Perimeter
7/8/2011
01:58 PM
Rob Enderle
Rob Enderle
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Murdoch Kills 'News of the World': The Coming Security Backlash

News Corp. scandal demonstrates massive shift in how privacy is perceived

It was interesting to watch News Corpo.’s response to the voicemail hacking allegations -- this practice had been going on for years. It appeared to be a current event with enough magnitude to kill one of the publishing firm's most successful businesses.

What happened wasn’t that the crime changed, but that people’s perception of the crime changed, and what was allowed suddenly wasn’t. The environment continues to be very hostile to companies that violate privacy, and companies like Google and Facebook that trade in personal information are at risk. They aren’t the only ones: We can see the problems Sony is having and the fact this could drift to anyone (like the carriers who controlled the voice mail systems) who gets breached.

Voicemail is normally provided by a carrier, but it could be provided by a company or a government. In either case, a breach that exposed a protected person (civil servant or soldier who died on duty, suicide victim, child, disabled person, elderly person, etc.) could result in a backlash not just against the attacker, but against the organization that didn’t adequately secure the service.

Given News Corp.’s reach and business, and the need for it to switch the focus off of it, the likely target would be the service providers who were breached, and News Corp. has the reach and resources to pull off this change.

But even if it doesn’t, anyone who provided a service that is seen as inadequately secure is at risk, and the real problem is that the bar for “inadequate” is dropping like a rock. What seemed acceptable last week no longer seems acceptable today, and one big public breach could result in a massive backlash. You could actually be more secure than a competitor, but if it is your company that gets hit, it is your company that could be in front of a Senate committee or on the wrong side of a class action suit like Sony.

Clearly, part of this is making sure security of personal information is at an acceptable level of risk by balancing the likely chance you’ll have an event like this with the level of effort you are making to secure the critical personal information.

This suggests having in place response plans for when the event occurs that immediately focuses on going after the attackers who penetrated the company. It would also message out the firm or entity as a victim and can articulate what has been done to secure the information as reasonable.

This is all about managing perceptions, and I think News Corp. got this wrong. The firm should have fired and filed criminal charges against the employees who committed the acts against protected people, but defended those that went after public figures under freedom of press rules.

The effort should have been to make this look like a few people didn’t understand that those who are aren’t public figures are off-limits. Shutting down the entire paper makes them look guilty. The response makes this actually appear more like a cover-up, where they are attempting to burn the evidence, and it isn’t playing out well -- likely because News Corp. didn’t have in place a contingency play for an investigation method blowing up on them.

What we often forget about security is that a good portion of the effort is about managing perceptions. If people feel secure, then they think you are doing a good job. If they don’t, then you aren’t, and often there is little relation to how secure they are to how secure they feel.

Given the rapid proliferation of breaches, plans to deal with the media aspect of the breach and to focus anger on the attacking -- rather than the defending -- organizations would be wise for those of us on the defense side.

Rob Enderle is is president and founder of The Enderle Group. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.