Lessons Learned From Five Big Database Breaches In 2010

The stream of database exposures remained steady in the second half of 2010: We saw organizations face the consequences of inept database account provisioning, bad encryption policies, poor choice of third-party vendors, and an overall indifference to security -- all of which continued to keep consumers on the watch for blips in their credit reports.

According to the recent Computing Technology Industry Association's (CompTIA's) 8th Annual Global Security Trends Study, only about half of IT professionals view security as a major priority. It's no surprise, then, that the survey found 63 percent of their companies have experienced some kind of breach this year.

In July, we explored some of the most glaring database breaches in the first half of 2010. Now we'll take a look at how we can learn from the incidents that have occurred since then.

1. Sheriff's Office in Mesa County, Colorado
Breach Details: The Sheriff's Office in Mesa County, Colo., potentially put people's lives at risk due to an IT snafu. The office exposed names, contact information, and Social Security numbers of drug informants when an IT staffer mistakenly put the extremely sensitive database containing this information onto an unsecure FTP site on a server owned by the county. The database contained 200,000 files. The county came to find out about the problem when an informant on the database saw the informants' names popping up on a Google search -- the search engine's crawler had been going through the FTP site.

Database Security Lessons Learned: This is a particularly egregious example of what can happen when organizations aren't mindful about where and how databases are stored. Organizations need to endeavor to have a better understanding of where their databases reside (including test databases) and how they're configured to better ensure the most top secret of information isn't mistakenly left online.

2. Ohio State University
Breach Details: A database server containing the personal information of more than 760,000 students, faculty, and alumni at Ohio State University was hacked in an attack the university says was likely not for the information itself. School officials say preliminary information shows the server was used to launch attacks on some unnamed business. Even though the school says it doesn't believe the information was accessed, OSU offered a year of free credit monitoring for all affected by the breach.

Database Security Lessons Learned: Universities are increasingly becoming the leading headliners in news of high-profile database breaches. The particulars of this attack are still forthcoming, however the university did say it had been ongoing for months before it was discovered. Better monitoring of the server and database itself could have potentially alerted officials earlier and provided better evidence about whether database records were improperly accessed.

3. Gawker
Breach Details: An embarrassing breach that exposed the log-in credentials of 1.3 million Gawker users was caused by hackers with a grudge against the site. By exploiting a vulnerability in the Gawker website source code and using that weakness to dig deeper into its main user database, attackers gained enough information to publicly shame Gawker and its poor security practices.

Database Security Lessons Learned: Gawker's security inadequacies offer good lessons for plenty of other organizations. The firm had little to no patch management procedures in place, mishandled sensitive information, and had no password policies in place for internal users. Most glaringly, it was using the extremely antiquated DES encryption method for user passwords stored within the database, making them easily crackable once the database was accessed.