Gordon Woolf's Blog

Changes in the way data is stolen

Some interesting facts in the latest Verizon Data Breach Investigations Report, which, for the first time, for 2010, was a joint report by Verizon and the US Secret Service.

This applies only to breaches within the USA of course, but there are still some lessons for us all.

Firstly, of 84 "confirmed breaches of data security" investigated by the US Secret Service, 66% led to arrests. Not all got the publicity of Albert Gonzalez who was sent to jail for 20 years in March this year for stealing more than 90 million credit and debit card numbers. In fact some received no publicity at all as the companies from which the data was stolen were loathe to have their problems revealed.

Most thefts happened in-house: rogue employees such as programmers were involved in nearly half the cases, but they involved only 3% of the records stolen. In other words, the inside jobs were amall jobs. But the report warned about outsourcing:  "Organizations that outsource their IT management and support also outsource a great deal of trust to these partners."

And there was not a single case involving a foreign government.

SQL database queries were used in more than half the cases: programmed queries that pluck data from the system and send it to the requester. This is a bit like the queries you can set up in Access or the old DBase. It seems to mean that the real problem is in the programming used by a vast majority of businesses.

Keyloggers, the programs that record what users are entering via the keyboard, and which can be hidden in other programs or installed without the user's knowledge from compromised websites, and which are often used to scare users, accounted for only 1% of the stolen data -- down from 80% the year before. So the bad guys have found better ways to steal the info.

And what of the other big scare tactic: keep updating or you'll compromise your computer? Well, Verizon and the Secret Service could not come up with a single case which "exploited a patchable vulnerability."

One wonders however whether companies are keeping as close a watch on their data as we might reasonable expect. The report states: "Third-party fraud detection is still the most common way breach victims come to know of their predicament".

As Woody Leonhard states in the Windows Secrets newsletter: "Companies learn of breaches when customers report them. So if you think your data's been stolen, holler yer head off!"

The biggest typo of all

A typo is a typesetting error, and Typo is a book about the biggest typesetting error of all time. The Full title is Typo: The last American Typesetter or how I lost 4 million dollars. And actually, on the cover the subtitle is typeset as “...or how I made 4 million dollars” but made is crossed through with the common handwritten correction mark for delete and above it is the insert mark and the word “LOST” is written in. That has led to the book being listed on Amazon as Typo: The Last American Typesetter or how I made & Lost 4 million dollars. It is appropriate that such an error creeps in. This is a true story in as much as it is author David Silverman’s account as one of the two people who borrowed to buy the Clarinda typesetting company at a time when the industry was going bad. He and mentor Dan Coyne were sure they could save not only Clarinda but by taking over the rest of the industry in the US and combining work in the US with outsourcing to Manilla they could stave off the disappearance of US typesetting to India. It almost worked, and might have if they had not had to deal with publishers and their own staff. This is not just a book for people in the printing and publishing industries -- it has lessons for anyone who runs a business and especially anyone who has ever moved in to an existing enterprise as “the new boss”. I can sympathise as David deals with situations such as the internal financial controller who just refuses to introduce new systems and makes sure that anything new does not work. As the new manager of a newspaper I had an office manager who almost every night, as I found out later, was phoning the owner to ask “has Gordon the right to do that” and similarly making sure new methods always  seemed to fail. David faced the same reluctance to sack anyone, let alone people he suspected were refusing to co-operate in any efficiencies. And there were inefficiencies galore. A woman was employed to check every laser printout of an online file with the original printout from the publisher because years ago laser printers would sometimes substitute Courier for some typefaces. Then the printout pages were numbered with one of those old fashioned numeric stampers because a printout could be dropped on the floor and they’d have to recollate, despite that having happened once in several years (and would take maybe an hour or two to put right). Even worse, should that woman be away, a senior typesetter would take over her job leaving them one down in the only department which might have been making money. The IT technician certainly installed the new 100MB network cables, but connected only four wires at each device, so that the system continued to run at 10MB (a new tech was amazed that it had worked at all). A fireproof storage room contained Syquest disks from the 1970s while current backup tapes lay on the floor outside. A fireproof filing cabinet was empty save for a key which did not fit anything they could find. The litany of these things covers three pages which every company tech and director should read even if they ignore the rest of the book. (Do a search on “rubber bands” in the look-inside section on the book’s Amazon page). Such items from David’s experiences make for a laugh but I’ve seen such things and I’m sure they are true for many, many businesses today. Then there were the publishers who refused to send work if it might be outsourced to Manilla despite being almost sure that other typesetters they did use are subcontracting to India. There’s also a slowly dawning realization for David that although their Manilla office seems to be the only section making a profit, it is still a high cost operation compared to India. You’ll know so many of these people: the salesman who persuades a client to phone threatening to take away their work if the salesman is sacked who David has to tell has not given them any orders for two years. The meals booked as expenses which turn out to be meals for one. The manager who keeps a van driving daily between offices long after all urgent work has gone electronically. But all these problems surfaced only when it was too late. In the early stages the new owners were intent on the big picture, increasing sales -- unable to get from an ancient accounting system the facts such as that for every extra book put through the typesetting system at even the most efficient of their US offices was losing money. The only profit source seems to have been corrections because of high fees and a hit-or-miss system which meant that invoices bore little relationship to the actual work. Typo: The last American Typesetter or how I lost 4 million dollars, by David Silverman, published in the US by Soft Skull Press, 2007 and in Australia by Scribe Publications, 2008. For more info and extracts including videos see http://agman.com/