Gordon Woolf's Blog

Changes in the way data is stolen

Some interesting facts in the latest Verizon Data Breach Investigations Report, which, for the first time, for 2010, was a joint report by Verizon and the US Secret Service.

This applies only to breaches within the USA of course, but there are still some lessons for us all.

Firstly, of 84 "confirmed breaches of data security" investigated by the US Secret Service, 66% led to arrests. Not all got the publicity of Albert Gonzalez who was sent to jail for 20 years in March this year for stealing more than 90 million credit and debit card numbers. In fact some received no publicity at all as the companies from which the data was stolen were loathe to have their problems revealed.

Most thefts happened in-house: rogue employees such as programmers were involved in nearly half the cases, but they involved only 3% of the records stolen. In other words, the inside jobs were amall jobs. But the report warned about outsourcing:  "Organizations that outsource their IT management and support also outsource a great deal of trust to these partners."

And there was not a single case involving a foreign government.

SQL database queries were used in more than half the cases: programmed queries that pluck data from the system and send it to the requester. This is a bit like the queries you can set up in Access or the old DBase. It seems to mean that the real problem is in the programming used by a vast majority of businesses.

Keyloggers, the programs that record what users are entering via the keyboard, and which can be hidden in other programs or installed without the user's knowledge from compromised websites, and which are often used to scare users, accounted for only 1% of the stolen data -- down from 80% the year before. So the bad guys have found better ways to steal the info.

And what of the other big scare tactic: keep updating or you'll compromise your computer? Well, Verizon and the Secret Service could not come up with a single case which "exploited a patchable vulnerability."

One wonders however whether companies are keeping as close a watch on their data as we might reasonable expect. The report states: "Third-party fraud detection is still the most common way breach victims come to know of their predicament".

As Woody Leonhard states in the Windows Secrets newsletter: "Companies learn of breaches when customers report them. So if you think your data's been stolen, holler yer head off!"

Email: the world will know

One of this country's senior politicians has just found that emails may not be what they seem. In particular a forwarded email may be changed easily before it is forwarded. That should be a warning to everyone who uses email.

To start from the basics: There's a simple Law of Email, which states "Never send anything that you wouldn't want the whole world to know".

They are easy to copy, easy to change, easy to get out of even secure offices since the introduction of USB sticks, which has led some companies to disable the USB ports on their computers, a method which causes more problems than it solves.

Encryption should be used if you are sending confidential information by email, but encryption does not assure security since it has to be decrypted at some stage ("Decryption" rather than the unencryption which I've seen many times). Emails may be decrypted on the main mail server which offers little security within an office.

There are better ways, one of the simplest being to create a PDF of a document, encrypt that and sign it digitally. Warning: simply requiring a password to open a PDF is not securing it; a Google search will reveal programs that will ger around that (which I've needed to do to get an ad into a magazine that was secured by a foolish designer).

If you have this kind of material then you'll need to study the Acrobat help files. There are also some examples of commercial software programs that will make it a simpler task.

On the other hand, there are authors and others who are so scared of someone stealing a single copy of their ebook that they make access difficult for the people who have paid for the file. I would quote from my own experience when running a milk bar/convenience store. If you put a box of lollies on the counter they will sell, but a proportion will be stolen -- move them to the back or anywhere where the customer cannot easily pick them up and they stop selling. There will be a point at which theft is too great but it will always be worth losing a few.

It can also reflect on the trust between a business owner and his customers. In my book Success in Store there are two examples of the relationship between my wife and some local high school students who came regularly for fish and chips. In the first, they left wrappers and cans by the seats on the footpath until one of them saw my wife go out to clean up their mess as they left. "Do you have to do that?" one asked. No one else will do it, she said, and from that day there was no more mess; everything went in the bins.

Similarly, a sheepish youngster returned to hold out a confectionary packet, saying he'd forgotten to pay. Next day one of the other students asked if he'd returned to pay. "He told us on the way back to school and we said 'you don't do that there'."

Fair dealing will do a lot to reduce problems of theft but that does not help with the general continued availability of email and its likelihood to spread far beyond its original intended use.

A recent search for my name in Google, and going far beyond the first two or three pages where most of us stop searching, came up with an email I wrote in 1996 which is 13 years ago, long before the Internet was anything like it is today, and in the earliest days of the web when many exagerated claims were being made about "hits" on web sites. If you are interested, that email is at http://open4success.net/Olnews/mbox2/282.html

That was not the start of email for me as I'd already been using it for the best part of a decade; at that time the problem was that there were not many people you could send emails to but I did use an email-to-telex service to submit articles to some publishers.

In all that time, there have been regular warnings that normal email is the least secure communications system of all. At least with phone recordings you can be fairly sure that what is heard is what you said, and there are legal safeguards on what can be used. With email, forgery is simple, and preservation and distribution is even more simple.
 

Keeping updated on updates

Quite often I seem to come across references to an updated version of a program I use, and occasionally with some rather scary references to security holes which have been patched by the newer version. I'm never quite convinced that the dangers are as dire as the news stories imply but I do wonder why I was not aware of the updates. The older version of AdAware is one program which will not even tell you that there is a new version, even when you tell it to check updates -- even to the extent that one version just stopped advising of updates to the old version without telling you that there were no updates because there was a new version of the entire program. So how can you keep updated on updates. One suggestion is a program called Securia, described as a "Personal Software Inspector". It certainly gives you a warning if a new version of a very wide range of programs you are likely to have installed. Not only that, it can be used to go directly to the program site, download the update and install it, all at the press of one button. That's great, but the one program it did not tell me had been updated was itself. In order to write this, which was supposed to be an item of praise for the way it worked, I clicked on the link to go to their website and found that I was 2 minor versions behind! All I can say is that at least it is free, for single personal use. (I did subsequently notice that the updates are for minor bug fixes, and an upgrade is said to be not necessary if it is running without problems). If you are interested, it can be downloaded from http://secunia.com/vulnerability_scanning/Personal/ but I'd suggest it may be most useful as a one-off check, You may be surprised just how many of your programs have had updates because of security issues... updates about which you knew nothing.