Attacks/Breaches
3/25/2010
01:55 PM
50%
50%

HSBC Database Breach Highlights Lack Of Accountability For IT Super Users

IT specialist had abused his database privileges to steal records of approximately 24,000 HSBC clients

As new details continue to emerge this month about an initially undetected large-scale database pilfering by a former IT worker at HSBC, security experts hope it will highlight one of the most glaring weaknesses in many a financial institution's database protection scheme: poor accountability for IT super users.

The breach was initially uncovered late last year, when former HSBC IT specialist Herve Falciani tried to sell the records of an unknown number of Swiss accounts held by French customers to officials in France charged with hunting down tax evaders. The French authorities eventually notified HSBC of a potential data breach and made a deal to rat out Falciani in return for more information on the HSBC clients in question. At the time, HSBC told its customer base that it believed the breach affected less than 10 clients.

But after further review, the bank found Falciani's data-plundering exploits dove far deeper than initially feared. Earlier this month, the bank 'fessed up that its former technologist abused his database privileges to steal the records of approximately 24,000 HSBC clients -- a heady sum for a bank with about 100,000 private clients.

"This breach is very unfortunate for HSBC, its customers, and consumers in general. However, I am not surprised by the magnitude of the breach. Industry statistics confirm that although the number of reported breaches declined from 2008 to 2009, the number of records compromised increased sevenfold," says Thom VanHorn, vice president of global marketing for Application Security Inc. "This breach is yet one more reminder of the challenges that large enterprise organizations face in securing their sensitive data. If securing databases is not yet a priority for some organizations, this illustrates why it must become one."

And priority No. 1 really should be focusing on those users, like Falciani, who have the most power to steal the whole treasure chest full of customer records in one shot. Of all the insiders within the enterprise, IT staffers have the most unfettered access and ability to strike the most lethal of blows to an organization.

"The really sad part of this story is that IT is many times the biggest enemy of security, willing to go to the mat to make sure that security for managing internal threats will never be adopted," says Phil Lieberman, president of Lieberman Software. "Why? Implementation of internal controls takes away the perceived power of IT and it annoys IT by forcing them to actually be accountable. Accountability: That is a pretty radical concept for most IT organizations at these large financial institutions."

Lieberman says that when he and his team approach financial organizations, he sees them making the same access control mistakes time and time again.

"Problems like using commonly known shared passwords, never changing sensitive passwords, and allowing their employees to have too much access for too long to sensitive data with no accountability is the rule rather than the exception," he says.

Lieberman believes that the only way financial institutions will be able to make a meaningful change is if the newest generation of CSOs and other executive leaders work to instill not just a technological change, but also a cultural one.

Analysts with U.K.-based Ovum agree. "Security needs to be addressed by appropriate policies and systems, but perhaps more importantly, a cultural commitment and buy-in by employees to achieving security," wrote Daniel Mayo and Graham Titterington, principal analysts for Ovum, in an analysis of the HSBC breach. "Lax behavior by legitimate users can create security risks even if data is initially locked down, and human nature means that too high restrictions can actually exacerbate such behavior if there is not a common recognition of the need for security."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5211
Published: 2015-01-27
Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execute arbitrary code via a large PWD response.

CVE-2014-8154
Published: 2015-01-27
The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which trigger a heap-based buffer overf...

CVE-2014-9197
Published: 2015-01-27
The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request.

CVE-2014-9198
Published: 2015-01-27
The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.

CVE-2014-9646
Published: 2015-01-27
Unquoted Windows search path vulnerability in the GoogleChromeDistribution::DoPostUninstallOperations function in installer/util/google_chrome_distribution.cc in the uninstall-survey feature in Google Chrome before 40.0.2214.91 allows local users to gain privileges via a Trojan horse program in the ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.