That's right. Rather than working up any righteous indignation over this development, I read all the headlines with a creeping sense of the blasé. Not a cynical "Those banks/consumers had it coming," or "Only 40 million? Well, records were made to be broken!" No, none of that.
But I will admit to wanting to tread a bit more lightly than usual when a defendant with a nickname like “Jonny Hell” is involved. Who would win if he and this guy got in a fight is fodder for another day (or a screenplay written on spec).
I presume this global e-fraud ring will provide some currency to attendees and presenters at this week's Black Hat Inc. conference in Las Vegas. But the mostly whitehat gathering won't be spending much time congratulating itself or supposing that hacks that put 40 million people at risk are all finished. Quite the opposite, in fact, as researchers demonstrate the security holes they've punched in products from Apple Inc. (Nasdaq: AAPL), Cisco Systems, Google, and Microsoft. (Whooops! Scratch Apple.)
Which brings me back to jaded indifference. You don't have to spend much time in the security industry or sifting through newsfeeds to see the scale and relentlessness of the problem. I've come to think of information security in the same way I think of personal privacy: nice, but non-existent. Yet we seem to cling to the illusion that either of these things can be made airtight and/or failsafe. Even if we put aside hackers and phishers and other scammers, we've got lost or stolen hard drives and backup tapes to contend with, not to mention the volumes of information available to anyone who can do a Google search or use a pay service to really dig up the dirt.
It's a thin tissue that separates our personal or business information from exposure or resale. Requirements for stronger authentication and encryption would be helpful, at least until attackers find new ways around them. Hope, as Dr. Phil loves to remind us, is not a strategy (he really needs to sit down with some VCs and PR firms I know). Still, where security's concerned, it looks as if being lucky and smart are our best hopes. Unless, of course, you can afford your own hellish enforcer.
This blog is part of Internet Evolution's Security Clan, which examines the future of Internet security and the changing nature of risks and vulnerabilities. Register here to join the Security Clan and for a chance at all kinds of free stuff.
There is no doubt that a lack of security awareness and focus in the corporate world is still far from where it should be. From a business perspective, it is like insurance, how much do you need for the risks. While TJX got caught without enough (as did many others), the risks resulted in fines. Individual consumers didn't seem to mind all that much and continued to shop there.
Like most problems, there is never a single-sided solution.
Corporations do need to step up, and some have, and integrate security into their framework.
Schools need to incorporate security administration into their IT curriculum. It is not enough to educate individuals on how to administer Active Directory, but how to do it securely. Too many IT folks don't understand the basics of security risk to even think in this manner.
Data is only on valuable if it can be used for gain. Criminals don't go after data just for the sake of knowing it. It must have a use. If we implemented more protections on how data can be used we could better prevent misuse. Social Security Numbers and credit cards are too easily used by unauthorized individuals for malicious purposes.
In the case of credit cards, we would go a lot further in de-valuing the credit card number than spending billions to protect it. Requiring a standard online payment framework that required a PIN be entered (and please not a 4-digit one) would go a long way. If credit authorities also had lockout procedures after a specific number of events (sound familiar?) that would help to.
As for home users, we need to provide operating systems that are more secure out of the box. Changing settings to lessen that security should alert the user to the potential vulnerabilities. All systems should come with a security resource DVD that provides video presentations on security awareness topics that affect home users.
You are right, there will always be people trying to break through the security of systems. We do need to make it more difficult for them to do so. As long as we're relying on technology, however, we will always be engaged in this endless battle. I don't mind it so much since that is half the fun, not to mention job security.
Very nicely written sir.However your Response is very similar to the Bush Administration's response to Global Warming and cutting Emmissions-whatever we do,the Chinese and the Indians will anyways generate more emissions than us!!
I prefer a policy of proactive education in Schools where basic IT security skills can and should be taught.We have to start somewhere,and schools are as good a place as any to create awareness on Security Issues and the sanctity of Data.
Lets face it,websites like Internet Evolution and Computer/Network World do a good job,but these are not really the kind of websites which School going Kids are likely to frequent.
A good deal of Basic Security is not that hard to understand and todays Social Networking Generation is anyway very fast and extremely knowledgeable with Technology.I started something similar for my nephews(just a simple PDF sheet of One page with Dos and Donts which they stuck on the wall next to their PCs) and the cool thing is since then they have less than half the trouble with Malware and Viruses than before.(Basically before I used to get a phonecall once a week,now its like less than once a month...)
Will this solution work for everybody?Not really,thats where we need to adapt Security Policies of our respective Organizations according to their varying needs.
Still,its great to hear that people have such strong and interesting views on this subject.
We don’t need the cavalry; I think to start, we just simply need some crowbars and some Vaseline. Let’s start w/ the 55 gallon drum. Yeah, that’s it (settle down now); these tools, along with some assistance, could help some of these pathetic people that are in power in corporate America (a.k.a. “the managers” Dunt dunt dunt dahhhhhh) in prying their heads from their @$$e$(I like the dollar sign symbolism…don’t you?)! These are the poor (as in intelligence), greedy, pathetic souls suffering from “cranial rectivitis”(a.k.a. head up the @$$) who are skirting, skating and skipping around the mahogany & leather clad offices throughout Retard-O-mis-manage-America, making the executive decisions to NOT secure their I.T. infrastructures, especially GDF (<- vulgarity) wireless technology or EVEN make attempts at it (ahem…by spending some $!). It appears that some of these breaches are the result of weak or NON EXISTENT(oh wtf, we don't need to encrpyt credit card numbers as they fly through air - do we?)security measures:http://www.networkworld.com/community/node/30779 , excerpt below:
“The indictment doesn't go into details on how these retailers apparently almost invited these attacks: that's certainly the case with TJX, where WLAN security was almost non-existent. And apparently still is appallingly slack in the retail industry: early this year, wireless security vendor AirDefense reported on its own New York City war drive, which found that one third of the 800 stores scanned had no, zero, zip WLAN security, another third had only weak protection.”
Security is one thing, GOOD security is another; and being stupid, lazy, pathetic and greedy is quite the opposite.
Data security! Yeah.....right! Ever since the insurance companies decided that data had intrinsic value, crooks, scam artists, and their ilk have come out of the closet by the thousands. They have a feeling/thought that if they could acquire/amass/conquer or whatever through use of said data, then their otherwise pathetic life might be somehow enhanced or even better, they would become accepted, liked and maybe even acquire a significant other not to mention some fame and fortune. Faced with this type demeanor or child-like behavior/thought process, what chance does the non-IT savvy person have? None, I'd say. What about the IT savvy? About the same because we all know that any IT person is going to go all out to make sure he/she can't be hacked, phished, back-doored or anything else which leads to overkill along with a missed tweak here, an un-plugged port there, a missed IP, or whatever! You can stay on top of all the latest apps, firmware, threats, etc and still be no better off tomorrow than you were today before you went through all that trouble in the first place. During the beta testing for CompTIA's Security+, a disclaimer was placed very prominently at the first of the material stating that security measures are not an exact science due to the rapidly changing technological landscape and therefore should not be looked upon as rigid set of rules, but merely as guidelines or a starting point from which to build. The Certified Ethical Hacker certification is another example of a way around security measures because it teaches just that. How to! Since there are no legal requirements/restrictions for this certification, anyone can take the course which opens a whole other scenario. Once you have the basics you can create your own form of security chaos. We thought kiddie scripters were bad back in the day but these new players have found ways to swarm over us like so many maggots looking for dead flesh. What we might think of as worthless data, they will find it to be as gold. Data lives on in spite of our best efforts and as long as it's there, someone else will always want it and do whatever it takes to get it. Secure as best you can, remain calm, the cavalry is on it's way!!!!!!!
I have the link set to just start at 2008, but you can scroll back for years. I use this site to show CEOs/CIOs, managers, business owners and Joe American just how big this problem is. The big 33 million exposure incidents hit the news, but look at how many incidents there are in total!
When I give a security presentation I ask for a show of hands, "Who here has ever gotten 'The Letter'", as I hold up the letter I myself received as a result of the VA breach. I rarely am the only one holding up my hand.
The ThinkerNet does not reflect the views of TechWeb. The ThinkerNet is an informal means of communication to members and visitors of the Internet Evolution site. Individual authors are chosen by Internet Evolution to blog. Neither Internet Evolution nor TechWeb assume responsibility for comments, claims, or opinions made by authors and ThinkerNet bloggers. They are no substitute for your own research and should not be relied upon for trading or any other purpose.
Julian Assange and his WikiLeaks organization are incredibly dangerous, subversive, and bad for the status quo. And they should be widely copied around the world.
Whether you're fighting some nasty cold or trying to fix the economy, all too often the remedy can be worse than the actual condition. Windows users are getting their own taste of this dynamic with an automated tool Microsoft released this week to address a newly discovered Windows vulnerability.
I scan my spam summary in email every day for the same reasons I click on over to Tweeteorites: a bit of pulse-taking and the possibility of a good laugh. "The Holy Infant Jesus of Prague Miraculous Sculpture," anyone?
Google's changes to its content provisioning services in China have meant it needs to reapply for its license as part of an annual renewal process. But a spokesman for the Chinese Ministry of Industry and Information Technology indicated the application isn't exactly on a fast track.
The Obama Administration turned a fresh new page in its bid for more transparent government, this time via the proposed creation of an Identity Ecosystem in which individuals, enterprises, and other organizations could safely conduct business with verified identities.
Getting to Work on Smart Work: How IT Is Transforming the Implementation of the 'Internet of Things' Organizations in all industry sectors are becoming more instrumented, interconnected, and intelligent -- and that's changing the way they approach virtually every facet of their operations. It's up to IT to help organizations adopt a "Three I's" approach that leverages the emerging Internet of Things and enables them to work smarter. READ THIS eBOOK
your weekly update of news, analysis, and
opinion from Internet Evolution - FREE! REGISTER HERE
Wanted! Site Moderators Internet Evolution is looking for a handful of readers to help moderate the message boards on our site – as well as engaging in high-IQ conversation with the industry mavens on our thinkerNet blogosphere. The job comes with various perks, bags of kudos, and GIANT bragging rights. Interested?
To save this item to your list of favorite Internet Evolution content so you can find it later in your Profile page, click the "Save It" button next to the item.
What kinds of companies are doing the most innovation in the data center? Turns out it's midtier enterprises that are taking the "Just Right" approach.
An email from Ukraine teaches us that perhaps those who complain about the Internet just haven’t figured out how to spam people’s inboxes with requests for pens and balloons… or something.
McAfee has figured out how to prevent virus problems: Stop your system from running altogether. We could take this logic into taxes, email, and more, or we can start to demand vendors do online updates with a bit more care. The credibility of the whole online service concept is at stake.
Sam Altman, founder and CEO of Loopt, discusses the privacy implications of location-based services, why users should be wary of 'unwitting use,' and how companies in this space can protect their users while still avoiding government regulation.
It's important for enterprises to capture data and build an infrastructure so they can digest and analyze it. Because what will set the winners apart in the future is that they will know more, Cloudera's CEO says.
With the debate on illegal immigration expected to once again heat up, the time has come for the government to look at using biometrics to verify individuals' identities.
There's a public-policy war on copyright that nobody is winning, and inconsistencies in viewpoint and interpretation seem to be multiplying. We need to step back and think our policies over again, or we risk having a strategy that fails everyone.
Ultraviolet is an industry-wide attempt to standardize video content delivery across multiple platforms. Apart from the fact that it’s based in the cloud, relies on the DRM system, and isn’t backed by Apple… it sounds great!
The FCC's Sixth Broadband Report has a hidden secret. But here’s a hint: The regulatory body plans to regulate broadband as a telecommunications service.
Once defined by epic journeys, planning, and maps, the phrase "on the road" takes on new meaning in a digital age, where we can make all our decisions using our connected devices en route.
Digg
Del.icio.us
Reddit
Email This
TWEET THIS
