Data Protection & Privacy: Data Breach in Greece

Greek Man Accused of Stealing Data of 9 Million Citizens

Greece is in news again, for all wrong reasons. This time it is not the ever failing economy or bailout plans from one more country or authority. A Greek man has been arrested on suspicion of having stolen 9 million personal data filesin what is believed to be the biggest breach of private information the country has ever seen. The 35-year-old accused was found in possession of the data files that included identity card details, tax numbers, vehicle license plate numbers and home addresses.

General legal framework  in Greece

Personal data processing and protection in Greece is mainly regulated by Law 2472/1997 known as the Data Protection Act (DPA), implementing Directive 95/46/EC. The DPA regulates the automatic or manual processing of data relating to living identifiable individuals in connection with the provision of electronic communications, which are not publicly available. The DPA sets forth the basic terms and conditions relating to data collection and processing, imposes fundamental obligations on data controllers regarding all categories of data-related activities. The DP Authority receives complaints and have been levying penalties on data breach complaints received.

What abets the crime?

Interestingly, data breaches were observed in increased  proportion across the Globe during the years of recession and economic slowdown few years ago. Security experts warn that incidents of crime  are likely to increase during challenging economic times. There is  evidence from the large security monitoring networks showing that cyber crime attacks like phishing have already risen. With rising levels of uncertainty of employment &  negative growths in income, disgruntled employees might take sensitive data when they leave an organisation. Even for the honest worker, there is no guarantee, that he would return all assets like USB token and remember to erase entire company data from his personal devices. Further, with falling incomes, companies would try to cut all expenses, perhaps those on information security administration as well, in order to save few more pennies.

 What can be done?

Organisations should not see this as a case of ‘data loss’ alone,  and what they should remember is that the company’s reputation itself is at stake. In addition, don’t forget the penalties imposed due to Data Protection & Privacy Laws in force.  Organisations handling potentially sensitive data should not routinely invest in some data protection tools and gain false assurance, as these tools, despite having a positive role, suffer from many of the limitations of early intrusion detection and intrusion prevention systems like potentially high numbers of false positives and associated inconvenience to legitimate business users. In addition, these organisations should  invest sufficient time and effort in creating policies and practises – like access controls to key & critical applications, log management –  aimed at preventing data loss.

Educating the end-users  about their responsibilities to organisation and customer data, would be more effective than locking down USB ports or disallowing devices. The problem of data breaches is NOT just with the technology, as popularly perceived, and the solution lies more in focusing at the policies, processes and education. The returns on investment on these are more rewarding than on investments in technology.



Information Security Trends: Cloud, Mobility & Social Tools add complexity

 Cloud and Mobility Complicate Security

Cloud computing, mobility, social tools and other technologies that put mor e power in the hands of individual users pose new challenges for organizations seeking to secure data, devices and networks, new research released today by CompTIA, the non-profit association for the information technology (IT) industry, reveals.
This was the big take-home from the latest Information Security Trends study by Computing Technology Industry Association (CompTIA). Among the 308 security breaches reported by participants in the 10th annual study, 54% were caused by human error. Nearly half those errors (49%) were attributed to end-user failure to follow policy and procedure. The study is based on a survey of 508 IT and business and IT executives directly involved in setting or executing information security policies and processes for their organizations; and 368 executives at U.S. IT firms, with most having some level of involvement in the IT channel.

“As users gain more responsibility for their own technology, the human element becomes more and more important,” said Seth Robinson, director, technology analysis, CompTIA.

“There’s a growing need that we see to educate the end users and bring them up to speed with security awareness, and [increase] their knowledge of what an attack might look like,” said study author Seth Robinson. “Educating the end user really should be a bigger priority.”

cloud The message doesn’t seem to be getting through to the people in charge of enterprise security. About 60 % of survey respondents cited malware, such as viruses and Trojans, as a “serious concern.” Other types of security threats from the outside, namely hacking (54%), also outranked human error as major threats. Indeed, only 24% of respondents viewed end-user error as a “serious concern.” The respondents’ focus on external threats does not surprise Robinson. “It’s what they’ve been concerned about for years, and it informs how they’ve built and continue to build security defenses.”

Robinson attributes the  disconnect between resource allocation and rising internal threats to both stagnant budgets and an outdated understanding of what constitutes adequate end-user training. A basic run-through of security policies at the time of hire with a yearly refresher isn’t enough, he said. Today, the advice from top information security experts calls for training that is frequent and interactive. For example, Robinson said a simulated phishing attack among the workforce can be a useful training tool. IT can track the number of employees who click the link, and give those employees additional information security training to recognize that type of threat.

A net 49 percent of companies say they intend to hire security specialists, including those that also plan on training current staff.  Executives have a strong preference for security professionals with industry certifications. A full 84 percent said they experienced a positive return on investment in security certifications,

cloudwith certified staff viewed as more valuable because of their proven expertise and ability to perform at a high level than non-certified staff. Putting employee security training in the hands of a security specialist — and off the to-do list of CIOs — is something experts

strongly advocate. Decisions about device and platform management and application access should be made by infrastructure and operations (I&O) teams. However, security experts should be the ones figuring out what threats their organizations face from different end-user access scenarios.

New ATM Fraud: Cash Claw Crimes

Banks in India, Beware !!

Yet another ATM fraud  hitting the headlines across the UK during the late November 2012. The trouble now is more physical, stopping the money being dispatched from ATM and  tricking the customers which invariably result in increasing disputes between the bank and its customers. The UK’s Dedicated Cheque and Plastic Crime Unit (DCPCU) said it had seen a big jump in the rise in the number of incidents of so-called “cash claw” fraud in recent months, and is warning the public to report any incidents.

UK’s Dailymail reported in detail  with images of ‘claws’ used to steal the money from ATMs. It was reported that the devices have been used at cash points across Britain, with 2,479 reported cases in the first half of 2012. Fraud losses through cash trapping and other ATM scams across the UK came to £29.3 million last year, according to Financial Fraud Action UK, although this is said to be dropping since chip and pin was introduced in 2004.

Problem for banks in India

With close to 100,000 ATMs, millions of uneducated users and emerging ground for technology frauds, India dubiously attracts fraudsters.  So far, we have not come across any such ‘claw’ frauds stealing money from ATM. Unfortunately for the bank customers in India, a new vulnerability emerged, thanks to the instructions of National Payment Corporation of India (NPCI) on withdrawing ATM cash retraction facility by March 31, 2012. Earlier, when the cash retraction method was in force, the money would be taken back into the ATM if the customer did not remove the cash within a specified amount of time (say 30 sec), thus virtually not giving scope to any ‘claw’ fraud. Now, in the absence of such defence if any ATM machine is “clawed”, then the money would neither be retracted nor the customer could take it.

The cash retraction facility has been withdrawn reportedly, to contain the ATM fraud cases by misusing retraction facility at many bank ATMs.  While the action could address a vulnerability, it has opened up another. While cash retraction facility misuse had impact on the banks, the ‘claw’ fraud  would impact the customers as in the bank’s records the money would be debited to the customer account.


Customer education and public awareness seem to be effective to a limited extent, as long as the ‘education’ is not counter-productive. In the UK, the Police have warned account holders to be vigilant, but many devices are impossible to spot. 

ATM designs, perhaps, need a revisit and with display of an alert on the screen and a transparent cash dispenser draw could help prevent this kind of exploitation of flaw.

More importantly, the banks and regulators should adopt a holistic approach, at least from the security point of view, while reviewing or withdrawing an existing control, to ensure the action would not result in another vulnerability. When it comes to security, golden rules have to be remembered, ALWAYS !!