Risk
12/16/2010
11:20 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Reputation Can't Be Delegated

A massive e-mail breach affecting Walgreens, McDonald's and others proves that while services can be outsourced, and responsibility delegated - reputation stays with you.

A massive e-mail breach affecting Walgreens, McDonald's and others proves that while services can be outsourced, and responsibility delegated - reputation stays with you.I first became aware of the Walgreens breach about a week ago, when the company sent a notice to me, a "valued customer:"

Dear Valued Customer,

We recently became aware of unauthorized access to an email list of customers who receive special offers and newsletters from us. As a result, it is possible you may have received some spam email messages asking you to go to another site and enter personal data. We are sorry this has taken place and for any inconvenience to you.

We want to assure you that the only information that was obtained was your email address. Your prescription information, account and any other personally identifiable information were not at risk because such data is not contained in the email system, and no access was gained to Walgreens consumer data systems.

Although Walgreens, best I can find out, has yet to validate whether the breach was on its own systems, or those of an outsourced service provider, the breach is most likely related to a very similar breach that affected McDonalds. From Darkreading:

McDonald's said a database containing customer email addresses, birth date information, and phone numbers was compromised when its third-party database firm was discovered to have been hacked. McDonald's was contacted by Arc Worldwide, a firm that handles McDonald's marketing and other promotions, that customer information from some of its websites and promotions had been breached via a hack of a firm that handled the database of McDonald's customer emails. Silverpop reportedly was the breached firm in question, but the companies won't confirm or deny the relationship on the record.

Obviously these stolen e-mails can be sold to spammers and they can be used as part of phishing attacks. Fortunately, for Walgreens customers, it looks like only e-mail addresses were stolen. McDonald's customers apparently had much more information gathered about them.

Software security firm Veracode's CTO, Chris Wysopal had this to say about the breaches in the same Darkreading article:

"The supply-chain risk we are seeing as the increasing specialization of services has companies outsourcing more and even has outsourcers outsourcing. This 'Russian doll' effect means that the biggest doll suffers if any of the smaller dolls has a breach. Outsourcing contracts should require security due diligence on the outsourcer, and subcontracting should trigger more due diligence that passes up the chain."

Great advice. Because the security of your partners - especially if they are handling customer data - is crucial. And it needs to be vetted and contractually enforced. It's not a new problem, but it is an important one.

You can outsource services, and you can even outsource security, but you can never outsource your reputation.

Brian Krebs first broke the news that e-Mail marketers were being targeted. Excellent background is available here.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5208
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

CVE-2014-7286
Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

CVE-2014-8015
Published: 2014-12-22
The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400.

CVE-2014-8017
Published: 2014-12-22
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.

CVE-2014-8018
Published: 2014-12-22
Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555, CSCur1...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.