BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Top 5 Data Breach Excuses Of 2011 (And What They Really Mean): Part 3

Posted January 5, 2012    Peter McCalister

BLAME IT ON A THIRD PARTY/MALWARE/THE WEATHER - Frequently throughout the year….
With so much out-soucing today, it’s easy to divert attention away from your role in allowing data to be breached, by focusing on slopping practices of third party suppliers and contractors (while not saying of course that it was you who hired them in the first place/were responsible for procurement policy).

i.) Boston Hospital Reports Data Breach Affecting More Than 2K Patients – but it wasn’t their fault. “Boston’s Beth Israel Deaconess Medical Center reported a security breach that could have compromised the personal information of 2,021 radiology patients, Boston Business Journal reports (Moore, Boston Business Journal, 7/19).”

Officials said the hospital’s intrusion detection system identified the breach after a radiology workstation computer was found to be transmitting data to an unknown location via the Internet (Goedert, Health Data Management, 7/19).

The hospital said a computer service vendor had failed to restore proper security settings after performing routine maintenance on the machine (Bray, Boston Globe, 7/19). The workstation later was found to be infected with malware that used a port on the workstation to encrypt and transmit data.

ii.) Texas Comptroller Susan Combs sought to share some of the blame for a huge data breach by pointing the finger at other agencies for failing to encrypt the confidential data before sending it. But the agencies — the Workforce Commission and the retirement systems for teachers and state workers — all disputed that claim and said they had sent their data securely.

For most of the 3.5 million Texans whose personal data was left exposed online for about a year, the technical issues probably don’t matter much as they wonder if their names, Social Security numbers and other personal information are being sold on the black market to the highest bidder. But for an elected official with political ambitions, such as Combs, finding a technical way to spread the blame for such a high-profile debacle could be paramount. Doug Holt, the state’s chief information security officer, undercut the comptroller’s search for cover in a letter to Combs’ chief technology officer this week.

Asked for a interpretation of state law regarding the transfer of confidential data, Holt said that the agencies had a choice and that the secure method used by the three agencies was acceptable.

“Once the transmitted data has been received, the originating agency’s responsibility to protect the transmitted confidential information ceases. It is then the responsibility of the receiving agency, as data custodian, to protect the confidential information by all appropriate means,” Holt writes.

BeyondTrust says: If a third party is reponsible for data theft/leak it’s still your responsibility. With so many potential points of entry to sensitive data and so many different attack surfaces from which infection or data theft can happen, a shift in perspective is required. At the very least it is your responsibility to verify the data leak protection of third parties handling sensitive data.

Leave a Reply

Additional articles

How To Implement The Australian Signals Directorate’s Top 4 Strategies

Posted October 20, 2014    Morey Haber

The Australian Signals Directorate (ASD), also known as the Defence Signals Directorate, has developed a list of strategies to mitigate targeted cyber intrusions. The recommended strategies were developed through ASD’s extensive experience in operational cyber security, including responding to serious security intrusions and performing vulnerability assessments and penetration testing for Australian government agencies. These recommendations…

Tags:
, , , ,
asp-mvc

Exploiting MS14-059 because sometimes XSS is fun, sometimes…

Posted October 17, 2014    BeyondTrust Research Team

This October, Microsoft has provided a security update for System.Web.Mvc.dll which addresses a ‘Security Feature Bypass’. The vulnerability itself is in ASP.NET MVC technology and given its wide adoption we thought we would take a closer look. Referring to the bulletin we can glean a few useful pieces of information: “A cross-site scripting (XSS) vulnerability exists…

Tags:
4bestpracticesaudits-blog

Four Best Practices for Passing Privileged Account Audits

Posted October 16, 2014    Chris Burd

Like most IT organizations, your team may periodically face the “dreaded” task of being audited. Your process for delegating privileged access to desktops, servers, and infrastructure devices is a massive target for the auditor’s microscope. An audit’s findings can have significant implications on technology and business strategy, so it’s critical to make sure you’re prepared…

Tags:
, , , ,