing market capitalization (shareholder value) by $3.97 billion in a single trading day.
Over the next 5 trading days, shares fell another 24%, reducing shareholder value by another $5.4 billion.
What this means is that the cost of the breach, measured in shareholder value lost by the close of business on September 15, 2017 (6 business days), was $9.37 billion – which is equivalent to the entire economic output of the country of Norway over a similar time span.
This also works out to losses of $347 million per line of code that Equifax could have avoided had it deployed the Apache Struts workaround back in March 2017.
The company’s Chief Information Officer and Chief Security Officer also “retired” on September 15, 2017.
Multiple lawsuits have been filed against Equifax. The largest is seeking $70 billion in damages sustained by affected consumers. This is more than ten times the company’s assets in 2016, and nearly three times the company’s market capitalization just before the breach was announced.
The Long-Term Impact on Equifax’s Brand
This is yet to be determined … but it’s more than likely the company will never fully recover its reputation. (Just ask Target Corporation about this.)
Takeaway Points for Other Companies
If something like this could happen at Equifax — where securely keeping the private information of consumers is the lifeblood of the business — one can only imagine the thousands of organizations and millions of web applications out there which are just as vulnerable (if not as vital), and which could possibly destroy the entire enterprise if compromised.
At most of the companies I’ve worked with over the past decade, web application development and support takes a back seat in terms of budgets and oversight compared to so-called “core” systems like SAP ERP. That’s because the footprint of each web application is typically small compared to “core” systems.
Of necessity, due to budget and staffing constraints at the Corporate IT level, business units have haphazardly built out and deployed a proliferation of web applications — often “on the cheap” — to address specific and sundry tactical business needs.
“Kid’s Day” at Equifax’s Argentine offices. Were the kids in command there, one is tempted to wonder …
I strongly suspect the Equifax portal for managing credit report disputes in Argentina — surely a backwater business unit within the greater Equifax organization — was one of those.
If I were a CIO or Chief Security Officer right now, I’d either have my head in the sand, or I’d be facing a choice. I could start identifying and combing through the dozens or hundreds of web applications currently running in my enterprise (each likely to be architecturally and operationally different from the others) to find and patch all the vulnerabilities. Or I could throw them all out, replacing them with a highly secure and centrally-maintainable web application platform — several of which have been developed, field-tested, and are readily available for use.
__________________________
So, there you have it from someone who’s “in the arena” of risk management every day. To all the CEOs, CIOs and CROs out there, here’s your wakeup call: Equifax is the tip of the spear. It’s no longer a question of “if,” but “when” your company is going to be attacked.
And when that attack happens, what’s the likelihood you’ll be able to repel it?
… Or maybe it’ll be the perfect excuse to make an unforeseen “early retirement decision” and call it a day.
__________________________
Update (9/25/17): And just like clockwork, another major corporation ‘fesses up to a major data breach — Deloitte — equally problematic for its customers.
I’m sure we aren’t the only family who’s had to suffer through the aftershocks of Target’s infamous Great Thanksgiving Weekend Data Breach that occurred in late 2013.
According to news reports, as many as 40 million Target credit cards were exposed to fraud by the data breach. And as it turns out, the initial reports of nefarious doings were just the beginning.
Even after being given a new credit card number, my family has had to endure seemingly endless rounds of “collateral damage” for more than a year since, as Target’s very skittish credit card unit staff members have placed card-holds at the drop of a hat … initiated phone calls to us at all hours of the day … and asked for confirmations (and reconfirmations) of merchandise charges.
Often, these unwelcome communications have occurred on out-of-town trips or whenever someone in the family has attempted to make an innocuous online purchase from a vendor based overseas.
It’s been altogether rather icky — in addition to being a royal pain in the you-know-where.
But our experience has hardly been unique. Consider these scary figures when it comes to data breaches that are happening with businesses:
On average, it takes nearly 100 days to detect a data breach at financial firms.
It takes nearly 200 days to do so at retail establishments.
Those unwelcome stats come to us courtesy of a multi-country survey of ~1,500 IT professionals in the retail and financial sectors. The study was conducted by the Ponemon Institute on behalf of network security and software firm Arbor Networks.
The next piece of unsettling news is that, even with the long “dwell” times of these data breaches, the IT professionals surveyed aren’t optimistic at all that the situation will improve over the coming year. (Nearly 60% of those working in the financial sector aren’t optimistic, as do a whopping ~70% in retail.)
It’s doubly concerning because companies in these sectors are such obvious targets for hack attacks. The reason is simple: The amount and degree of customer data stored by companies in these sectors is highly valuable on the black market — thereby commanding high prices.
It makes it all the more lucrative for unscrupulous people to make relentless attempts to hack into the systems and extract whatever data they can. IT respondents at ~83% of the financial companies reported that they suffer more than 50 such attacks in a given month, as do respondents at ~44% of the retail firms.
The impact on companies isn’t trivial, either. Another study released jointly just last week by Ponemon and IBM, based on an evaluation of ~350 companies worldwide, finds that the average data breach costs nearly $160 for each lost or stolen record. And that’s up over 6% from a year ago. (The Target breach cost substantially more on a per-record basis, incidentally. And for healthcare organizations, the average cost is well over $350 per record.)
What can be done to stem the endless flood of data breach attacks? The respondents to this survey put the most faith in technology that monitors networks and traffic to stop or at least minimize these so-called advanced persistent threats (APTs). More companies have been implementing formalized incident response procedures, too.
As Dr. Larry Ponemon, chairman of the Ponemon Institute has stated, “The time to detect an advanced threat is far too long; attackers are getting in and staying long enough that the damage caused is often irreparable.”
Clearly, more investment in security tools and operations would be advisable.
When it comes to cyber-security, high-visibility data breaches get all the press, which is understandable.
But small businesses are also victims of cyber-attacks. And sometimes those events can be financially devastating.
Now a newly published survey quantifies the extent to which small businesses are at risk. The National Small Business Association polled nearly 850 U.S. small business owners (most with annual revenues between $500,000 and $25 million) in August 2013). The NSBA survey found that nearly 45% of the respondents’ businesses had been the victim of cyber attacks such as malware, spyware or banking Trojans.
The average cost of these cyber attacks was reportedly nearly $9,000 – with some dollar amounts going much higher.
Separately, another study shows that a record number of cyber attacks targeted small businesses in 2012. Verizon’s Data Breach Investigations Report examined 855 data breaches and found that over 70% of them involved victim companies with fewer than 100 employees.
Verizon’s 2013 report is showing a continuing increase in cyber attacks on small business, meaning that 2012 was no fluke.
What’s going on here?
According to the Verizon study’s conclusions as well as comments from security experts like Vikas Bhatia, small and medium-sized businesses could be doing a better job of “offensive defense.”
Among the mistakes commonly observed in small businesses are these:
Lack of conducting regular backups of business data
Neglecting to store backed up data offsite
Failing to test data restore functions on a periodic basis
Neglecting to keep antivirus software up to date, including software patches and updates
Practicing sloppy password protection behaviors (using plain-language passwords … using identical passwords across multiple accounts, etc.)
Not understanding cloud-based data storage and what outsourced providers’ liabilities are (and are not) for protecting data
There’s no question that cyber-security continues to be a big challenge – and probably a growing one – for many companies.
But it’s also pretty evident that many businesses could be doing more to protect themselves from the heartburn (and financial fallout) along the way.
Unfortunately, some companies are making far too much of their information visible to the world without realizing it. Clean laundry, dirty laundry – the works.
Nones Notes 