Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
How South Carolina Failed To Spot Hack Attack
Newest First  |  Oldest First  |  Threaded View
PJS880
PJS880,
User Rank: Ninja
12/10/2012 | 3:12:58 PM
re: How South Carolina Failed To Spot Hack Attack
Putting aside all that the IRS and state were supposed to do such as the breech detection system, this would not have been such a big deal had all the social security numbers were encrypted. Really 1.2 million social security numbers sitting on a system with basically no security measurements at all to alert IT of intruders? Every IT individual who is involved in this system from a security standpoint, is responsible for this breech. Weather they lacked the knowledge or lacked the enthusiasm to speak up or purpose some form of security, is not an acceptable excuse for a breech f this magnitude.

Paul Sprague
InformationWeek Contributor
moarsauce123
moarsauce123,
User Rank: Ninja
11/29/2012 | 12:35:13 PM
re: How South Carolina Failed To Spot Hack Attack
That is just passing the buck. SC officials are just recklessly inept when it comes to securing data. Maybe the bare minimal standard does not require encryption, but common sense does. And if the standard is indeed that flawed it needs to be fixed before the end of the year and implemented across the nation in Q1 2013. If there is one state administration that is so clueless I bet that there are 49 more - plus the IRS.
KatieSC
KatieSC,
User Rank: Apprentice
11/26/2012 | 11:11:29 PM
re: How South Carolina Failed To Spot Hack Attack
I hope people realize that credit monitoring services do not protect from identity fraud. This data breach will be a life-long problem for residents of South Carolina and a huge headache for banks. I hope those banks will look into the Personal Firewall Project to protect their customers.
Number 6
Number 6,
User Rank: Apprentice
11/26/2012 | 7:09:29 PM
re: How South Carolina Failed To Spot Hack Attack
They criticized the IRS for not requiring them to encrypt SSN's? So S.C. state officials are saying they need Big Government to tell them what to do? Oh, the irony.
Deirdre Blake
Deirdre Blake,
User Rank: Apprentice
11/26/2012 | 4:20:25 PM
re: How South Carolina Failed To Spot Hack Attack
Makes you wonder how many successful attacks/thefts have gone undetected elsewhere....
Deirdre Blake
Managing Editor, Dr. Dobb's


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Black Hat USA 2022 Attendee Report
Black Hat attendees are not sleeping well. Between concerns about attacks against cloud services, ransomware, and the growing risks to the global supply chain, these security pros have a lot to be worried about. Read our 2022 report to hear what they're concerned about now.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-35606
PUBLISHED: 2022-08-18
A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameter 'customerCode.'
CVE-2022-35598
PUBLISHED: 2022-08-18
A SQL injection vulnerability in ConnectionFactoryDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter username.
CVE-2022-35599
PUBLISHED: 2022-08-18
A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter productcode.
CVE-2022-35601
PUBLISHED: 2022-08-18
A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter searchTxt.
CVE-2022-35602
PUBLISHED: 2022-08-18
A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter user.