Attacks/Breaches
4/22/2010
01:34 PM
50%
50%

Pair Of Fines Levied On Breached Companies Show Real Costs Of Database Hacks

Fidelity National Information Services subsidiary, Davidson & Company each penalized hundreds of thousands of dollars by regulatory agencies

Two different companies in the past two weeks were fined by regulatory agencies for separate database breaches, totaling well over $1 million. The fines serve as a concrete and eye-opening example of what can happen to a business that fails to lock down its precious data stores, and also a warning that the toothless compliance mandates of yesteryear really do have bite now.

The two breach incidents in question are on opposite ends of the spectrum in regard to cause. The first was an insider breach initiated by a former DBA at Certegy, a wholly owned subsidiary of Jacksonville, Fla.-based Fidelity National Information Services (FIS), which cost the company $975,000 in fines to the Florida Attorney General. The second was an external attack precipitated by a SQL injection exploit against a customer database owned by brokerage firm Davidson & Co., for which the Financial Industry Regulatory Authority (FINRA) fined the firm $375,000.

"In one case it was hackers, and in another case it was an internal employee -- a DBA -- but in both the issue was that they didn't have any real-time monitoring in place. That's how these two stories are related," says Phil Neray, vice president of security strategy of Guardium, an IBM company. "What a SQL injection attack [does] is give the attacker privileged user credentials. So if you're monitoring your privileged users like your DBAs, you're also getting the bonus of monitoring for external threats at the same time."

According to Ponemon Institute, the current average organizational cost of a data breach stands at about $6.75 million. The more extreme case among the two fined companies was Certegy's breach, which shows how database breach costs can really rack up for a company: A malicious insider at the company exposed about 5.9 million customer records. The $850,000 fine levied by Florida to pay its investigative costs and attorney fees, and the additional $125,000 demanded to help fund a statewide crime prevention program, are just a tip of the breach cost iceberg for Certegy. In 2008, the company settled a class-action lawsuit that cost it $4 million. Additionally, the company is now required by the state of Florida to conduct a yearly security assessment.

"There are a lot of costs there, not just in terms of paying for the audits, but in terms of the time and the resources that are going to be required internally to support that audit," Neray explains.

The big fines doled out to Certegy and Davidson & Co. act not only serve as a punishment, but also as a deterrent and warning to others. When it meted out its punishment to Davidson & Co., FINRA had its chief enforcer issue a strong warning to other brokers.

"Broker-dealers must be especially vigilant about protecting its customers' confidential information, which includes ensuring that its technology is sufficient," said James Shorris, executive vice president and executive director of enforcement for FINRA, in a statement. "In this case, the firm placed its database containing confidential customer information on a server that was perpetually exposed to the Internet, but failed to implement basic safeguards to protect that data -- even though the firm had been advised before this incident to implement an intrusion detection system."

Neray believes firms would do well to heed Shorris' warning -- the Davidson & Company breach in his mind is a classic morality tale of the security world. Paying attention to the ramifications of the breach and how it happened in the first place can offer companies a lot of instruction.

"The Davidson breach is a really great example because it has all the classic aspects of cybercrime in the 21st century. It's got hackers in Eastern Europe using Western Union to try to launder the money, and it's got extortion," Neray says. "It's got SQL injection as an intrusion mechanism and ... they were relying on manual reviews of logs, which we know doesn't work because it happens long after the breach has occurred and because there is so much data contained in those logs that a human can't really find suspicious or unauthorized activity easily. And it had a database with a blank password, which if they were using automated vulnerability assessment tools would have been quickly found."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8551
Published: 2014-11-26
The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets.

CVE-2014-8552
Published: 2014-11-26
The WinCC server in Siemens SIMATIC WinCC 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to read arbitrary files via crafted packets.

CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?