BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Top 5 Data Breach Excuses Of 2011 (And What They Really Mean): Part 3

Posted January 5, 2012    Peter McCalister

BLAME IT ON A THIRD PARTY/MALWARE/THE WEATHER - Frequently throughout the year….
With so much out-soucing today, it’s easy to divert attention away from your role in allowing data to be breached, by focusing on slopping practices of third party suppliers and contractors (while not saying of course that it was you who hired them in the first place/were responsible for procurement policy).

i.) Boston Hospital Reports Data Breach Affecting More Than 2K Patients – but it wasn’t their fault. “Boston’s Beth Israel Deaconess Medical Center reported a security breach that could have compromised the personal information of 2,021 radiology patients, Boston Business Journal reports (Moore, Boston Business Journal, 7/19).”

Officials said the hospital’s intrusion detection system identified the breach after a radiology workstation computer was found to be transmitting data to an unknown location via the Internet (Goedert, Health Data Management, 7/19).

The hospital said a computer service vendor had failed to restore proper security settings after performing routine maintenance on the machine (Bray, Boston Globe, 7/19). The workstation later was found to be infected with malware that used a port on the workstation to encrypt and transmit data.

ii.) Texas Comptroller Susan Combs sought to share some of the blame for a huge data breach by pointing the finger at other agencies for failing to encrypt the confidential data before sending it. But the agencies — the Workforce Commission and the retirement systems for teachers and state workers — all disputed that claim and said they had sent their data securely.

For most of the 3.5 million Texans whose personal data was left exposed online for about a year, the technical issues probably don’t matter much as they wonder if their names, Social Security numbers and other personal information are being sold on the black market to the highest bidder. But for an elected official with political ambitions, such as Combs, finding a technical way to spread the blame for such a high-profile debacle could be paramount. Doug Holt, the state’s chief information security officer, undercut the comptroller’s search for cover in a letter to Combs’ chief technology officer this week.

Asked for a interpretation of state law regarding the transfer of confidential data, Holt said that the agencies had a choice and that the secure method used by the three agencies was acceptable.

“Once the transmitted data has been received, the originating agency’s responsibility to protect the transmitted confidential information ceases. It is then the responsibility of the receiving agency, as data custodian, to protect the confidential information by all appropriate means,” Holt writes.

BeyondTrust says: If a third party is reponsible for data theft/leak it’s still your responsibility. With so many potential points of entry to sensitive data and so many different attack surfaces from which infection or data theft can happen, a shift in perspective is required. At the very least it is your responsibility to verify the data leak protection of third parties handling sensitive data.

Leave a Reply

Additional articles

Integrating Least Privilege and Password Management to Solve Account Security Challenges

Integrating Least Privilege and Password Management to Solve Account Security Challenges

Posted July 24, 2014    Morey Haber

There is a reason all BeyondTrust Privileged Account Management (PAM) solutions share the PowerBroker name: They all inherently enable you to reduce user-based risk and can be integrated under a centralized IT risk management platform. Here’s one common use case that demonstrates how this integration changes the playing field. Consider the challenge of privileged access:…

Tags:
, , , , ,
PowerBroker Password Safe Password Age Report

Reshaping Privileged Password Management with Password Safe 5.2

Posted July 21, 2014    Martin Cannard

Today, we’re pleased to unveil the latest edition of our privileged password management solution, PowerBroker Password Safe. I’ll start with a brief intro of what’s new and then tell you a little about the driving factors behind Password Safe development. New features for mitigating password risk and ensuring accountability enterprise-wide Here’s the 10,000-foot overview of…

Tags:
, , ,
PowerBroker for Windows tamper protection

PowerBroker for Windows 6.6 Tamper Protection

Posted July 18, 2014    Morey Haber

I have a bone to pick: Stopping an administrator from performing an action on a system is futile endeavor. As an administrator, there is always a way to circumvent a solution’s from tampered protection. Really! By default, Windows administrators have unrestricted access to the system – and even though an application, hardened configuration, or group policy…

Tags:
, ,