Attacks/Breaches
4/22/2010
01:34 PM
50%
50%

Pair Of Fines Levied On Breached Companies Show Real Costs Of Database Hacks

Fidelity National Information Services subsidiary, Davidson & Company each penalized hundreds of thousands of dollars by regulatory agencies

Two different companies in the past two weeks were fined by regulatory agencies for separate database breaches, totaling well over $1 million. The fines serve as a concrete and eye-opening example of what can happen to a business that fails to lock down its precious data stores, and also a warning that the toothless compliance mandates of yesteryear really do have bite now.

The two breach incidents in question are on opposite ends of the spectrum in regard to cause. The first was an insider breach initiated by a former DBA at Certegy, a wholly owned subsidiary of Jacksonville, Fla.-based Fidelity National Information Services (FIS), which cost the company $975,000 in fines to the Florida Attorney General. The second was an external attack precipitated by a SQL injection exploit against a customer database owned by brokerage firm Davidson & Co., for which the Financial Industry Regulatory Authority (FINRA) fined the firm $375,000.

"In one case it was hackers, and in another case it was an internal employee -- a DBA -- but in both the issue was that they didn't have any real-time monitoring in place. That's how these two stories are related," says Phil Neray, vice president of security strategy of Guardium, an IBM company. "What a SQL injection attack [does] is give the attacker privileged user credentials. So if you're monitoring your privileged users like your DBAs, you're also getting the bonus of monitoring for external threats at the same time."

According to Ponemon Institute, the current average organizational cost of a data breach stands at about $6.75 million. The more extreme case among the two fined companies was Certegy's breach, which shows how database breach costs can really rack up for a company: A malicious insider at the company exposed about 5.9 million customer records. The $850,000 fine levied by Florida to pay its investigative costs and attorney fees, and the additional $125,000 demanded to help fund a statewide crime prevention program, are just a tip of the breach cost iceberg for Certegy. In 2008, the company settled a class-action lawsuit that cost it $4 million. Additionally, the company is now required by the state of Florida to conduct a yearly security assessment.

"There are a lot of costs there, not just in terms of paying for the audits, but in terms of the time and the resources that are going to be required internally to support that audit," Neray explains.

The big fines doled out to Certegy and Davidson & Co. act not only serve as a punishment, but also as a deterrent and warning to others. When it meted out its punishment to Davidson & Co., FINRA had its chief enforcer issue a strong warning to other brokers.

"Broker-dealers must be especially vigilant about protecting its customers' confidential information, which includes ensuring that its technology is sufficient," said James Shorris, executive vice president and executive director of enforcement for FINRA, in a statement. "In this case, the firm placed its database containing confidential customer information on a server that was perpetually exposed to the Internet, but failed to implement basic safeguards to protect that data -- even though the firm had been advised before this incident to implement an intrusion detection system."

Neray believes firms would do well to heed Shorris' warning -- the Davidson & Company breach in his mind is a classic morality tale of the security world. Paying attention to the ramifications of the breach and how it happened in the first place can offer companies a lot of instruction.

"The Davidson breach is a really great example because it has all the classic aspects of cybercrime in the 21st century. It's got hackers in Eastern Europe using Western Union to try to launder the money, and it's got extortion," Neray says. "It's got SQL injection as an intrusion mechanism and ... they were relying on manual reviews of logs, which we know doesn't work because it happens long after the breach has occurred and because there is so much data contained in those logs that a human can't really find suspicious or unauthorized activity easily. And it had a database with a blank password, which if they were using automated vulnerability assessment tools would have been quickly found."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.