Attacks/Breaches
4/22/2010
01:34 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Pair Of Fines Levied On Breached Companies Show Real Costs Of Database Hacks

Fidelity National Information Services subsidiary, Davidson & Company each penalized hundreds of thousands of dollars by regulatory agencies

Two different companies in the past two weeks were fined by regulatory agencies for separate database breaches, totaling well over $1 million. The fines serve as a concrete and eye-opening example of what can happen to a business that fails to lock down its precious data stores, and also a warning that the toothless compliance mandates of yesteryear really do have bite now.

The two breach incidents in question are on opposite ends of the spectrum in regard to cause. The first was an insider breach initiated by a former DBA at Certegy, a wholly owned subsidiary of Jacksonville, Fla.-based Fidelity National Information Services (FIS), which cost the company $975,000 in fines to the Florida Attorney General. The second was an external attack precipitated by a SQL injection exploit against a customer database owned by brokerage firm Davidson & Co., for which the Financial Industry Regulatory Authority (FINRA) fined the firm $375,000.

"In one case it was hackers, and in another case it was an internal employee -- a DBA -- but in both the issue was that they didn't have any real-time monitoring in place. That's how these two stories are related," says Phil Neray, vice president of security strategy of Guardium, an IBM company. "What a SQL injection attack [does] is give the attacker privileged user credentials. So if you're monitoring your privileged users like your DBAs, you're also getting the bonus of monitoring for external threats at the same time."

According to Ponemon Institute, the current average organizational cost of a data breach stands at about $6.75 million. The more extreme case among the two fined companies was Certegy's breach, which shows how database breach costs can really rack up for a company: A malicious insider at the company exposed about 5.9 million customer records. The $850,000 fine levied by Florida to pay its investigative costs and attorney fees, and the additional $125,000 demanded to help fund a statewide crime prevention program, are just a tip of the breach cost iceberg for Certegy. In 2008, the company settled a class-action lawsuit that cost it $4 million. Additionally, the company is now required by the state of Florida to conduct a yearly security assessment.

"There are a lot of costs there, not just in terms of paying for the audits, but in terms of the time and the resources that are going to be required internally to support that audit," Neray explains.

The big fines doled out to Certegy and Davidson & Co. act not only serve as a punishment, but also as a deterrent and warning to others. When it meted out its punishment to Davidson & Co., FINRA had its chief enforcer issue a strong warning to other brokers.

"Broker-dealers must be especially vigilant about protecting its customers' confidential information, which includes ensuring that its technology is sufficient," said James Shorris, executive vice president and executive director of enforcement for FINRA, in a statement. "In this case, the firm placed its database containing confidential customer information on a server that was perpetually exposed to the Internet, but failed to implement basic safeguards to protect that data -- even though the firm had been advised before this incident to implement an intrusion detection system."

Neray believes firms would do well to heed Shorris' warning -- the Davidson & Company breach in his mind is a classic morality tale of the security world. Paying attention to the ramifications of the breach and how it happened in the first place can offer companies a lot of instruction.

"The Davidson breach is a really great example because it has all the classic aspects of cybercrime in the 21st century. It's got hackers in Eastern Europe using Western Union to try to launder the money, and it's got extortion," Neray says. "It's got SQL injection as an intrusion mechanism and ... they were relying on manual reviews of logs, which we know doesn't work because it happens long after the breach has occurred and because there is so much data contained in those logs that a human can't really find suspicious or unauthorized activity easily. And it had a database with a blank password, which if they were using automated vulnerability assessment tools would have been quickly found."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6212
Published: 2014-04-19
Unspecified vulnerability in HP Database and Middleware Automation 10.0, 10.01, 10.10, and 10.20 before 10.20.100 allows remote authenticated users to obtain sensitive information via unknown vectors.

CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2013-6215
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 10.01 and 10.10 allows remote authenticated users to execute arbitrary code via unknown vectors, aka ZDI-CAN-1977.

CVE-2013-6218
Published: 2014-04-19
Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors.

Best of the Web