Attacks/Breaches
3/25/2010
01:55 PM
Connect Directly
RSS
E-Mail
50%
50%

HSBC Database Breach Highlights Lack Of Accountability For IT Super Users

IT specialist had abused his database privileges to steal records of approximately 24,000 HSBC clients

As new details continue to emerge this month about an initially undetected large-scale database pilfering by a former IT worker at HSBC, security experts hope it will highlight one of the most glaring weaknesses in many a financial institution's database protection scheme: poor accountability for IT super users.

The breach was initially uncovered late last year, when former HSBC IT specialist Herve Falciani tried to sell the records of an unknown number of Swiss accounts held by French customers to officials in France charged with hunting down tax evaders. The French authorities eventually notified HSBC of a potential data breach and made a deal to rat out Falciani in return for more information on the HSBC clients in question. At the time, HSBC told its customer base that it believed the breach affected less than 10 clients.

But after further review, the bank found Falciani's data-plundering exploits dove far deeper than initially feared. Earlier this month, the bank 'fessed up that its former technologist abused his database privileges to steal the records of approximately 24,000 HSBC clients -- a heady sum for a bank with about 100,000 private clients.

"This breach is very unfortunate for HSBC, its customers, and consumers in general. However, I am not surprised by the magnitude of the breach. Industry statistics confirm that although the number of reported breaches declined from 2008 to 2009, the number of records compromised increased sevenfold," says Thom VanHorn, vice president of global marketing for Application Security Inc. "This breach is yet one more reminder of the challenges that large enterprise organizations face in securing their sensitive data. If securing databases is not yet a priority for some organizations, this illustrates why it must become one."

And priority No. 1 really should be focusing on those users, like Falciani, who have the most power to steal the whole treasure chest full of customer records in one shot. Of all the insiders within the enterprise, IT staffers have the most unfettered access and ability to strike the most lethal of blows to an organization.

"The really sad part of this story is that IT is many times the biggest enemy of security, willing to go to the mat to make sure that security for managing internal threats will never be adopted," says Phil Lieberman, president of Lieberman Software. "Why? Implementation of internal controls takes away the perceived power of IT and it annoys IT by forcing them to actually be accountable. Accountability: That is a pretty radical concept for most IT organizations at these large financial institutions."

Lieberman says that when he and his team approach financial organizations, he sees them making the same access control mistakes time and time again.

"Problems like using commonly known shared passwords, never changing sensitive passwords, and allowing their employees to have too much access for too long to sensitive data with no accountability is the rule rather than the exception," he says.

Lieberman believes that the only way financial institutions will be able to make a meaningful change is if the newest generation of CSOs and other executive leaders work to instill not just a technological change, but also a cultural one.

Analysts with U.K.-based Ovum agree. "Security needs to be addressed by appropriate policies and systems, but perhaps more importantly, a cultural commitment and buy-in by employees to achieving security," wrote Daniel Mayo and Graham Titterington, principal analysts for Ovum, in an analysis of the HSBC breach. "Lax behavior by legitimate users can create security risks even if data is initially locked down, and human nature means that too high restrictions can actually exacerbate such behavior if there is not a common recognition of the need for security."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4594
Published: 2014-10-25
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment.

CVE-2014-0476
Published: 2014-10-25
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.

CVE-2014-1927
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928....

CVE-2014-1928
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulner...

CVE-2014-1929
Published: 2014-10-25
python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.