Insider threat to data security

Referring again to the  Verizon 2010 Data Breach Investigations Report, it shows that 48% of data breaches involved some sort of insider in the organization.
Two example of this were reported on the Office of Inadequate Security website recently. Both cases allegedly involve insiders abusing their access privileges to data.

• Twelve indicted in $10 million bank fraud conspiracy operated by a “network” that included bank employees.
• Bank employee accused of selling account numbers.

The lesson here is that all data access must be audited. The audit information must be stored in a secure location in order to allow for report generation and, if necessary, to carry out forensic analysis at a future date. Once an appropriate data access policy is implemented, employees should be advised that it exists. This in itself acts as a deterrent to anyone thinking of wrongfully accessing or modifying data.

Another database compromised in Ireland

Irish recruitment website Recruit Ireland was taken offline on the Feb 8th following the discovery that it's database had been compromised and it is suspected that names and email addresses were stolen for spamming purposes ( Data breach at recruitment site )There are no details yet of how the attach on recruitireland.com took place or when it took place.

On Jan 10, the website of the political party Irish Fine Gael was hacked and 2000 email addresses were stolen from it.

  

Here are few point to consider on the topic of securing the data in your databases:

• Database security is the poor cousin of network security and PC/laptop security. The networks are locked down with firewalls. PCs/laptops have virus scanners, personal firewalls, spyware protection, etc. It's no longer enough to rely on these security measures at the perimeter of the organisation in order to secure the data in the database.  A website that displays / adds / updates data in the database can provide that attacker with a route into the database.
• Remember if one laptop gets stolen you loose all the data on that laptop but if the intruders make it to your database then all your data is compromised. 

So

 

Carry out a security audit on your database(s) to discover:

• Who (people) / what (applications) uses them
• What data they look at / change
• What level of access to data that each user / application has
• What level of access to data that each user / application actually require
• Who are your privileged users (DBAs, system administrators, developers, applications) and how can you monitor what they are doing? 
• Follow a check-list to lock your database down (e.g. change default passwords, close old accounts, etc.)

 
Having your database locked down is not then end of the story. You need to actively maintain it's security and monitor it for suspicious activity.

• Keep database software patches up to date. If you run a 24/7 operation this will require a lot of planning because more than likely some downtime will be required.
• You will need to audit the database activity in order to have an audit trail for forensic analysis if a data breach occurs.
• Protect your audit trail from privileged users.
• Actively monitor database activity to identify any suspicious activity and notify the system administrators in real time. The last thing you want is to discover a data compromise days or weeks after it happened at which stage your customers know about it before you did.
• Audit the activity of privileged users (DBAs / application). Administrators may not like the idea of being monitored but if there is a data breach then they will be suspect. If a clear audit train exists then the administrators can be ruled out quickly.
• Identify unusual changes to the database schemas. This may indicate that an attacker is copying data into a table that they created in order to get it out of the system.
• Consider encrypting your database data files. If the intruder has access to your operating system but not your database then they could steal the database data files and extract the data from them without having logon credentials to the database. It makes it more difficult but this is still possible.
• Encrypt your database backups. If not then an intruder could steal your backup and restore the whole database on their own system.

There are more steps to secure and monitor the database but these ones above are just to get people thinking about what should be done. It will cost time and money to properly secure the data in your databases but this must be compared against the cost of a data compromise - cost of tidy up, fines & reputation damage.

Fine Gael and database security

Yesterdays hack of the Fine Gael website (http://finegael2011.com/) has highlighted the need for individuals and organizations who collect  personal data in Ireland to be aware that they must to take all steps that they can to protect this data.  Full details on these obligations can be found on the Data Protection Commissioners website www.dataprotection.ie.

There has been no details of the security vulnerability that was exploited yet but to me it sounds like a SQL Injection attack.

Verizon 2010 Data Breach Investigations Report

I have just looked through the Verizon 2010 Data Breach Investigations Report http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf

It was published 6 months ago but there are 2 interesting points in it for me

The first point comes from "Table 7 Types of compromised assets by percent of breaches and percent of records" on page 39. It shows that while the database server accounts for 25% of compromised assets it accounts for a huge 92% of compromised records. This shows that once the attacker gets to your database they have access to the crown jewels.

The second point comes from "Figure 42. Cost of recommended preventive measures by percent of breaches" which shows the cost of implementing the preventive measures once the breach was discovered. The cost to prevent 64% of the breaches was considered "simple and cheap" . This counters the argument that it would cost too much to implement full data protection policies. "Figure 43. Categorization of recommended mitigation measures by percent of breaches" goes on to shows that 66% of breaches could have been prevented by "Configuration change to existing assets" and "alter existing practice".

Attackers will generally go for the lowest hanging fruit and from this Verizon report it looks like there is still plenty of it around.