Perimeter
7/8/2011
01:58 PM
Rob Enderle
Rob Enderle
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Murdoch Kills 'News of the World': The Coming Security Backlash

News Corp. scandal demonstrates massive shift in how privacy is perceived

It was interesting to watch News Corpo.’s response to the voicemail hacking allegations -- this practice had been going on for years. It appeared to be a current event with enough magnitude to kill one of the publishing firm's most successful businesses.

What happened wasn’t that the crime changed, but that people’s perception of the crime changed, and what was allowed suddenly wasn’t. The environment continues to be very hostile to companies that violate privacy, and companies like Google and Facebook that trade in personal information are at risk. They aren’t the only ones: We can see the problems Sony is having and the fact this could drift to anyone (like the carriers who controlled the voice mail systems) who gets breached.

Voicemail is normally provided by a carrier, but it could be provided by a company or a government. In either case, a breach that exposed a protected person (civil servant or soldier who died on duty, suicide victim, child, disabled person, elderly person, etc.) could result in a backlash not just against the attacker, but against the organization that didn’t adequately secure the service.

Given News Corp.’s reach and business, and the need for it to switch the focus off of it, the likely target would be the service providers who were breached, and News Corp. has the reach and resources to pull off this change.

But even if it doesn’t, anyone who provided a service that is seen as inadequately secure is at risk, and the real problem is that the bar for “inadequate” is dropping like a rock. What seemed acceptable last week no longer seems acceptable today, and one big public breach could result in a massive backlash. You could actually be more secure than a competitor, but if it is your company that gets hit, it is your company that could be in front of a Senate committee or on the wrong side of a class action suit like Sony.

Clearly, part of this is making sure security of personal information is at an acceptable level of risk by balancing the likely chance you’ll have an event like this with the level of effort you are making to secure the critical personal information.

This suggests having in place response plans for when the event occurs that immediately focuses on going after the attackers who penetrated the company. It would also message out the firm or entity as a victim and can articulate what has been done to secure the information as reasonable.

This is all about managing perceptions, and I think News Corp. got this wrong. The firm should have fired and filed criminal charges against the employees who committed the acts against protected people, but defended those that went after public figures under freedom of press rules.

The effort should have been to make this look like a few people didn’t understand that those who are aren’t public figures are off-limits. Shutting down the entire paper makes them look guilty. The response makes this actually appear more like a cover-up, where they are attempting to burn the evidence, and it isn’t playing out well -- likely because News Corp. didn’t have in place a contingency play for an investigation method blowing up on them.

What we often forget about security is that a good portion of the effort is about managing perceptions. If people feel secure, then they think you are doing a good job. If they don’t, then you aren’t, and often there is little relation to how secure they are to how secure they feel.

Given the rapid proliferation of breaches, plans to deal with the media aspect of the breach and to focus anger on the attacking -- rather than the defending -- organizations would be wise for those of us on the defense side.

Rob Enderle is is president and founder of The Enderle Group. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-0460
Published: 2014-04-16
The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.

CVE-2011-0993
Published: 2014-04-16
SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2011-3180
Published: 2014-04-16
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

CVE-2011-4089
Published: 2014-04-16
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

CVE-2011-4192
Published: 2014-04-16
kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwi_oemtitle of .profile."

Best of the Web