Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV

11/20/2017
05:51 PM
Curtis Franklin
Curtis Franklin
Curt Franklin
50%
50%

It's Inevitable: You've Been Hacked

If your personal information is available on the Internet, you should assume that a hacker has it.

The notion that every organization has a perimeter that has been breached isn't new. And much of modern security is how to deal with that. But take it a step further: What do you do when every employee, customer and partner has personal info that has been hacked?

That's the question posed by a press conference given by members of the agencies fighting cyber crime in the UK. Peter Goodman, the National Police Chiefs' Council lead for cyber crime, reported that his personal information has been stolen three times [registration required] and that virtually every computer user in the UK has had personally identifiable information (PII) stolen and sold on the dark web.

For those fighting against PII theft and other cyber crime, the idea that everyone's information is already on the dark web is disheartening, akin, in some ways, to declaring that the security war has already been lost. It's not impossible, though, to find those who aren't ready to wave a white flag and succumb to depression when it comes to computer security.

Some gain their optimism from a sense that the scale of information loss has been over-stated. In a statement to Security Now, the CEO of High-Tech Bridge, Ilia Kolochenko, said, "Digitalization has become an inalienable part of our everyday lives. Even people who have never used a PC or a smartphone have their personal data stored and processed somewhere. Cybercrime is skyrocketing, and the vast majority of digital systems have been breached. However, I think that it's technically incorrect to say that every person was hacked, as our common notion of 'hack' implies at least some motive and targeting."

This notion, that there hasn't been specific targeting involved with absolutely everyone's information, is part of what gives others hope, as well. In conversations this author has had with a number of cybersecurity professionals, many have expressed the opinion that there is now so much basic information out on the dark web that any given individual's chances of being a victim are still small. Think of it as the "bait ball" theory of cyber defense.

And that brings us to the "what does this mean for my organization?" part of the proceedings. One of the big things is that basic PII has little value for most criminals; the valuable information is all of the enriched data that comes from specific financial or healthcare records. Those, then, must be highly protected precisely because they contain the sort of data that allows for targeted attacks against individuals.

Because a given individual might still be the target of an attack, security systems must be even more vigilant about recognizing and responding to account breaches and mis-uses. Recognition, response and mitigation must be built into systems -- and especially automated systems -- so that they will be able to prevent criminal activity from becoming catastrophic for individuals and organizations.

In one sense the war is, indeed, lost. If information is accessible from the Internet, the only safe assumption is that it can be accessed by unauthorized individuals. Intelligent use of automated systems will mean that access doesn't become loss -- and that the vast bait ball of Internet users swims on, undisturbed.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15058
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.
CVE-2020-15059
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.
CVE-2020-15060
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15061
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values.
CVE-2020-15062
PUBLISHED: 2020-08-07
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.