2011 is turning out to be a bad year when it comes to the amount of ‘records’ lost through security breaches. Searching around the web for information I’ve found a lot of resources that give details, but this article from networknewz.com, posted by Joe Purcell, puts it into perspective on the first couple of paragraphs, and has links to details on the breaches. Here are some of breaches from 2011, from the post. For the entire list, with links to the details go to the source of the article here:
1.29 million Sega accounts
100 million or more Sony accounts
Potentially, the email accounts of over 2,500 companies serviced by Epsilon
360,083 bank accounts at Citigroup
280,000 accounts at Honda
1.2 million accounts at the Texas Comptroller’s office
114,000 accounts of iPad 3G owners
40 million or more RSA SecurID tokens issued by EMC to over 30,000 companies and government agencies, including half of US banks that use SecurID tokens
It’s quite scary to not only how many user accounts are compromised, but also (not mentioned in this article), how long it has taken certain entities to get their infrastructure back online. One has to assume that the issues were massive for it to have taken so long, perhaps? (supposition)
You also have to ask if these were preventable. By nature it’s almost impossible to stay one step ahead of attackers. With undisclosed vulnerabilities, let alone Zero-day vulnerabilities it is all you can do to follow the flow. Bearing in mind the human factor is a huge influence on this field, and it almost feels like herding cats while chasing your own tail.
Readiness – Red Teams – constant self assessments – audits – reaction drills – forensics – so much to be done with probably little budget, and sometimes little concern. I’ve said it a few times here, if we (security leaders) cannot convince senior leadership of the risk, should we be in that role? The variables are things like – it doesn’t matter how good you are, they still won’t listen – I guess then it’s time for a career change, if not at least a company change? Do we (you) have the balls to escalate your fears to the board? Should you?
For fear of rambling on, suffice it to say 2011 has been a bad year for breaches. Perhaps companies will notice now, that you really do need to be aware and in control of information security to stand any chance of staying secure.
