Slashdot Mirror
Millions of Records Leaked From Huge US Corporate Database (zdnet.com)
Millions of records from a commercial corporate database have been leaked. ZDNet reports: The database, about 52 gigabytes in size, contains just under 33.7 million unique email addresses and other contact information from employees of thousands of companies, representing a large portion of the US corporate population. Dun & Bradstreet, a business services giant, confirmed that it owns the database, which it acquired as part of a 2015 deal to buy NetProspex for $125 million. The purchased database contains dozens of fields, some including personal information such as names, job titles and functions, work email addresses, and phone numbers. Other information includes more generic corporate and publicly sourced data, such as believed office location, the number of employees in the business unit, and other descriptions of the kind of industry the company falls into, such as advertising, legal, media and broadcasting, and telecoms.
> $1 penalty per leaked / stolen record
The average cost to a company that's breached is already well over $1 per record, so no that doesn't "quickly remedy this problem". It IS slowly getting things fixed. A lot of companies have a Chief Security Officer now, a C-suite executive responsible for security. That wasn't the case ten years ago.
The issue is, the likelihood of a major breach is low (for each conpany). People, including executives, aren't good at reasoning about unlikely events. On the other hand, insurance companies are very good at it. Risk assessment and risk reduction is their business and they've gotten quite good at it. Insurance companies created the fire code, UL labs, etc to reduce the risk of fire. They hold companies responsible for properly mitigating all kinds of risks, as a condition of issuing insurance. The cost of the insurance, which shows up on the balance sheet, is based on the risk-reduction methods that the insured uses. (Just like installing monitored fire and burglary alarms reduces the cost of your homeowners insurance). I think we'll see a major shift in information security when the insurance companies get more involved, requiring companies they insure to follow certain standards.
If I were a thief, the thing I'd try attacking is the increasing use of federated identity, and hit those targets with everything I had...social engineering, zero-days, finding soft spots where cut-rate consulting firms left the door open, the works. In the new cloudy world of abstracted everything, companies are finding it easier to rely on a few identity providers..."log in using Facebook" and the like. In the Microsoft, Google and Amazon iterations of this (MS account, Azure AD, Google Account, Amazon Identity Management,) companies are using third parties to handle authentication to their resources (at least on the web.) This means that the identities are slowly being consolidated to a few providers on the corporate side. Anyone using Office 365 in an organization likely has their credentials synchronized up to Azure AD, for example, so they can use the web apps like Outlook and Skype.
OAuth and the like set up a very strong environment, but it's still just an identity database under the hood. Even if the provider has no idea what your password is, a hash of it is being stored somewhere...otherwise you wouldn't be able to authenticate. If anyone ever comes up with an easy way to break this, then everyone's going to be in for a round of password changes and free credit monitoring. Getting someone's corporate credentials gives thieves a lot more access than stealing one database.