BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Top 5 Data Breach Excuses Of 2011 (And What They Really Mean): Part 3

Posted January 5, 2012    Peter McCalister

BLAME IT ON A THIRD PARTY/MALWARE/THE WEATHER - Frequently throughout the year….
With so much out-soucing today, it’s easy to divert attention away from your role in allowing data to be breached, by focusing on slopping practices of third party suppliers and contractors (while not saying of course that it was you who hired them in the first place/were responsible for procurement policy).

i.) Boston Hospital Reports Data Breach Affecting More Than 2K Patients – but it wasn’t their fault. “Boston’s Beth Israel Deaconess Medical Center reported a security breach that could have compromised the personal information of 2,021 radiology patients, Boston Business Journal reports (Moore, Boston Business Journal, 7/19).”

Officials said the hospital’s intrusion detection system identified the breach after a radiology workstation computer was found to be transmitting data to an unknown location via the Internet (Goedert, Health Data Management, 7/19).

The hospital said a computer service vendor had failed to restore proper security settings after performing routine maintenance on the machine (Bray, Boston Globe, 7/19). The workstation later was found to be infected with malware that used a port on the workstation to encrypt and transmit data.

ii.) Texas Comptroller Susan Combs sought to share some of the blame for a huge data breach by pointing the finger at other agencies for failing to encrypt the confidential data before sending it. But the agencies — the Workforce Commission and the retirement systems for teachers and state workers — all disputed that claim and said they had sent their data securely.

For most of the 3.5 million Texans whose personal data was left exposed online for about a year, the technical issues probably don’t matter much as they wonder if their names, Social Security numbers and other personal information are being sold on the black market to the highest bidder. But for an elected official with political ambitions, such as Combs, finding a technical way to spread the blame for such a high-profile debacle could be paramount. Doug Holt, the state’s chief information security officer, undercut the comptroller’s search for cover in a letter to Combs’ chief technology officer this week.

Asked for a interpretation of state law regarding the transfer of confidential data, Holt said that the agencies had a choice and that the secure method used by the three agencies was acceptable.

“Once the transmitted data has been received, the originating agency’s responsibility to protect the transmitted confidential information ceases. It is then the responsibility of the receiving agency, as data custodian, to protect the confidential information by all appropriate means,” Holt writes.

BeyondTrust says: If a third party is reponsible for data theft/leak it’s still your responsibility. With so many potential points of entry to sensitive data and so many different attack surfaces from which infection or data theft can happen, a shift in perspective is required. At the very least it is your responsibility to verify the data leak protection of third parties handling sensitive data.

Leave a Reply

Additional articles

pbps-customer-campaign-image

You Change Your Oil Regularly; Why Not Your Passwords?

Posted September 11, 2014    Chris Burd

There are many things in life that get changed regularly:  your car oil, toothbrush and hopefully, your bed sheets.  It’s rare that you give these things much thought – even when you forget to change them. But what if you’re forgetting something that can cost you millions of dollars if left unchanged for long periods…

Tags:
, , ,

On-Demand Webcast: The Little JPEG that Could (Hack Your Organization) with Marcus Murray

Posted September 10, 2014    Chris Burd

IT security has come a long way, but every once in a while you see something that makes you think otherwise. Every day, internal and external hackers breach and traverse “secure” environments, making you wonder just how easy it is for attackers to completely compromise your network. In a new on-demand BeyondTrust webcast, Marcus Murray,…

Tags:
, , , , ,

Retina Vulnerability Audits – September 2014 Patch Tuesday

Posted September 9, 2014    BeyondTrust Research Team

The following is a list of Retina vulnerability audits for this September 2014 Patch Tuesday: MS14-052 – Cumulative Security Update for Internet Explorer (2977629) 35141 – Microsoft Cumulative Security Update for Internet Explorer (2977629) 35142 – Microsoft Cumulative Security Update for Internet Explorer (2977629) – IE8/2003 35143 – Microsoft Cumulative Security Update for Internet Explorer (2977629) – IE8…