It has been widely reported and blogged about how an old United Airlines story was posted with huge stock value loss…
United Airlines (UAL) reportedly lost $1 billion after an article about the company’s 2002 bankruptcy was mistakenly accessed, posted and widely reported. UAL stock dropped 75%…worth $1 billion…in 11 minutes.
Much analysis has been done about why this happened, such as “How a Series of Mistakes Hurt Shares of United.”
However, it seems to me, from the bits and pieces that I’ve read, that this was an automated, and unplanned, exploit of poor security related to inadequate access controls, record retention weaknesses, and…the always present element in incidents…human vulnerabilities to make mistakes and bad judgments.
The main blame reportedly appears to be a lack of a date on the old news release.
So, another factor is a lack of proper classification labeling and logging a date stamp.
Actually, doing an in-depth look at this incident would make a great case study to show how many different areas…not just IT but others throughout an enterprise along with business partners…can have vulnerabilities that, when stirred together create the perfect storm to completely wipe out a company, company’s stock value, etc.
Tags: access control, awareness and training, Information Security, IT compliance, IT training, logs, policies and procedures, privacy training, risk management, security training, United Airlines