Risk
12/16/2010
11:20 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Reputation Can't Be Delegated

A massive e-mail breach affecting Walgreens, McDonald's and others proves that while services can be outsourced, and responsibility delegated - reputation stays with you.

A massive e-mail breach affecting Walgreens, McDonald's and others proves that while services can be outsourced, and responsibility delegated - reputation stays with you.I first became aware of the Walgreens breach about a week ago, when the company sent a notice to me, a "valued customer:"

Dear Valued Customer,

We recently became aware of unauthorized access to an email list of customers who receive special offers and newsletters from us. As a result, it is possible you may have received some spam email messages asking you to go to another site and enter personal data. We are sorry this has taken place and for any inconvenience to you.

We want to assure you that the only information that was obtained was your email address. Your prescription information, account and any other personally identifiable information were not at risk because such data is not contained in the email system, and no access was gained to Walgreens consumer data systems.

Although Walgreens, best I can find out, has yet to validate whether the breach was on its own systems, or those of an outsourced service provider, the breach is most likely related to a very similar breach that affected McDonalds. From Darkreading:

McDonald's said a database containing customer email addresses, birth date information, and phone numbers was compromised when its third-party database firm was discovered to have been hacked. McDonald's was contacted by Arc Worldwide, a firm that handles McDonald's marketing and other promotions, that customer information from some of its websites and promotions had been breached via a hack of a firm that handled the database of McDonald's customer emails. Silverpop reportedly was the breached firm in question, but the companies won't confirm or deny the relationship on the record.

Obviously these stolen e-mails can be sold to spammers and they can be used as part of phishing attacks. Fortunately, for Walgreens customers, it looks like only e-mail addresses were stolen. McDonald's customers apparently had much more information gathered about them.

Software security firm Veracode's CTO, Chris Wysopal had this to say about the breaches in the same Darkreading article:

"The supply-chain risk we are seeing as the increasing specialization of services has companies outsourcing more and even has outsourcers outsourcing. This 'Russian doll' effect means that the biggest doll suffers if any of the smaller dolls has a breach. Outsourcing contracts should require security due diligence on the outsourcer, and subcontracting should trigger more due diligence that passes up the chain."

Great advice. Because the security of your partners - especially if they are handling customer data - is crucial. And it needs to be vetted and contractually enforced. It's not a new problem, but it is an important one.

You can outsource services, and you can even outsource security, but you can never outsource your reputation.

Brian Krebs first broke the news that e-Mail marketers were being targeted. Excellent background is available here.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-0334
Published: 2014-10-31
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

CVE-2014-2334
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2335
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2336
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.

CVE-2014-3366
Published: 2014-10-31
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.