[ISN] VanBokkelen: 2006: The year of the breach

From: InfoSec News (alerts@private)
Date: Mon Dec 18 2006 - 23:27:31 PST


http://www.fcw.com/article97098-12-18-06-Print

By James B. VanBokkelen
Dec. 18, 2006

The year 2006 may go down in computer security history as the year of 
the breach. As of Dec. 1, more than 36 million people in the United 
States might have had their personal information compromised this year 
by hackers, laptop computer theft or information security blunders. More 
than 97 million records are potentially at risk of identity theft 
because of nearly 300 separate breaches, and the year isnt over.

Those security breaches happened nationwide, and their victims cut 
across age, race, socioeconomic and geographic lines. However, people 
affiliated with universities, government agencies and the military are 
most likely to have their personal information compromised. The 
inadvertent disclosure of the records of 26.5 million veterans and their 
families, including more than 2 million active-duty members, was the 
largest data breach of its kind in history. Large institutions face 
greater risks. They have larger volumes of data storage to plunder and 
potentially a greater number of disgruntled insiders, or former 
insiders, with malicious reasons for trying to gain access to the data.

Of the 30 largest data breaches so far this year, at least 10 were the 
result of unauthorized access a network. In a majority of those cases, 
investigators could not determine the date the breach occurred or were 
unwilling to report it publicly.

In many cases, the organizations didnt know whether the breach involved 
outsiders or insiders or whether the culprit ignored, merely viewed or 
stole the personal information. Information technology departments often 
do not have the proper technology to ascertain the basic facts about a 
breach, such as when it occurred, its source or the reasons for the 
breach.

IT departments can remediate those data gaps with increased security 
budgets, better-trained and more qualified employees, and software that 
captures and examines the needle of evidence in a haystack of data.

Network forensics and analysis tools gather and analyze data about a 
security incident. Such tools have allowed organizations to find 
malicious hackers; determine whether sensitive data was ignored, viewed 
or compromised; and prevent future attacks.

A network forensics and analysis tool wont help find a missing laptop. 
It wont strengthen the defenses of a weak or improperly configured 
network or magically clear up intransigence and miscommunication 
regarding security policy. But good forensics software, properly 
configured, will allow IT administrators to see precisely what is 
passing through an organizations networks. Aided by network forensics 
tools, network administrators have identified suspicious or anomalous 
traffic patterns to and from specific sites at certain times of the day 
or week.

For institutions affected by data breaches in 2006, network analysis 
tools could have assisted in identifying perpetrators, determining 
whether data had been stolen, and saving time and money for security 
upgrades not to mention saving organizational face.

-=-

VanBokkelen is president of Sandstorm Enterprises, a network security 
company.


_____________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn
 



This archive was generated by hypermail 2.1.3 : Mon Dec 18 2006 - 23:39:58 PST