Slashdot Mirror
Millions of Records Leaked From Huge US Corporate Database (zdnet.com)
Millions of records from a commercial corporate database have been leaked. ZDNet reports: The database, about 52 gigabytes in size, contains just under 33.7 million unique email addresses and other contact information from employees of thousands of companies, representing a large portion of the US corporate population. Dun & Bradstreet, a business services giant, confirmed that it owns the database, which it acquired as part of a 2015 deal to buy NetProspex for $125 million. The purchased database contains dozens of fields, some including personal information such as names, job titles and functions, work email addresses, and phone numbers. Other information includes more generic corporate and publicly sourced data, such as believed office location, the number of employees in the business unit, and other descriptions of the kind of industry the company falls into, such as advertising, legal, media and broadcasting, and telecoms.
Here's the solution.
This is the new norm, is the only "new" invulvaed.
$1 penalty per leaked / stolen record, imposed by the FTC/SEC/SSA/CFPB will quickly remedy this problem. As long as the value of private personal information is intangible, the value it will be assigned in companies' risk assessments and capital plans is $0.
But I guess that would be a burdensome regulation under our new regime.
Wonder if it will drive down the price of marketing data from other firms knowing that there is a set of data out there. It will go out of date eventually, but even old data can be good for updating.
"Imagination is more important than knowledge" - Einstein
"...more generic corporate and publicly sourced data, such as believed office location, the number of employees in the business unit, and other descriptions of the kind of industry the company falls into, such as advertising, legal, media and broadcasting, and telecoms."
The word you're looking for is 'client list' . (damn, that's 2 words)
I think your proposal highlights a flaw inherent with how leftists try to solve real-world problems.
You aren't thinking about how to solve the problem at hand.
You're just thinking about increasing costs related to the problem, without this actually helping in any meaningful way.
Yes, what you're proposing would be very burdensome.
All it does is make doing routine business far more expensive and difficult to do.
Worse, it encourages affected organizations to not disclose breaches, as they would face costly fines.
What is a non-leftist solution to this problem?
It's actually quite simple: just avoid storing all of this sort of data to begin with!
Data that don't exist or aren't stored can't be stolen.
It should be clear now that leftist-style regulations just don't help.
They inhibit the economy without actually addressing whatever problem they're supposed to solve.
In many cases they're extremely regressive, not only in that they don't accomplish anything useful, but in how they actually encourage and reward even more harmful behavior (like not disclosing breaches to avoid paying fines).
The real solution to problems like this is to avoid the environment and situations that allow the data theft to happen.
The solution surely doesn't involve yet more bureaucracy, regulations, fines, and other leftist-supported nonsense like those.
I get it, data leaks are bad. But what actually comes from this? Spam to random emails addresses? Doesnt that just happen anyway? You can scrape email addresses or even generate random ones a number of ways... the impact here doesnt seem that large.
Even the Ashley Madison hack. That 1 should have had a huge impact as it should have outed a lot of cheaters, possibly public figures as cheaters (and also possibly outing homosexuals). But what became of it?
These stories of leaked data keep becoming more common and everyone says its BAD and needs to be stopped. Im just looking for the backup for it actually causing some kind of harm.
Just remember; focus on the 'scary hackers' side of the story; not the 'the data were already aggregated and available, and presumably in use, well before the leak occurred' aspect.
As long as giant databases remain in respectable hands, no harm can come of them; so just worry about whether it was a nation-state actor or an 'advanced persistent threat'. Nothing else to see here.
> $1 penalty per leaked / stolen record
The average cost to a company that's breached is already well over $1 per record, so no that doesn't "quickly remedy this problem". It IS slowly getting things fixed. A lot of companies have a Chief Security Officer now, a C-suite executive responsible for security. That wasn't the case ten years ago.
The issue is, the likelihood of a major breach is low (for each conpany). People, including executives, aren't good at reasoning about unlikely events. On the other hand, insurance companies are very good at it. Risk assessment and risk reduction is their business and they've gotten quite good at it. Insurance companies created the fire code, UL labs, etc to reduce the risk of fire. They hold companies responsible for properly mitigating all kinds of risks, as a condition of issuing insurance. The cost of the insurance, which shows up on the balance sheet, is based on the risk-reduction methods that the insured uses. (Just like installing monitored fire and burglary alarms reduces the cost of your homeowners insurance). I think we'll see a major shift in information security when the insurance companies get more involved, requiring companies they insure to follow certain standards.
They told me all I had to do was change my password every month and use 2 factor authentication. How can this be happening?
10 years ago this stuff happened WAY too much. NOW? It is absolutely ridiculous. Apparently these companies don't value data that should be kept private. Companies like this, Yahoo, and others - shouldn't legally be allowed to exist.
I did a haveibeenpwned check against our domain name and a couple of fake email addresses showed up in the NetProspex leak. These were email addresses that have never existed. Plus, none of our actual email addresses were in the leak.
This may be a list of 33.7 million mostly fake or SPAM email addresses. Just sayin'.
From http://www.dnb.com/utility-pag...
"Data Security: Dun & Bradstreet applies appropriate technical, physical, and administrative Data security measures to protect Data against unauthorized access and disclosure."
Except when they don't....
Also, (farther down the page): "Dun & Bradstreet does not respond to Do Not Track Signals."
Just cruising through this digital world at 33 1/3 rpm...
If I were a thief, the thing I'd try attacking is the increasing use of federated identity, and hit those targets with everything I had...social engineering, zero-days, finding soft spots where cut-rate consulting firms left the door open, the works. In the new cloudy world of abstracted everything, companies are finding it easier to rely on a few identity providers..."log in using Facebook" and the like. In the Microsoft, Google and Amazon iterations of this (MS account, Azure AD, Google Account, Amazon Identity Management,) companies are using third parties to handle authentication to their resources (at least on the web.) This means that the identities are slowly being consolidated to a few providers on the corporate side. Anyone using Office 365 in an organization likely has their credentials synchronized up to Azure AD, for example, so they can use the web apps like Outlook and Skype.
OAuth and the like set up a very strong environment, but it's still just an identity database under the hood. Even if the provider has no idea what your password is, a hash of it is being stored somewhere...otherwise you wouldn't be able to authenticate. If anyone ever comes up with an easy way to break this, then everyone's going to be in for a round of password changes and free credit monitoring. Getting someone's corporate credentials gives thieves a lot more access than stealing one database.
Sounds like a great thing to have when starting a business
It can't be copyrighted, and it is not (any longer) private information either... Is there a torrent or something?
In Soviet Washington the swamp drains you.
See, when government agencies get hacked it's "well, government can't do ANYTHING right! See?" and when it's a private company, the response is "oh, yeah. Happens all the time. They really need to tighten up security...".
The purchased database contains dozens of fields, some including personal information such as names, job titles and functions, work email addresses, and phone numbers. Other information includes more generic corporate and publicly sourced data, such as believed office location, the number of employees in the business unit, and other descriptions of the kind of industry the company falls into, such as advertising, legal, media and broadcasting, and telecoms.
So... pretty much the exact same information you can get by viewing someone's LinkedIn profile?
The fire code is a leftist solution to the Problem of fire, it just adds cost but doesn't Prevent fire. The rational way to approach this is to just outlaw fire.
> > avoid storing all of this sort of data to begin with!
> Gawd what a stupid suggestion.
Based on my 20 years in information security, I'd say that's the very BEST suggestion to start with. Not only is it very effective, it's very COST EFFECTIVE. Twenty years ago, a great many companies used social security number as a handy identifier for people. Now we don't do that so much - there is no need to use SSN as a customer ID or employee ID, and there is great risk in doing that. So just don't store anybody's SSN, and you can never leak their SSN. The government agency I worked at before my current job was finishing up the process of removing SSNs from all databases when I left.
Companies who take payments by credit card only need the card number once, at the time of payment. Yet many of them kept the CC number laying around in a database for no good reason. Smart companies prevent big leaks of credit card numbers by simply not storing credit card numbers. Charge the card and be done with it - no need to store the number.
Or does slashfag just do clickbait now?
Is that the new synonym for Stolen?
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
Yet many of them kept the CC number laying around in a database for no good reason. Smart companies prevent big leaks of credit card numbers by simply not storing credit card numbers. Charge the card and be done with it - no need to store the number.
Wrong. Smart companies store tokenized forms of the CC number so that they can remove a hurdle to repeat business without bearing the risk of losing re-useable payment info.
What would the rightist approach be, then? Calling the fire "FAKE FIRE" and pretending it doesn't exist?
Dun & Bradstreet is one of the most scummy companies on earth. Other companies use D&B reports to determine what their competitors are doing. D&B spies on other organizations on behalf of those paying them money to spy. D&B will also go after individuals. While I'd like to hope that this leak sinks their ship into oblivion we all know that is probably not going to happen.
I've been the target of D&B before. I'd love to get my hands on that database to see who was behind it.
Sorry, you're still describing a leftist approach to it not a rightest.
If the "tokenized forms of the CC number" can be used to charge the card, it probably shouldn't be made public.
If many customers will legitimately want to do further purchases, and for some reason entering the CC number is a major hurdle (both propositions that should be proved, not assumed) you can actually store it without storing it, in a way.
Certain customers can make purchases from us without re-entering their CC, but the CC number isn't stored on the web server, nor in the database that drives the web site, nor in any other system that stores data to be retrieved by these systems. None of our customer-facing systems, or systems that allow data retrieval of any kind, store credit card data. Instead, credit card information is stored on an isolated system which only accepts commands and returns "ok" or "failed". All other systems in the company can only send a command "please charge the card for customer #312" - there is no mechanism to retrieve data from that system. So our database and systems in general don't store CC data or other sensitive information, but we can still use customer CCs because it's stored only in, and can be accessed only by, the one hardened system. So that's an extension of "don't store sensitive data you don't need to store - and don't sensitive data in systems you don't need to store it in".
The rightist approach would be to invent alternative facts. "That isn't a fire, it's a beautiful display of light. Remember the horrific napalm massacre on Bowling Green? Now *that* was a fire."
> There is no way to fully secure shared data. You can only mitigate as much risk as possible.
This is true. In our case, it's not in the cloud. It's a physical machine. An old machine worth about $30 because all it needs to do is store the encrypted data and when needed send it to the credit card network.
Orginally access was via the console only, you had to physically touch the keyboard to do anything on the system, with all ports blocked on the firewall. Later we enabled only ssh from the internal network. Of course to ssh you also habe to have an approved ssh key, then seperately you need the encryption key to unlock the credit card data.
For physical security, nobody goes into the server room without permission and most of our employees carry Glocks. At least one is a state licensed security officer (me). Once, a friend barged into the office - two employees drew their pistols before he made it to the door.
It's unlikely that anyone will get our customer's credit card information. Possible, but unlikely.