Attacks/Breaches
3/25/2010
01:55 PM
50%
50%

HSBC Database Breach Highlights Lack Of Accountability For IT Super Users

IT specialist had abused his database privileges to steal records of approximately 24,000 HSBC clients

As new details continue to emerge this month about an initially undetected large-scale database pilfering by a former IT worker at HSBC, security experts hope it will highlight one of the most glaring weaknesses in many a financial institution's database protection scheme: poor accountability for IT super users.

The breach was initially uncovered late last year, when former HSBC IT specialist Herve Falciani tried to sell the records of an unknown number of Swiss accounts held by French customers to officials in France charged with hunting down tax evaders. The French authorities eventually notified HSBC of a potential data breach and made a deal to rat out Falciani in return for more information on the HSBC clients in question. At the time, HSBC told its customer base that it believed the breach affected less than 10 clients.

But after further review, the bank found Falciani's data-plundering exploits dove far deeper than initially feared. Earlier this month, the bank 'fessed up that its former technologist abused his database privileges to steal the records of approximately 24,000 HSBC clients -- a heady sum for a bank with about 100,000 private clients.

"This breach is very unfortunate for HSBC, its customers, and consumers in general. However, I am not surprised by the magnitude of the breach. Industry statistics confirm that although the number of reported breaches declined from 2008 to 2009, the number of records compromised increased sevenfold," says Thom VanHorn, vice president of global marketing for Application Security Inc. "This breach is yet one more reminder of the challenges that large enterprise organizations face in securing their sensitive data. If securing databases is not yet a priority for some organizations, this illustrates why it must become one."

And priority No. 1 really should be focusing on those users, like Falciani, who have the most power to steal the whole treasure chest full of customer records in one shot. Of all the insiders within the enterprise, IT staffers have the most unfettered access and ability to strike the most lethal of blows to an organization.

"The really sad part of this story is that IT is many times the biggest enemy of security, willing to go to the mat to make sure that security for managing internal threats will never be adopted," says Phil Lieberman, president of Lieberman Software. "Why? Implementation of internal controls takes away the perceived power of IT and it annoys IT by forcing them to actually be accountable. Accountability: That is a pretty radical concept for most IT organizations at these large financial institutions."

Lieberman says that when he and his team approach financial organizations, he sees them making the same access control mistakes time and time again.

"Problems like using commonly known shared passwords, never changing sensitive passwords, and allowing their employees to have too much access for too long to sensitive data with no accountability is the rule rather than the exception," he says.

Lieberman believes that the only way financial institutions will be able to make a meaningful change is if the newest generation of CSOs and other executive leaders work to instill not just a technological change, but also a cultural one.

Analysts with U.K.-based Ovum agree. "Security needs to be addressed by appropriate policies and systems, but perhaps more importantly, a cultural commitment and buy-in by employees to achieving security," wrote Daniel Mayo and Graham Titterington, principal analysts for Ovum, in an analysis of the HSBC breach. "Lax behavior by legitimate users can create security risks even if data is initially locked down, and human nature means that too high restrictions can actually exacerbate such behavior if there is not a common recognition of the need for security."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?