Risk
12/16/2010
11:20 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Reputation Can't Be Delegated

A massive e-mail breach affecting Walgreens, McDonald's and others proves that while services can be outsourced, and responsibility delegated - reputation stays with you.

A massive e-mail breach affecting Walgreens, McDonald's and others proves that while services can be outsourced, and responsibility delegated - reputation stays with you.I first became aware of the Walgreens breach about a week ago, when the company sent a notice to me, a "valued customer:"

Dear Valued Customer,

We recently became aware of unauthorized access to an email list of customers who receive special offers and newsletters from us. As a result, it is possible you may have received some spam email messages asking you to go to another site and enter personal data. We are sorry this has taken place and for any inconvenience to you.

We want to assure you that the only information that was obtained was your email address. Your prescription information, account and any other personally identifiable information were not at risk because such data is not contained in the email system, and no access was gained to Walgreens consumer data systems.

Although Walgreens, best I can find out, has yet to validate whether the breach was on its own systems, or those of an outsourced service provider, the breach is most likely related to a very similar breach that affected McDonalds. From Darkreading:

McDonald's said a database containing customer email addresses, birth date information, and phone numbers was compromised when its third-party database firm was discovered to have been hacked. McDonald's was contacted by Arc Worldwide, a firm that handles McDonald's marketing and other promotions, that customer information from some of its websites and promotions had been breached via a hack of a firm that handled the database of McDonald's customer emails. Silverpop reportedly was the breached firm in question, but the companies won't confirm or deny the relationship on the record.

Obviously these stolen e-mails can be sold to spammers and they can be used as part of phishing attacks. Fortunately, for Walgreens customers, it looks like only e-mail addresses were stolen. McDonald's customers apparently had much more information gathered about them.

Software security firm Veracode's CTO, Chris Wysopal had this to say about the breaches in the same Darkreading article:

"The supply-chain risk we are seeing as the increasing specialization of services has companies outsourcing more and even has outsourcers outsourcing. This 'Russian doll' effect means that the biggest doll suffers if any of the smaller dolls has a breach. Outsourcing contracts should require security due diligence on the outsourcer, and subcontracting should trigger more due diligence that passes up the chain."

Great advice. Because the security of your partners - especially if they are handling customer data - is crucial. And it needs to be vetted and contractually enforced. It's not a new problem, but it is an important one.

You can outsource services, and you can even outsource security, but you can never outsource your reputation.

Brian Krebs first broke the news that e-Mail marketers were being targeted. Excellent background is available here.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-0360
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

CVE-2012-1317
Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

CVE-2012-1366
Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

CVE-2012-3062
Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

CVE-2012-3918
Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web