Slashdot Mirror
Has the Data Security Problem Become an Epidemic?
telstar asks: "Lately, it seems like an almost weekly occurrence: confidential customer data is exposed online, despite the assurance that security measures were in place to prevent such a problem. ChoicePoint Inc., LexisNexis, and DSW Inc. were all victims of online security breaches. Ameritrade and Bank of America both admitted lost physical data tapes containing confidential client account information. Recently, Carnegie Mellon notified 19,000 students, alumni, faculty and staff that their confidential information may have been compromised. An April 2005 GAO report found that though the IRS is making progress fixing security holes in systems that it operates, they aren't keeping pace with new vulnerabilities, risking exposure of sensitive financial data of the taxpaying population of the country. To top things off, these are only the cases that we're aware of, which begs the question of how many security breaches have gone unnoticed, or unannounced. What about companies like Google? As they expand their service offerings with GMail and Google Search History, where they are increasingly responsible for retaining client data, will they become a bigger target for attackers? This is the problem. What is the solution? Are there any tips for people to help protect their identity and confidential financial information? What firms go above and beyond the call of duty to ensure that their client data is secure?"
Write your state senators and legislators and urge adoption of california style laws that require companies to notify their customers if any private data is compromised.
Illinois does not have a law, and it should.
From what I understand, the main reason we're hearing more about these data intrusions is the California law now mandates such disclosures.
Unitarian Church: Freethinkers Congregate!
That said - the cracker population is getting significantly more sophisticated with more resources available to them (think a zombie network for solving distributed problems rather than simply launching a DDoS).
Online is a scary place to be isn't it ?
I have mod points and I am not afraid to use them
There's always going to be data compromise. One should be careful, and precautions should be kept in place but the long-term answer is that consumers will be protected like they are with credit card theft, the losses will become another background cost and you're going to have to live with the possibility that someone will know what movies you rent.
What I'm listening to now on Pandora...
Compare with people who watch Faux News: they're convinced that Osama is on the verge of attacking BFE, ND, and we're also winning the war in Iraq.
Yeah, right.
The word we were looking for was pandemic. Pandemic.
I imagine there will be some laws passed about this real-soon-now. Stuff like this doesn't happen over night, but as high profile cases hit the news with greater frequency it is only a matter of time before an influential senator or congressman gets inconvenienced by it and champions a bill.
I'm surprised the Homeland Security folks haven't done it themselves on the grounds terrorists will steal identities of US citizens to sneak in and get around.
As for a technological fix... unplug.
As I read in some article a few weeks ago (not sure if it was /. or not), if companies made their authentication processes more stringent, data like SSN's and names and addresses wouldn't be so valuable any more. The problem is that you can get access to so many things with just basic contact info and a SSN.
"That is the saving grace of humor, if you fail no one is laughing at you." -A. Whitney Brown
This is just speculation, but I believe a lot of these new warnings are the result of California's new law forcing disclosure of these events. I'd venture that it was probably happening before, but they just kept quiet about it. And if someone doesn't conduct business in California, you still won't know until it's too late.
On the other hand, some of these may be cases where the *potential* exists that someone accessed your data, but really didn't, but the company is covering it's ass.
Some of these attacks could be mitigated if these companies encrypted their backups before they go off-site (which they should already be doing anyway).
Whoops, posted anonymously...
This is just speculation, but I believe a lot of these new warnings are the result of California's new law forcing disclosure of these events. I'd venture that it was probably happening before, but they just kept quiet about it. And if someone doesn't conduct business in California, you still won't know until it's too late.
On the other hand, some of these may be cases where the *potential* exists that someone accessed your data, but really didn't, but the company is covering it's ass.
Some of these attacks could be mitigated if these companies encrypted their backups before they go off-site (which they should already be doing anyway).
This was in the Boston Globe as well as The Washington times today. The govenor of the state and many celebritie's driving records were publicly available, such as Jay Leno's. Massachusetts closes personal data hole
SA Article on Web Accelerator Flaw
I love Google as much as anyone else here, but this definately points out that even the geniuses at Google can make mistakes, and this is just a tiny look at what can happen with those mistakes.
I hope Google is able to fix this or pulls the web accelerator.
~Rebecca
Look, I know this is OT, but I see this so often it's starting to cause me physical pain.
To top things off, these are only the cases that we're aware of, which begs the question of how many security breaches have gone unnoticed, or unannounced.
The circumstances may "raise" or "prompt" a question, but it doesn't "beg" a question. "Begging the question" is a logically fallacious practice in which one assumes one's conclusion, making a circular logic. (eg. claiming the Bible is the inerrant word of God because it says so) It has nothing to do with speculation.
vk.
The biggest reason that these releases of confidential data cause harm is that practically every piece of information that exists in a corporate database about an american citizen or resident alien is keyed to the SSN, and the SSN is used as an authenticator. If it weren't for this, the mere fact that someone got a copy of your bank records would be annoying, but not particularly worrisome.
I don't particularly *want* a copy of my college transcripts roaming the Internet, but the main problem with them roaming the Internet comes if they have my SSN on them (they probably do). An identity thief can use this information in combination with other public information to apply for credit in my name, change addresses on accounts, et cetera.
So yes, by all means, write your senator. Ask him or (if you live in NY) her to do something about the SSN mess. Of course, probably what they'll do is propose legislation to start a national identity card or something stupid like that. And then there will be a big protest to stop that. So nothing will happen. Repeat until dispossessed.
Once all your stuff has been stolen, you won't have to worry about it anymore. Go pitch your tent someplace that stays warm in the winter, make sure there's water nearby, and learn how to live on mesquite meal and cactus fruit. Life under the stars will seem like heaven.
When you have 100 times more servers and users, you'll probably have ~100 times more problems and security breaches.
It hasn't "become" an epidemic, it always "has been" one. Thank goodness for California, or most people would never know.
1) Our Data : an appeal - a "Plimsoll line" for computer security:
2) Twelve Step TrustABLE IT : VLSBs in VDNZs From TBAs: 3) Do you want the Good or Bad news first? .Comment removed based on user account deletion
One thing I don't understand is why our personal information has to be accessable to the entire world...ie, exposed to the Internet. It should be treated as any other item of high value and locked up or kept away from the public. A company doesn't keep their stock certificates or other valuables in the lobbies of their branch offices, so why should our data be "available" to the public? Why not just keep the computers that hold all this information on a separate network...one that is not connected to the outside world? Keep it guarded in a completely closed network and then workers can have a separate computer and network to interact with the rest of the Internet world.
"He uses statistics as a drunken man uses lampposts...for support rather than illumination." - Andrew Lang
http://webaccelerator.google.com/
To reduce the identity theft immensely, one or more of the following MUST be legislated:
1. Replace the SSN with SecureID card with challenge keypad (none of those biometric foo-foo crap, bio is non-revokable)
2. Make data aggregation illegal (ooooh, sorry credit bureaus)
3. Make IRS the focal point of multi-keyed 2nd-generation SSN registration centre (sorry SSA, you screwed up, big-time!)
4. Customer "optionally" generate a NEW SSN for each business or financial institutions. (remember, data aggregation should be illegal)
5. Credit Bureau would function just fine (just a bit laggard with aggregation effort).
Once imposed, identity theft would (I guarantee this) be reduced to insignificant amount.
UNTIL THEN, nothing is currently being done to reduce the water flow from the Dutch Boy's leaking dikes.
It doesn't take much brain to resolve this crisis, just time and money. The Congress has absolutely no clue on how to fix this mess... Write your congressman today with these suggestions.
The other day, the wonderful community college which I acquired my near worthless associates degree from, sent an email to just about all the people in my graduating class. Not a problem you may think, but consider this..
THEY PUT EVERYONE'S EMAIL, IN THE TO: LINE.
I (as well as every other fellow student) now have a full listing of all my fellow student's names and email addresses..
Oddly enough, this school has a "networking" course, hello security.
Dedicated private networks cost money. Money that most companies will not spend unless someone is holding a gun to their head. The problem with security is that often the risks and costs of improper disclosures are dumped on third parties, not the people who were responsible for the security breach.
Mea navis aericumbens anguillis abundat
It was more interesting when I saw it here. Going for karma, or what?
I just went to a very interesting panel discussion about just this very subject, hosted by hosted by the Center for American Progress (http://www.americanprogress.org). It featured some very insightful comments from the very knowledgeable James X. Dempsey of the Center for Democracy and Technology.
Video transcripts are also available (here)
According to an article I remember reading on WindowsSecurity.com, only 0.1% of companies are spending the appropriate budget on Intrusion Detection Systems.
Does anyone need to keep your data such as Credit card No etc after payment has been accepted ?
which is worse losing 3 months customer data , or 3 years ?
Type unto others as you would have them type unto you.
I used to work for a company that did not take customer information seriously. They handled social security numbers and medical information.
Training employees was nonexistant. Physical security of the machines was minimal. Many HIPAA violations. The longer I worked there, the more violations I would see... like plain text transmission of SS# via email or web apps on remote systems - which is why I jumped ship when nobody thought it was a bad idea and wouldn't change.
The only thing that would change is for the Feds to take on the laws CA did... forcing the offending company that leaked the ID information to pay for all damages. It would either scare companies into taking things seriously or shut them down after a couple of screw ups.
What about employee data loss. Iron Mountain lost the backup tapes of Time Warner and data on every employee for the last 15 years, including SSN!!! Employees should have the same protections/requirements to be informed as customers. They are offering credit monitoring for a year, because everyone's SSN changes after a year of course(sarcasm included) Not that /. Would care, tried submitting it and it gets rejected!
Linux Works
to those who have had there personal information stolen
and a ten thousand dollar fine per client paid immediately by the company to the individual whose information has been lifted regardless of the means by which it has been hacked or is guilty or letting personel information leak out by other means.
Afterwards companies would not keep the personel information unless it has a value (at least ten grand) to their business model and is worth protecting otherwise keeping it would be a liability.
Posessing the data is a good part of the problem. Companies are allowed to callect and aggregate information about us, without our knowledge or permission, and then use that data in promoting their interests, which, as we've seen, can easily compromise our interests. When I say compromise, I'm not talking about a minor inconvenience- I'm talking about a life-chenging event that can take years to resolve, with no guarantee that it will be resolved.
The I question think we should be asking is this: why are others being allowed to put us at risk like this?
Why do you think Symantec made the move to buy/merge with Veritas. At face value, it seems to be an odd pairing. The end goal of computer security is to protect data. The end goal of backup solutions is to protect data.
There really ought to be a reverse contract that when you give away your confidential information to (for example) a bank, THEY have to sign it. By this contract, the little guy should be protected from confidential-information-loss (CIL) due to poor security in institutions that have always insisted on having your private information on file. Not sure what the fine should be... how about no usage-charges for the ATM? More?