01:55 PM

HSBC Database Breach Highlights Lack Of Accountability For IT Super Users

IT specialist had abused his database privileges to steal records of approximately 24,000 HSBC clients

As new details continue to emerge this month about an initially undetected large-scale database pilfering by a former IT worker at HSBC, security experts hope it will highlight one of the most glaring weaknesses in many a financial institution's database protection scheme: poor accountability for IT super users.

The breach was initially uncovered late last year, when former HSBC IT specialist Herve Falciani tried to sell the records of an unknown number of Swiss accounts held by French customers to officials in France charged with hunting down tax evaders. The French authorities eventually notified HSBC of a potential data breach and made a deal to rat out Falciani in return for more information on the HSBC clients in question. At the time, HSBC told its customer base that it believed the breach affected less than 10 clients.

But after further review, the bank found Falciani's data-plundering exploits dove far deeper than initially feared. Earlier this month, the bank 'fessed up that its former technologist abused his database privileges to steal the records of approximately 24,000 HSBC clients -- a heady sum for a bank with about 100,000 private clients.

"This breach is very unfortunate for HSBC, its customers, and consumers in general. However, I am not surprised by the magnitude of the breach. Industry statistics confirm that although the number of reported breaches declined from 2008 to 2009, the number of records compromised increased sevenfold," says Thom VanHorn, vice president of global marketing for Application Security Inc. "This breach is yet one more reminder of the challenges that large enterprise organizations face in securing their sensitive data. If securing databases is not yet a priority for some organizations, this illustrates why it must become one."

And priority No. 1 really should be focusing on those users, like Falciani, who have the most power to steal the whole treasure chest full of customer records in one shot. Of all the insiders within the enterprise, IT staffers have the most unfettered access and ability to strike the most lethal of blows to an organization.

"The really sad part of this story is that IT is many times the biggest enemy of security, willing to go to the mat to make sure that security for managing internal threats will never be adopted," says Phil Lieberman, president of Lieberman Software. "Why? Implementation of internal controls takes away the perceived power of IT and it annoys IT by forcing them to actually be accountable. Accountability: That is a pretty radical concept for most IT organizations at these large financial institutions."

Lieberman says that when he and his team approach financial organizations, he sees them making the same access control mistakes time and time again.

"Problems like using commonly known shared passwords, never changing sensitive passwords, and allowing their employees to have too much access for too long to sensitive data with no accountability is the rule rather than the exception," he says.

Lieberman believes that the only way financial institutions will be able to make a meaningful change is if the newest generation of CSOs and other executive leaders work to instill not just a technological change, but also a cultural one.

Analysts with U.K.-based Ovum agree. "Security needs to be addressed by appropriate policies and systems, but perhaps more importantly, a cultural commitment and buy-in by employees to achieving security," wrote Daniel Mayo and Graham Titterington, principal analysts for Ovum, in an analysis of the HSBC breach. "Lax behavior by legitimate users can create security risks even if data is initially locked down, and human nature means that too high restrictions can actually exacerbate such behavior if there is not a common recognition of the need for security."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

Published: 2015-03-27
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.