BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

How Sensitive Could Data Be?

Posted March 25, 2011    Peter McCalister

Here at BeyondTrust, we work with some of the most sensitive information in the world. The kind of stuff that makes or breaks businesses, collapses empires, or creates headlines.  Ok – we’re being melodramatic, and we also deal with things as simple as system configuration settings that hike up help desk costs.

But it’s always interesting to hear extravagant cases of extremely sensitive, but small volumes of data. Like Goldman’s top secret algorithms, or a Wikileaks breach that could publically humiliate the company with as little as 1 or as many as 10,000 documents.

Today I read a story that made me think of an unexpected source – the feds completed a comprehensive “stress test” (see WSJ story) and the results of those tests are confidential. In other words, some banks could have been evaluated by the government and to have been evaluated by the government as unable to survive economic uncertainty.

That gets one to wondering, who has access to these reports, who would pay for them and what is the potential risk/damage to every major American bank?  Surely key corporate execs at the bank have the report results; lots of employees probably have some idea; government representatives have them; oh AND every IT staffer with access to the corporate email system.

If I was a departing employee in the IT department and I felt underpaid and under appreciated; if I was angry, resentful and truly motivated to cause harm to the company, that’s exactly how I would do it.

Leave a Reply

Additional articles

How To Implement The Australian Signals Directorate’s Top 4 Strategies

Posted October 20, 2014    Morey Haber

The Australian Signals Directorate (ASD), also known as the Defence Signals Directorate, has developed a list of strategies to mitigate targeted cyber intrusions. The recommended strategies were developed through ASD’s extensive experience in operational cyber security, including responding to serious security intrusions and performing vulnerability assessments and penetration testing for Australian government agencies. These recommendations…

Tags:
, , , ,
asp-mvc

Exploiting MS14-059 because sometimes XSS is fun, sometimes…

Posted October 17, 2014    BeyondTrust Research Team

This October, Microsoft has provided a security update for System.Web.Mvc.dll which addresses a ‘Security Feature Bypass’. The vulnerability itself is in ASP.NET MVC technology and given its wide adoption we thought we would take a closer look. Referring to the bulletin we can glean a few useful pieces of information: “A cross-site scripting (XSS) vulnerability exists…

Tags:
4bestpracticesaudits-blog

Four Best Practices for Passing Privileged Account Audits

Posted October 16, 2014    Chris Burd

Like most IT organizations, your team may periodically face the “dreaded” task of being audited. Your process for delegating privileged access to desktops, servers, and infrastructure devices is a massive target for the auditor’s microscope. An audit’s findings can have significant implications on technology and business strategy, so it’s critical to make sure you’re prepared…

Tags:
, , , ,