jump to navigation

“Pleased to meet you…hope you guessed my name…” – Sophisticated CyberAttack hits US Dept of Energy February 4, 2013

Posted by Chris Mark in Uncategorized.
Tags: , , , , , , ,
add a comment

 

CT2013UPDATE: A new report released shows that Chinese military is involved in CyberAttacks.   Read the full story here and download the report.

Foxnews released an article today that outlines a sophisticated cyberattack targetting the US Dept of Energy.  Surprisingly, the suspect is China.  According to the story, the attack compromised the information of several hundred employees with the expected outcome to be to compromise more information .  According to the article:

“It’s a continuing story of negligence,” former Energy Department security official Ed McCallum told the Free Beacon, explaining that the department continues to have security problems despite controlling some of the most “sophisticated military and intelligence technology the country owns.” 

He said China, as well as Iran, have been after Energy Department secrets. Several groups and agencies have warned about stepped-up cyber activities out of China. 

“China continues to develop its capabilities in the cyber arena,” the U.S. China Economic and Security Review Commission said in a November 2012 report to Congress. “U.S. industry and a range of government and military targets face repeated exploitation attempts by Chinese hackers as do international organizations and nongovernmental groups including Chinese dissident groups, activists, religious organizations, rights groups, and media institutions.” 

Read more: http://www.foxnews.com/politics/2013/02/04/sophisticated-cyber-attack-hits-energy-department-china-possible-suspect/#ixzz2Jwn0Yycu

Beating an Old Drum October 27, 2012

Posted by Heather Mark in cybersecurity, Data Breach, Industry News, InfoSec & Privacy.
Tags: , , , , , , ,
add a comment

It’s the end of what has already been a tough year for data security.  And the news just got worse.  South Carolina has announced that its Department of Revenue suffered a major breach.  The breach is so massive, in fact that more than 75% of the state’s residents have been affected.  The compromised data consisted of the (unencrypted) social security numbers of more than 3.6 million residents.  Also included in the breach were about 390,000 payment cards.  Most of those were encrypted, though.

This is disturbing on a number of levels.  I find it curious, for example, that while encryption was deployed, it was only deployed on payment cards (and not even on all of those).  Consumers have built in protections on payment cards.  As long as those cards are branded by one of the major card brands, consumers are protected against liability for fraudulent transactions.  The far more sensitive data, the social security numbers, were not encrypted, though.  This defies logic.  Consumers have little to no protection against misuse of SSNs.  Not only can very real financial damage be done, consumers have to spend enormous resources (time, money, emotions) in untangling the identity theft knot that comes with stolen SSNs.

Secondly, in the wake of the breach, Governor Nikki Haley issued an executive order that read: “I hereby direct all cabinet agencies to immediately designate an information technology officer to cooperate with the State Inspector General who is authorized to make recommendations to improve information security policies and procedures in state agencies.”  WHAT?  If I’m inferring correctly, it seems that these agencies didn’t have an information technology officer already?? That is very troubling, particularly considering the types of data that state agencies hold.  After 3.6 million (out of about 4.7 million) residents have had their sensitive data stolen is not a great time to decide that data security and privacy should become priority.

Private sector organizations have been working for years to shore up their data security, and in some cases (PCI DSS, HIPAA/HITECH, GLBA, SOX, state laws) face real consequences for failure to protect that data.  It’s long past time states put forth the same level of protection.  On the plus side, the state did comply nicely with its own data breach notification law.

Mobile Privacy October 12, 2012

Posted by Heather Mark in InfoSec & Privacy, Laws and Leglslation, privacy.
Tags: , , , , ,
add a comment

Smartphones have changed the way we interact with our world.   They’ve introduced a new level of convenience, but they’ve also introduced a new potential threat to our privacy.    As consumers, we should be informed about the choices that we make on our smartphones and how they might impact us.  For example, I upgraded my iPhone to iOS 6 this afternoon. (I know. I’m a little late on that one.)  Anyway, when I was done I got two prompts.   The first asked if I wanted to enable location services.  I said yes, knowing that meant that 1) I could use the “find my phone” app, as well as many other apps that come in handy for a frequent traveler, and; 2) that it meant that Apple would have access to my location data.  The next prompt suggested that Apple could improve its products and services if I just allowed my phone to send occasional reports to headquarters.  That one I declined.  I don’t necessarily want Apple to have access to all of my activities on my smartphone.

Now, I’m not naive enough to believe that my simple selection means that I have safely secured my data and mobile behavior entirely.  There are companies that are taking advantage of the fact that privacy laws have not kept pace with technology.  We know for example, that there are companies that offer device fingerprinting services for fraud prevention that also happen to sell mobile device behavior analytics to marketers.  Consumers don’t have any way of knowing that their behavior is being tracked and they have no way to opt out.

This week, Sen. Franken (D-Minn) and Sen. Blumenthal (D-Conn) introduced a bill designed to protect mobile privacy.  The Location Privacy Protection Act of 2011 is meant to protect consumer privacy by informing users of how and with whom their location data is shared.  There are four primary requirements of the bill.  Distilled to their basics, those requirements are:

1) Gain consumer consent before collecting location data

2) Get consumer consent before sharing that data

3) Assist in understanding and investigating crimes that involve the misuse of location data

and

4) create criminal penalties for those that abuse location services or use so-called “stalking apps.”

While I applaud the move to ensure that mobile users are protected from entities divulging their location without the knowledge or consent of the consumer, I wonder if the law goes far enough in protecting consumer privacy.  What about those device fingerprinting activities?  Do you think the proposed bill goes far enough? Too far?  What would you like to see in terms of mobile privacy protection?

Privacy, Social Media, and Legislation September 29, 2012

Posted by Heather Mark in InfoSec & Privacy, Laws and Leglslation.
Tags: , , , , , , , ,
add a comment

This week marks the opening of a new chapter in the rocky marriage of privacy and social media.  California has passed two laws related to the protection of privacy on social media platform.

In SB1349, the state prohibits public or private post-secondary educational institutions from requiring students to provide the organization with access to the student (or student groups) social media sites.  Nor can the student or group be forced to divulge information contained on those sites.

AB 1844 is similar in nature, but applies to employers.  Specifically, the bill “would prohibit an employer from requiring or requesting an employee or applicant for employment to disclose a username or password for the purpose of accessing personal social media, to access personal social media in the presence of the employer, or to divulge any personal social media. This bill would also prohibit an employer from discharging, disciplining, threatening to discharge or discipline, or otherwise retaliating against an employee or applicant for not complying with a request or demand by the employer that violates these provisions.”

These bills are interesting in that they address a core concern around privacy and labor laws as they relate to social media.  Employers (and potential lenders) are prohibited from making decisions based upon race, gender, religion, politics, sexual orientation.  Most of this information, though, is available on individuals’ private social media profiles.  Amid increasing reports of employers requiring prospective employees to turn over credentials or access their sites in view of the employer, privacy advocates were becoming increasingly, and rightly, concerned that the rights of individuals to protect their personal lives from employers were being diluted.  These actions on the part of California serve to protect those rights.  Frankly, these actions can also protect employers and schools from being accused of discriminatory behavior by not providing them access to this information, which would otherwise be unavailable to them.

It will be interesting to see how quickly other states follow the lead that California has set.  Recall that California was the first state to pass a breach notification law and we now have 46 such laws nationwide.  So the question, to me, is when, not if, we are going to see the trend take shape.

 

 

 

“You Can’t Unring That Bell!” – What is a”Data Breach” and When Should I Notify? August 21, 2012

Posted by Chris Mark in cybersecurity, Data Breach.
Tags: , , , , , , , , , , , ,
add a comment

There are currently over 45 state breach notification laws, several data protection laws, and numerous regulations including PCI DSS, HIPAA/HITECH, FISMA, and more.  I frequently find myself working with companies on data breach notification plans.  One of the more interesting (and heated) discussions comes when I ask them to define a “data breach” or “data compromise”.  More interesting is when I ask them to define a “suspected data breach”.  Visa’ rules state that “suspected” breaches must be reported within 24 hours of identification or there could be penalties. Consider the following example.  You, as CSO, are informed of a malicious software outbreak in the customer service department. Does this require notification under the state breach notification laws, or relevant regulatory regimes?  Maybe, maybe not.  It is dependent upon a number of factors including access to data, data protections (ie. encryption), segmentation, the various laws etc.  In short, it is not easy to decipher yet it is critical to be as accurate as possible.

Understanding what is, and what is NOT, a data breach or data compromise is the first step in defining your company’s data breach notification plan.  The reason it is so critical is in the titled of this article.  Once you notify that your company has been ‘breached’ you cannot ‘unring that bell’.  The genie is out of the proverbial bottle and things start moving quickly.  Most company’s would absolutely hate to make an announcement only to find that, while they may have experienced a security incident, it did not impact sensitive data (PII, CHD, NPI, PHI, etc.).   It is important that you work with your compliance group, legal (don’t forget legal!), and the infosec & risk department to ensure you have a solid understanding of when, and under what conditions your company is required to notify of a breach or suspected breach.  Here are some basic definitions to use as a starting point.  (check with your legal council and don’t simply use these…there..that should protect me!;)

Security Incident/Event – Any event that compromises the availability, accessibility, or integrity of any asset.  This includes systems, personnel, applications, services, etc.

Data Breach – Any exposure of or unauthorized access of sensitive and/or protected data to include PHI, PII, CHD, and NPI.

Suspected Data Breach– In the absence of  direct evidence (identified fraud, or misuse of data, for example), any Security Incident in which it can be reasonable assumed that sensitive and/or protected data was exposed or accessed without authorization.

Remember, some state breach notification laws do not consider a breach of encrypted data as a trigger for notification…others do 😉  If you need help unraveling these issues (insert shameless marketing plug)…contact Mark Consulting Group…www.MarkConsultingGroup.com

graphic by Hippacartoons.com

%d bloggers like this: