BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Top 5 Data Breach Excuses Of 2011 (And What They Really Mean): Part 3

Posted January 5, 2012    Peter McCalister

BLAME IT ON A THIRD PARTY/MALWARE/THE WEATHER – Frequently throughout the year….
With so much out-soucing today, it’s easy to divert attention away from your role in allowing data to be breached, by focusing on slopping practices of third party suppliers and contractors (while not saying of course that it was you who hired them in the first place/were responsible for procurement policy).

i.) Boston Hospital Reports Data Breach Affecting More Than 2K Patients – but it wasn’t their fault. “Boston’s Beth Israel Deaconess Medical Center reported a security breach that could have compromised the personal information of 2,021 radiology patients, Boston Business Journal reports (Moore, Boston Business Journal, 7/19).”

Officials said the hospital’s intrusion detection system identified the breach after a radiology workstation computer was found to be transmitting data to an unknown location via the Internet (Goedert, Health Data Management, 7/19).

The hospital said a computer service vendor had failed to restore proper security settings after performing routine maintenance on the machine (Bray, Boston Globe, 7/19). The workstation later was found to be infected with malware that used a port on the workstation to encrypt and transmit data.

ii.) Texas Comptroller Susan Combs sought to share some of the blame for a huge data breach by pointing the finger at other agencies for failing to encrypt the confidential data before sending it. But the agencies — the Workforce Commission and the retirement systems for teachers and state workers — all disputed that claim and said they had sent their data securely.

For most of the 3.5 million Texans whose personal data was left exposed online for about a year, the technical issues probably don’t matter much as they wonder if their names, Social Security numbers and other personal information are being sold on the black market to the highest bidder. But for an elected official with political ambitions, such as Combs, finding a technical way to spread the blame for such a high-profile debacle could be paramount. Doug Holt, the state’s chief information security officer, undercut the comptroller’s search for cover in a letter to Combs’ chief technology officer this week.

Asked for a interpretation of state law regarding the transfer of confidential data, Holt said that the agencies had a choice and that the secure method used by the three agencies was acceptable.

“Once the transmitted data has been received, the originating agency’s responsibility to protect the transmitted confidential information ceases. It is then the responsibility of the receiving agency, as data custodian, to protect the confidential information by all appropriate means,” Holt writes.

BeyondTrust says: If a third party is reponsible for data theft/leak it’s still your responsibility. With so many potential points of entry to sensitive data and so many different attack surfaces from which infection or data theft can happen, a shift in perspective is required. At the very least it is your responsibility to verify the data leak protection of third parties handling sensitive data.

Leave a Reply

Additional articles

beyond-trust

PowerBroker for Windows – Most Innovative IAM Solution by Cyber Defense Magazine

Posted April 21, 2015    Scott Lang

PowerBroker for Windows has been selected as a winner by the 2015 Cyber Defense Magazine Awards Program in the category of “Most Innovative Identity and Access Management Solution”.

Tags:
, , ,
pbps-customer-campaign-image

Are you changing your passwords as often as the weather changes?

Posted April 20, 2015    Scott Lang

There is one thing that should change more frequently than the weather: Your privileged passwords. Why? If you’re like more than 25% of companies out there, then your current IT environment contains unmanaged accounts putting you at risk of data breaches and compliance violations, and you don’t have a process to control those accounts.

Tags:
, , , ,
webinar1

On Demand Webinar: Advanced Windows Tracing

Posted April 17, 2015    BeyondTrust Software

Webinar: Security MVP, Paula Januszkiewicz, shows Windows administrators how to be more aware of what happens whenever somebody does something within the system.

Tags:
, ,