Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

6/23/2006
05:15 AM
50%
50%

Data Loss Epidemic

Data losses at major corporations and government agencies are being reported almost every day now

1:25 PM -- As an IT security journalist, I'm amazed. As an ordinary consumer, I'm downright frightened.

In the last week alone, five major insurance and financial services companies and one government agency have admitted to losing or exposing the personal information of their customers through lax or careless security behavior. Most of these losses occurred not through the ingenuity of attackers, but through the boneheaded behavior of corporate employees – and, in some cases, their IT departments.

We started off the week with the news that ING had lost the names, Social Security numbers, and other data of 13,000 District of Columbia employees when a laptop was stolen from an ING agent living in the D.C. area. (See DC Workers' Personal Data Stolen.)

The laptop was not password-protected, and the data was not encrypted. That loss came just weeks after a similar theft resulted in the loss of 26.5 million veterans' personal information from a laptop owned by a D.C.-area employee of the Department of Veterans Affairs. (See VA Data Loss Worse Than Expected.)

(Note to myself, a D.C.-area resident: Buy new locks for the doors.)

Then, a day later, insurance giant AIG admitted that a break-in back in March had resulted in the loss of a file server containing personal data on some 970,000 of its customers. The data on the server was not encrypted, and AIG said most of the data shouldn't have been given to the company anyway. (See Thieves Nab AIG Customer Records.)

Was that the end of the wave? Not by a longshot. By Thursday, three more companies – Visa, Wachovia, and Equifax – had notified customers of laptop thefts or security violations that may have resulted in the loss of personal data for thousands more customers.

Aside from the sheer coincidence of these major data losses, the most amazing thing about the week's events is the lack of security policy enforcement that occurred (or didn't occur) to create the problems in the first place: Users walking out of the office with thousands of customer records on completely unprotected laptops; and huge caches of data that were never encrypted – or even known about.

How many more hits do companies have to take before IT wises up and gets tough on enforcing security policies?

Apparently, at least a few more. Many of the companies violated this week said they are only just embarking on policy enforcement and training programs to clean up the problem. Credit card vendors report that as many as 90 percent of retailers still aren't complying with guidelines for securing user credit information. (See Retailers Lag on Security Standard.) This thing is likely to get worse before it gets better.

Before you click to the next page, ask yourself the question: Is my customers' data truly safe? The answer may amaze you – or even frighten you.

— Tim Wilson, Site Editor, Dark Reading

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Is Zero Trust the Best Answer to the COVID-19 Lockdown?
Dan Blum, Cybersecurity & Risk Management Strategist,  5/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: WHO FARTED?!#
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13485
PUBLISHED: 2020-05-25
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
CVE-2020-13486
PUBLISHED: 2020-05-25
The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.
CVE-2020-13482
PUBLISHED: 2020-05-25
EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
CVE-2020-13458
PUBLISHED: 2020-05-25
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action.
CVE-2020-13459
PUBLISHED: 2020-05-25
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.