Yesterday the AP released a story that was widely published, "Pentagon Hacker Compromises Personal Data." 

The story didn’t really give much detail, but does demonstrate the importance of firewalls, intrusion detection systems, and other types of monitoring and logging to detect unauthorized access to networks.  As well as the need to encrypt personal information…

"WASHINGTON — An intruder gained access to a Defense Department computer server and compromised confidential health care insurance information for more than 14,000 people, the department said Friday. 

William Winkenwerder Jr., the assistant defense secretary for health affairs, said the affected individuals have been advised by letter that the compromise of personal information could put them at risk for identity theft. 

"Such incidents are reprehensible, and we deeply regret the inconvenience this may cause the people we serve," he said in a brief statement."

Yes, this is an inconvenience, a huge one, for people who end up having to fight the consequences of inadequate security for their personal information.  As another story from Houston points out, the amount of effort and time it takes for people to convince law enforcement, credit companies, and the companies where the security incidents occur, that bad things are happening to them, and then to clean up their credit information, is significant.

"HOUSTON — Identity theft is the fastest growing crime in the United States and Houston is the No. 1 spot for this crime in Texas. Yet, the KPRC Local 2 Troubleshooters found there is little chance the people committing these crimes will ever see the inside of a jail cell.  Every month an average of 340,000 Houstonians report crimes involving credit and debit cards.  This man is just one of those cases.

"It’s worse than having your car stolen because it’s an intangible. It’s your identity and I had no clue how I was going to get that back," a victim said.  He asked the Troubleshooters to shield his identity because someone ran up $17,000 worth of credit card charges under his name.  "I didn’t find out until I was getting calls from creditors," the victim said.  Equally frustrating is what happened when he said he reported the crime to police.  "The tone of the conversation was pretty clear. He had taken the report and I could get a copy of the report, which would help me clear my record," the victim said.  Angry by what he felt was a lack of response, he did his own digging and was able to find out which ATM the crooks were using to take out cash.

"I offered that to police and they were like, ‘Yeah, if you want to bring that down, that’s fine. We’ll have a look at it.’ But it was pretty clear nothing was going to be done," the victim said.  "I’ve been a victim of identity theft over three times in the past year and I understand their frustration. It’s a frustrating crime, said Sgt. Mike Osina with the Houston Police Department.  Osina is with HPD’s Financial Crimes Unit.  "We are inundated with cases," he said.

That may be an understatement. In the last two years, HPD’s 15-member financial crimes unit has received more than 32,000 cases for investigation. Just getting a detective on the phone to talk about a case can be a chore.  The Troubleshooters called the financial crimes unit.  "You have reached the Houston Police Department’s Financial Crimes Unit. All representatives are currently assisting other callers. Please remain on the line," the recording said.  The Troubleshooters waited for 10 minutes, 20 minutes, 30 minutes, and 45 minutes.  After being on hold for an hour, they heard the following message.  "All representatives are still assisting other callers. Please remain on the line and your call will be answered in the order in which it was received."  No one ever answered the Troubleshooters call.

"I don’t know what to tell you what happened on that and I apologize that it did happen. We will do a better job of that," Osina said.  So, with such heavy caseloads, what about actually catching the crooks?  "Every case gets read. Every single case that comes to our office gets read — that I can promise them," Osina said.  Reading a case is one thing. Solving it is another.  HPD records show in the last year, only 2 percent of forgery and counterfeiting cases and only 12 percent of fraud cases were actually solved. "Every time we get a handle on a certain way these crooks are doing things, they evolve into something else," Osina said.

Just ask the victim interviewed by the Troubleshooters. It took years to repair his credit. But what about the person who stole his identity?  "Actually, I don’t know. It’s still a mystery to me," the victim said.  One of the biggest problems with solving these cases is many of the crooks live in other cities, states or even foreign countries.  That means local detectives have to rely on other jurisdictions for help, and that spirit of cooperation isn’t always there.  As for the problems of getting ahold of a detective, the captain of the division was so disturbed by what the Troubleshooters found he said he is making immediate changes to ensure it doesn’t happen again."

Yes, this is a big inconvenience.  I think showing these stories in juxtaposition highlights the common flaw in the thinking of the companies where incidents occur, and with the judges who say if no damage is done (in their opinion) to a victim within a mere matter of a few weeks, then the company where the incident occurred is not held accountable and that it can be assumed that bad things will not happen.  Bad things can be done with the stolen data over a matter of months or years.  It often is not noticed until something unusual happens like getting a call from creditors.  The sad fact is that most people don’t look over their credit card statements closely…and that the bills for the newly established fraudulent accounts are often sent to bogus addresses, so that the victim never is aware of the fraud occurring.

Okay…back to the Pentagon hacking story…

"The Pentagon established a toll-free telephone number (1-800-600-9332) for affected people to call if they have questions. The computer server is for people insured under the Pentagon’s TRICARE health care system. 

The type of information that was compromised was not disclosed in the Pentagon announcement, but Winkenwerder said it varied and investigators do not know the intent of the crime or if the compromised information will be misused."

Of course you can never know the intent of the intruders for how they will use the information!  They will use it in any way they can, and probably in many different ways, to get as much money out of it as possible. 

It is possible the information will be sold, resold, and propagated to a very wide audience.   And, of course you cannot know IF the information will be misused, but shouldn’t you expect that is a very significant possibility given it was taken to begin with?

"A spokesman for Winkenwerder, who asked not to be identified, said the information included names, Social Security numbers, credit card numbers and some personal health information.  Routine monitoring of one of the health care insurance system’s public servers detected unusual activity, and an investigation led to the discovery on April 5 that an intrusion had occurred and information was compromised.  As a result, additional monitoring tools were installed to improve security of existing networks and data files, Winkenwerder said."

Highlights, again, the need to encrypt personal information at rest and in motion.  If this data had been encrypted there would truly have been no impact on 14,000+ people as a result of this incident (assuming the compromise was not done by an authorized insider).

The incident occurred on April 5, but the story was not reported until April 28.  I wonder how long it took the impacted individuals to get their notice of the incident?

Technorati Tags
identity theft
Pentagon
hack
cybercrime
encrypt
personal information breach
privacy
information security

There was a story published in The Register (a really great source of news, btw) earlier this week that I am just now getting around to reading, "UK PLC security prognosis mixed."  They gave a synopsis of some of the findings in the DTI Information Security Breaches Survey 2006; there is an Executive Summary and the full report.

Well…it is Friday…and I still have over half of my week’s to-do list to get done…but I’m always curious about these types of surveys…so here are just a few excerpts and thoughts about the findings from the full DTI report:

"Overall, the cost of security breaches to UK plc is up by roughly 50% since two years ago, and is of the order of ten billion pounds per annum."

This is around $18billion U.S. dollars and around 14,380,043,082 Euro.  (Here’s a nice little currency conversion calculator.)

" The average cost of a UK company’s worst security incident of the year was roughly ¬£12,000 (up from ¬£10,000 two years ago)."

This is US $21,613.20…seems low to me.  But then again, averages can be misleading.

"Roughly two-fifths of businesses spend less than 1% of their IT budget on information security."

Well…kinda, but then again not really, too surprising…seems excessively low.  Definitely disappointing to see information security is still so low on the budget totem pole.

"There is still a shortage of security qualified staff; only one in eight companies has any."

Wow!  This low number does surprise me.

"Three-fifths of UK businesses are still without an overall security policy, though a third of these have defined an acceptable usage policy for the Internet."

This is surprising also.  I wonder, with this lack of staff and lack of policies, how accurate the cost of security breaches truly is?  There is likely a lot of security problems going on…including fraud and insider abuse…that is not known or being discovered.  There’s no one on staff, and no technology being used, to discover them!

Well…there is so much more to the report…I only got to page 5 of the full report.  Check it out; I’ll look through it more closely this weekend.

Technorati Tags
information security
UK
DTI Information Security Breaches Survey
IT budget
security breaches
security study

Wow…it’s a busy week for data security incidents! The Aetna laptop I just mentioned… earlier this week the hack at the University of Texas at Austin involving a database with info on 197,000 people, etc… 

Remember last year around this time when Iron Mountain had several incidents where they lost data for their customers?  Well, spring is no kinder to them this year…they’ve lost more data on around 17,000 people, as reported by the AP:

"(AP) NEW YORK The Long Island Rail Road says it has lost personal information — names, addresses, Social Security numbers and salary figures — of virtually everyone who has ever worked for the railroad. Iron Mountain, Incorporated — a Boston company — employed by the railroad to warehouse and secure information at an undisclosed storage site discovered the loss on April 6. During a routine delivery between LIRR headquarters in Jamaica and the storage site — an Iron Mountain driver noticed that at least one unmarked box was missing. The LIRR said MTA Police and the NYPD were immediately notified.

On Monday, the railroad mailed a letter from LIRR President James Dermody to approximately 17,000 current and former employees, notifying them about the lost information. The LIRR has about 6,000 current employees. Newsday reports that the letter said the information on the computer discs was formatted in a way that is very difficult to access without specialized skills, specific software and sophisticated computer equipment. The LIRR agreed to provide anyone at risk with a free one-year enrollment with a credit check and identity theft monitoring service. The railroad has also set up a Web site and telephone hotline for employees with questions about the missing data."

It is always interesting to see when incidents involving data that is not encrypted is downplayed by the organization saying the data is "very difficult to access without specialized skills…"

Gee, how many folks have IT experience, specialized IT skills, and sophisticated computers?  Hmm…

Technorati Tags
lost backups
privacy
encrypt
personal information
Iron Mountain
security incident
social security numbers

Yesterday I posted a new article in the reading room of the Realtime IT Compliance site about the need for securing mobile computing devices and mobile storage media, "Managing Mobile Computing Risks."  Within it you will find a partial (but still pretty lengthy) listing of the laptop theft and loss events I’ve been accumulating.  There are also several pointers for securing these mobile devices, along with some awareness recommendations.  People are the weakest link in your mobile computing device security strategy; they literally hold security within their hands.  With the increase in incidents involving mobile computing devices, you must educate them about how to protect these devices.

For additional information about mobile computing security, see another article published today on SearchSecurity. 

Technorati Tags
information security
mobile computing
encrypt
stolen laptops

Today Media Life Magazine published an interesting article about using encryption to extort money from organizations from whom data has been stolen.  The dark side of encryption!  After Googling a bit, I’m sure this is nothing new to some of you.  However, the article is a pretty interesting read…

“From a venue of shared information, the web is turned by blackmailers into a vehicle for extortion. Scamsters break into a user’s computer, encrypt data, then demand money by e-payment in order to unlock the data. Such schemes have been around for years but investigators warn that they have shot up in the last year, and they’re likely to surge in the coming months. That’s because in the first quarter of 2006 the cyber criminals operating these scams developed increasingly sophisticated software, according to a report from Kaspersky Lab, a Russian anti-virus software company.  As a result of these developments, Kaspersky researchers warn, “Holding user data hostage is one of the most dangerous and rapidly evolving types of cyber crime.

It is not mainstream yet, says David Emm, senior technology consultant at Kaspersky. But this is a new twist on the theme and watch out, because it may become a bigger part of the picture.

Blackmail scams that encrypted data until a sum of money was paid first appeared in 1989. However, at that point e-payment systems weren‚Äôt readily available, so blackmail involved physically collecting the money. That made it no more attractive than traditional blackmail schemes, where the schemers face a huge risk when they swing by to pick up the loot. That risk larger evaporates with e-payment systems. Collecting involves no physical appearances, just clearly written instructions on where to send the money, and the transactions are difficult to track. 

The current scams work like this. The virus, of which there are three main ones at the moment, enters the victim’s machine through the usual routes, such as email attachments, worms or phishing. The virus then encrypts the victim’s files, locking them up. The virus leaves a readme text file, which when opened explains that the data has been locked up and will stay that way until the blackmailer receives money wired over the internet through an e-payment system.  The amount demanded typically ranges between $50 to $2,000.

The user is given very thorough instructions on how to go about setting up an e-payment account. In one instance, this even included a handy tip suggesting the victim makes the account name something easy to remember (as they will be asked for it again later) and reasonably short, according to the Kaspersky report.  In setting the extortion sum, scamsters keep the figure low enough that a sufficient number will choose to pay up. What’s more, says Emm, these low-figure operations can cover their tracks more easily.  Perhaps surprisingly, these crooks so far have generally unlocked the data upon receipt of payment.

Kaspersky advises victims of such schemes to not hand over the money demanded, though it may seem the easier course, but to instead contact their anti-virus software provider. They will likely be able to unlock the data. In the last year Emm estimates hundreds of people have fallen victim to such scams. Says he: “It is a significant number.  To date most incidents have been in Russia and Eastern Europe, but Emm believes that this is likely to change. I don’t see any reason why we wouldn’t see it soon in the U.S. and Western Europe.”

More reason to keep your data encrypted in storage…along with off-line backups!!

This extortion method has been written about before in multiple places.   An FBI acquaintance of mine told me about this a few months ago, and the FBI posted a message regarding it on their site on 3/16/06. I’d like to know how widespread this is…if it is anything like my FBI contact indicates, it is pretty incredible.

Technorati Tags
FBI
cybercrime
encrypt
extortion