Do you have any idea what the average amount of money that enterprises have spent in the past 12 months to resolve the impact of exploits? If you guessed $10 million you were not only correct but probably had to write the check. If you didn't, you should be a bit shocked at this number. What do you think the number would have been if they had actionable intelligence about cyber attacks within 60 seconds of a compromise? Yep, time is critical as an of average $4 million in savings would have occured. These numbers come from Ponemon Institute’s latest research findings, Live Threat Intelligence Impact Report 2013.
Seemingly moments after hearing about the JP Morgan data breach, consumers are learning about the data breach at AT&T. According to multiple reports, approximately 1,600 Vermont-based customers have been affected by the breach. The breach came from inside the company.
“We recently determined that one of our employees violated our strict privacy and security guidelines by accessing your account without authorization in August 2014, and while doing so, would have been able to view and may have obtained your account information including your social security number and driver’s license number. Additionally, while accessing your account, the employee would have been able to view your Customer Proprietary Network Information (CPNI), without proper authorization,” said AT&T in a notice to the Vermont Attorney General.
ZDNet reports that CPNIs are unique customer numbers that can include metadata such as “the time, date, duration, and destination number of each call made.” AT&T plans to make amends by reversing fraudulent charges, and providing a free year of credit monitoring to affected customers.
According to eWeek, AT&T experienced a similar data breach in June of this year, and the breach occurred from inside the company. “In the June breach, the motive was to help resellers unlock or "jailbreak" AT&T phones so they could be resold,” eWeek went on to say.
This time, it's JP Morgan reporting that 76 million households and 8 million small businesses were exposed in a data breach. At this point, it's understandable if it’s not rattling the cage or isn’t front page news.
It seems like the press is full of educational institution breaches recently:
- On February 18, 2014, the University of Maryland was the victim of a computer security attack that exposed records containing personally identifiable information (PII).
- A week later, Indiana University announced that a staff error had exposed information on 146,000 students for 11 months.
- A week after that, the North Dakota University System reported that a server containing names and Social Security numbers for more than 290,000 current and former students and about 780 faculty and staff, had been hacked.
- Shortly after that on April 2014, Iowa State IT staff discovered unauthorized access to five departmental servers on campus. An extensive analysis of the information breach has revealed the compromised servers contained Social Security numbers of 29,780 students
Let's face facts, today we live in an “on-demand” world. Want to watch a movie? No problem- you can access it immediately. Looking to read one of New York Times’ best sellers? You can download it and start reading in two minutes flat. Even shopping, music, file sharing, and TV are all available around the clock. We are becoming hardwired to expect immediate access to the things we need (or even want). Patience is not a virtue we enkoy, especially when it comes to our data security.
It should be common knowledge that the security of your company data is one of the most critical functions of an Information Technology program. It’s also one of the most budget- and resource-intensive functions, as well. With all of the directions you can get pulled in every day, having to deal with the headache of your security posture shouldn’t be at the top of your list. That’s where outsourcing your information security comes in. Data security outsourcing, specifically security monitoring, can be a viable and intelligent option when it comes to keeping the data in your organization secure, and it allows you to keep security levels high without having to allocate precious resources to those functions.
EiQ has been a longstanding provider to the government departments and agencies. We know that many government agencies and divisions are working on overtime to meet fundamental security standards outlined in the DISA’s Security Technical Implementation Guides (STIGs), NIST Special Publication 800-53, 8500.2, and AR25.2. There’s no wonder why. A combination of insufficient or long-awaiting funding, political bickering, lack of clarity in the guidance and the lack of a real timeline for implementation has caused a lot of confusion and waste in time and money. There is also so much hype around new technologies that will protect from the latest threat. Just considering what’s in the market now is full time job takes time and attention away from basic infrastructure management. Every week a new firewall, anti-malware, anti-spam, APT, AV, IPS promise to mitigate risk, thwart attack.
A recent study that came out reminds us here at EiQ that the importance of continuous monitoring needs to be implemented on a more regular basis, and that most companies don’t work hard enough to do so.
In the wake of the Edward Snowden case, many companies began to take caution and re-evaluate what they wanted to share with employees. Privileged users who have access to valuable company data have always posed a threat to companies but in the wake of the Snowden case and the never ending threat of attacks this year has seen, companies are now beginning to recognize that insider threats can be even more damaging than an outside attack.