Lack of Security Policy behind Columbia’s BIGGEST breach

The reasons behind South Carolina Department of Revenue (DoR) data breach are more than shocking . All state agencies have some type of computer security system in place, but there is NO mandatory policy, standards, monitoring or enforcement for each of the approximately 100 state agencies, boards, commissions, colleges and universities that operate computers, the state’s inspector general says.


The Breach

The DOR breach, the biggest in the state’s history, exposed 3.6 million Social Security numbers, 387,000 mostly encrypted credit or debit card numbers and information belonging to more than 650,000 businesses. The agency’s computer system was breached four times, officials have said, and the data was exposed in September. The later reports push the numbers even high.
Impact

A former top official with the FBI said that if just 1 percent of the taxpayers and businesses whose information was hacked in September at the Revenue Department have their information misused it could cost them more than $350 million, based upon past FBI experience.


What caused it?

Apparently, they do NOT have an effective data security policy which is more than clear from the statement made by Senator Vincent Sheheen, who narrated the entire episode a week ago – “when a group of us simply asked the Administration and the Department for a copy of the DOR data security policy so we could better understand what went so terribly wrong, we got this – an answer you would expect in a third world banana republic- we were essentially told that they couldn’t tell us the policy that had failed so badly because it might “further compromise” security. I would have laughed if it hadn’t made me want to cry”
The state had two main vulnerabilities. There was no dual verification required to get into the system and the social security data had no encryption. Interestingly, Internal Revenue Service (IRS), does not mandate the data encryption.The IRS is the revenue service of the United States federal government. The agency is a bureau of the Department of the Treasury, and is under the immediate direction of the Commissioner of Internal Revenue. The IRS is responsible for collecting taxes and the interpretation and enforcement of the Internal Revenue Code.

Two simple concepts of information security were ignored here:

1. ‘Need based access’ – violated and no additional authentication !! All users have access to all stuff kind of access controls was implemented.

2. ‘No data encryption’ rules were enforced for critical data as it is not mandated. Compliance took front seat and not a risk based threat assessment.


Few questions?

  1. Why the top management view of information technology is so inadequate? 
  2. What happened to the IT Governance, in the US Government? 
  3. Why the compliance standards could not be applied to a public body? 
  4. What happened to the concurrent or statutory IT Audit? 
  5. Why risk assessments could not prevent this, if conducted?and many more questions .. that remain unanswered !


Advertisements

In 2013 Cyber Conflicts become the norm: Symantec predicts

Symantec released its 5 most important security threat expectations of the  year 2013. Symantec claims that these predictions are based on their expertise, “understanding of threat evolution” as well as “experience in previous cybersecurity trends”.  Symantec Corporation is an American global computer security software corporation headquartered in Mountain View, California.

The threat expectations for 2013 and beyond go like this – 

Cyber conflict becomes the norm among nations, organizations, and individuals. Espionage can be successful and easily deniable. Nation States, organizations and groups of individuals use cyber tactics to gain advantage over their opponents. The conflict is moving more and more on cyber assets from physical.




 
Ransomware is the new scareware: With online payment methods becoming omnipotent and omnipresent, criminals find it easy to extract money at anytime from anywhere!! Get ready for more professional ransom screens and methods. FBI keeps cautioning the users as more cases are already being reported.According to Kevin Haley, Director of Security Response at Symantec, during 2013, there’ll be increasing utilization of commercial ransom screens, exploitation of targets’ sentiments, along with utilization of techniques, which will make recovery more difficult following system compromise.


Madware adds to the insanity: Mobile adware or “madware” is a nuisance that disrupts the user experience and can potentially expose location details, contact information and device identifiers to cybercriminals.The past experience sees rapid growth in this menace, an increase of 210% in 9 months in 2012!! Free mobile apps are going to contribute more aggressive and potentially malicious approach.


Monetization of social networks introduces new dangers – the growing social spending trend also provides cybercriminals with new ways to lay the groundwork for attack. Symantec anticipates an increase in malware attacks that steal payment credentials in social networks and trick users into providing payment details, and other personal and potentially valuable information, to fake social networks.


As users shift to mobile and cloud, so will attackers – Symantec claims that mobile platforms and cloud services will be likely targets for attacks and breaches in 2013. The rapid rise of Android malware in 2012 confirms this. It is predicted that in 2013, mobile technology will continue to advance and thereby create new opportunities for cybercriminals.

 

Wrong use of devices in corporate networks that utilize clouds will witness growing danger of personalized assaults and breaches into the devices’ data, the security firm explains.

The threats could be more alrming to India. Identity fraud is turning out be as a major concern in India with the growing number of Internet, social media and internet users through mobile phone devices.

A recent Symantec report stated, of the total 137 million Internet users in India, 42 million have fallen prey to the cyber fraud in one way or the other. The financial loss per cyber crime victim is around Rs 10,000 for 2012, as per Semantec.

While this list is more on expected lines considering the cyber crime trends being witnessed in the recent past. The key to the threat management lies in end-user education in protecting the online privacy, a more disciplined online behaviour and much better understanding of their smart phone.

In a lighter vein: 

On January 17, 2012, Symantec admitted to their network getting hacked. A hacker known as “Yama Tough” obtained Symantec’s source code by hacking an Indian Government server. Yama Tough has released parts of the source code, and has threatened to release more. 

Top IT Challenges & Audit: Protiviti Survey 2012

Information Security (including data privacy, storage and management) ranked #1 among the top technology challenges faced by organisations, according to 2012 IT Audit Benchmarking Survey conducted by Protiviti, a global consulting firm operating in over 20 countries. Protiviti conducted the survey at the end of September 2012 with 1,000 people from companies with 100+ employees.

Cloud computing, social media, risk management & governance and regulatory compliance followed the list of top technology challenges.

IT Audit

The survey hints that a large of number of organizations may be understaffed in terms of IT Audit capabilities in their internal audit functions. Organizations are meeting this gap with guest auditors, co-source providers and outsource IT audit function. 


While the survey indicates a significant gap in the IT audit capabilities of many organizations, 48% of small companies are  not using any outside resources, clearly indicating  that these organizations lack necessary skills and resources to manage IT risk. 

 
In-house internal audit department lacking the specific skill sets seems to be the major reason for organizations using external resources to meet the IT audit requirements. 67% of the participants expressed this opinion, which stood at 62%  in 2011. This clearly indicates, the organizations are increasingly looking forward to avail the services of experienced and qualified IT auditors, while keeping the costs low.
 
Considering the fact that a significant number of companies have limited or no resources devoted to IT Audit,   the survey concludes that a number of  organizations are not in compliance with Standard 1210.A3 stipulated by the IIA. 

IIA Standard 1210.A3  Internal auditors must have sufficient knowledge of key information technology risks and controls and available technology-based audit techniques to perform their assigned work. However, not all internal auditors are expected to have the expertise of an internal auditor whose primary responsibility is information technology auditing.

 IT Audit Risk Assessment

Considering the pace of technology proliferation in organizations IT implementation and business models as well as the changing threat scope in general, IT audit risk assessment needs to be carried out on an ongoing process and at least in a quarter. Interestingly, only 13% of the organizations are conducting the risk assessment at this frequency and as many as 65% of the organizations conduct at annual intervals !! This clearly indicates,  majority of organizations are NOT keeping pace with the rate of technology change, emerging new threats and innovations in the organizations.

Frameworks

On a positive note, 86% of the organizations adopted a framework to based their IT Audit Risk Assessments with COBIT (63%) and COSO (43%) leading the list.

IT Governance

The survey tested the organizations’ IT Governance processes as against the IIA standard to ensure the internal audit function assesses whether the IT Governance sustains and supports organization’s business strategy and objectives.

IIA Standard 2110.A2 – The internal audit activity must assess whether the information technology governance of the organization supports the organization’s strategies and objectives.

Unfortunately, responses from about three fourths of the organizations indicate that IT Governance process is NOT a priority.

The survey also covered other aspects like training, gaps in audit plan and can be accessed  from http://www.protiviti.com/en-US/Documents/Surveys/2012-IT-Audit-Benchmarking-Survey-Protiviti.pdf