IT Security Breaches Soar In 2009

slak11 quotes from a Globe and Mail article on the jump in corporate and government security breaches year-over-year. (The reporting is from Canada but the picture is probably much the same in the US.) "This does not seem to be all that newsworthy these days, since stories like this are appearing on a regular basis. The one detail I did like — that seems to break from the traditional 'hackers cause all the bad stuff' reporting — is the mention that everyday employees are a major cause of breaches. The recent Rocky Mountain Bank/Google story is a perfect example. As stated in the article: 'But lower security budgets aren't the only reason breaches tend to soar during tough economic times — employees themselves can often be the cause of such problems.' I figure this will be an ongoing problem until company management and employees accept their role in keeping company information safe. And IT people need to understand that regular employees are not propeller-heads like Slashdot readers, and to begin to implement technology and processes that average people can understand and use."

Comment removed

[account_deleted]

Comment removed based on user account deletion

Propeller-heads

[causality]

And IT people need to understand that regular employees are not propeller-heads like Slashdot readers, and to begin to implement technology and processes that average people can understand and use.

You have to love the implication that IT staff purposefully choose the most arcane implementation for the hell of it, or that they enjoy the support calls they receive when users have a hard time with a system. Sometimes what you are doing is inherently complex, and some ability to deal with complexity is necessary. The way I see it, there are two broad approaches to the problem of "implement[ing] technology and processes that average people can understand and use." One is to simplify those technologies and processes. The other is to increase the understanding of the users, or for the users to increase their own understanding.

For some reason, most discussions like this seem to have this unstated assumption that the former approach is the only possible one. I'd like to see more of a middle-ground solution. I like Einstein's saying about how things should be made as simple as possible, but no simpler. Once that is done, if the users still find the systems and processes to be too complex, and their job requires the ability to handle same, then I would conclude that this means they are not qualified for their job and need to be replaced by someone with more understanding. Is that really such a scary conclusion that we must perform all sorts of musings and mental gymnastics to avoid it? Because I certainly believe that people can improve if it is expected of them, if there are not infinite excuses for their shortcomings. For that reason, I don't believe that regarding users who can't handle good systems as unqualified would result in tremendous turnover within a company. I think it would result in more savvy users, even if only to avoid being fired. It would certainly help to disabuse people of this mentality that basic competency is only for nerds, hardcore geeks, and experts.

I.T. IS COMPLICATED, GET USED TO IT!

[uslurper]

" And IT people need to understand that regular employees are not propeller-heads like Slashdot readers, and to begin to implement technology and processes that average people can understand and use."

This is exactly the attitude that causes insecure environments. Security IS complicated. Accounting IS complicated. Networking IS complicated. PC's ARE complicated. Fuck people realize that I.T. IS COMPLICATED. Give your IT Department the tools and authority to run their department the way it needs to be done.

Security

[oldhack]

Security is a lot like IT, but much more so. It's waste of money until shit hits the fan. 5 minutes later, it becomes waste of money again. But it's difficult to judge how close you're to shit-blade collision point, though, because in the end it's an effort to mitigate breach, not a guarantee, and news stories that do pop up tend to be sensationalistic and doesn't help the assessment.

Motivation

[whoever57]

... employees themselves can often be the cause of such problems.' I figure this will be an ongoing problem until company management and employees accept their role in keeping company information safe

I figure it will continue to be a problem until company management provides the appropriate motivation and training to employees to keep company data safe. This won't happen until management also has the appropriate motivation. Did anyone in management get fired over the Rocky Mountain bank/Google incident? How much has this cost the bank?

A new law in security.

[Polarina]

Everything that can be hacked, will be hacked. If not in your lifetime, then in mine.

Re:I.T. IS COMPLICATED, GET USED TO IT!

[jklovanc]

Yes, it is complicated. It is also understandable if enough information is given to the users. The standard IT responses of "it's company policy" and "just do it" do not cut it in an intelligent workplace. Sure you want users to follow the rules but giving real reasons why might just raise compliance.

Re:Propeller-heads

[plover]

But "simple" does not mean "secure". Yes, simple is easier to verify, but you can write simple, clean code and still get hit with a security incident.

Code that is simple and secure today also doesn't mean that it will be secure tomorrow, once the next exploit is created and discovered. How long ago was it before javascript existed? Nobody cared if you put <script> tags in your comments, because browsers didn't even know the keyword "script". Suddenly browsers started appearing that supported this tag, and people got creative when posting comments, including cute scripts to animate their signatures. Then XSS attacks were discovered and became all the rage, and perfectly secure web sites around the globe suddenly had a new threat model that became their responsibility to clean up.

You can review simple code all day long and assure yourself that it will do what it's supposed to do. But it's very, very hard to review code to ensure that it won't do something bad, especially when you don't have tomorrow's definition for "bad" to review against!

Re:Oh no!

[lysergic.acid]

OSF Dataloss seems to be counting the number of data breaches (i.e. database of customer info being leaked, millions of credit card numbers being stolen, etc.), whereas this article refers to security breaches in general, not just those that affect personal privacy. Also, the article seems to be based on Canadian statistics, as well as going by the cost of damages rather than the number of breaches that occurred.

I mean, if in 2008, there were 703 breaches, each only making off with a $10~20k of data on average, whereas the 331 breaches this year average $100k in data, then that's still a huge increase the severity of the security breaches.

Simply counting the number of breaches on record just doesn't paint the full picture.

Re:Security

[shentino]

So it's actually closer to insurance.

Security Always Loses

[endus]

"I figure this will be an ongoing problem until company management and employees accept their role in keeping company information safe."

Exactly. I suppose it's not that surprising that everyone wants all the benefits of IT without any of the responsibility given that a solid 90% of people are just too fucking stupid to understand that it even HAS consequences, but the willful disregard for protecting customers/patients info is just pathetic. You work in the medical industry and you see that doctors and nurses and sys admins just don't give a fuck about protecting their patients identities and privacy, regardless of how small an inconvenience they face.

I understand that a lot of security solutions are not always convenient but the level of laziness and disregard for people is really inexcusable. You wanna know the truth? Really easy to use security solutions just aren't here yet in a lot of areas. That's a fact. Viruses, worms, system compromises, botnets, identity theft...those ARE here in ALL areas. That's also a fact. If people don't like it then they should go back to using paper records...uhoh...that sounds a little more inconvenient than remembering two passwords doesn't it?

I realize this comment makes me sound like a security nazi but honestly I am pretty good at bridging the gap and have worked on both sides of the security fence. I am just really really tired of users whining. To a point, yes, usability is very important for a lot of reasons and anywhere possible you should strike a balance between usability and security. I don't discount that. However, in a lot of organizations security ALWAYS loses that battle...ALWAYS. Companies are jumping through incredible hoops to meet regs and appease auditors while willfully engaging in egregious breaches of security in areas not covered by laws.

Re:Mafiaa and "terrorists"

[POTSandPANS]

The best thieves make sure you never realize they were there..

Re:Dude...

[rtb61]

Easiest solution to your problem, parallel networks. An internal secure network, accounting, payroll, banking, data management, cad, cam, publishing etc. and an external network email and internet access. Lock down the internal network, tight, no internet access, no portable media, data is either input at the keyboard or uploaded at the IT office after it is reviewed and scanned.

External network, let the children play and create a USB reboot and rebuild stick for each notebook. You will be a whole lot less frustrated and the children will be happy as they get to play without controls and, by children I do mean the executive pool. Keep it simple internal wired and external wireless, in office try to use infra-red for wireless, it is more restricted and safer.

This way only one machine at a time gets infected on the external network and the infection is always from the net rather than internal. Internal a desktop/terminal, external cheap netbooks/smartbook basically a throw away and in affect an extension of a mobile phone.

Best thing about this, passwords not a problem, unless they break into the specific office to gain access to the specific files than they are out of luck and the server room itself can be fully secured and alarmed, basically a vault.