Attacks/Breaches
3/25/2010
01:55 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

HSBC Database Breach Highlights Lack Of Accountability For IT Super Users

IT specialist had abused his database privileges to steal records of approximately 24,000 HSBC clients

As new details continue to emerge this month about an initially undetected large-scale database pilfering by a former IT worker at HSBC, security experts hope it will highlight one of the most glaring weaknesses in many a financial institution's database protection scheme: poor accountability for IT super users.

The breach was initially uncovered late last year, when former HSBC IT specialist Herve Falciani tried to sell the records of an unknown number of Swiss accounts held by French customers to officials in France charged with hunting down tax evaders. The French authorities eventually notified HSBC of a potential data breach and made a deal to rat out Falciani in return for more information on the HSBC clients in question. At the time, HSBC told its customer base that it believed the breach affected less than 10 clients.

But after further review, the bank found Falciani's data-plundering exploits dove far deeper than initially feared. Earlier this month, the bank 'fessed up that its former technologist abused his database privileges to steal the records of approximately 24,000 HSBC clients -- a heady sum for a bank with about 100,000 private clients.

"This breach is very unfortunate for HSBC, its customers, and consumers in general. However, I am not surprised by the magnitude of the breach. Industry statistics confirm that although the number of reported breaches declined from 2008 to 2009, the number of records compromised increased sevenfold," says Thom VanHorn, vice president of global marketing for Application Security Inc. "This breach is yet one more reminder of the challenges that large enterprise organizations face in securing their sensitive data. If securing databases is not yet a priority for some organizations, this illustrates why it must become one."

And priority No. 1 really should be focusing on those users, like Falciani, who have the most power to steal the whole treasure chest full of customer records in one shot. Of all the insiders within the enterprise, IT staffers have the most unfettered access and ability to strike the most lethal of blows to an organization.

"The really sad part of this story is that IT is many times the biggest enemy of security, willing to go to the mat to make sure that security for managing internal threats will never be adopted," says Phil Lieberman, president of Lieberman Software. "Why? Implementation of internal controls takes away the perceived power of IT and it annoys IT by forcing them to actually be accountable. Accountability: That is a pretty radical concept for most IT organizations at these large financial institutions."

Lieberman says that when he and his team approach financial organizations, he sees them making the same access control mistakes time and time again.

"Problems like using commonly known shared passwords, never changing sensitive passwords, and allowing their employees to have too much access for too long to sensitive data with no accountability is the rule rather than the exception," he says.

Lieberman believes that the only way financial institutions will be able to make a meaningful change is if the newest generation of CSOs and other executive leaders work to instill not just a technological change, but also a cultural one.

Analysts with U.K.-based Ovum agree. "Security needs to be addressed by appropriate policies and systems, but perhaps more importantly, a cultural commitment and buy-in by employees to achieving security," wrote Daniel Mayo and Graham Titterington, principal analysts for Ovum, in an analysis of the HSBC breach. "Lax behavior by legitimate users can create security risks even if data is initially locked down, and human nature means that too high restrictions can actually exacerbate such behavior if there is not a common recognition of the need for security."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

CVE-2014-2392
Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

Best of the Web