Tag Archives: Data

Security Think Tank: How to share data securely

21 June 2014

This post of Tim Holman is absolutely worth reading.

Security Think Tank: How to share data securely

Tim presents the elementary basics on the People and Process level for sharing of classified data with trusted third parties. From my point of view these basic principles must be applied for handling of classified data inside a company as well.

In particular for strictly confidential classified information I would strongly recommend to take further actions:

  • Review of all authorizations and permissions with strict regards to the Need-to-Know and the Separation of Duties principle.
  • Reorganization of all filing structures

Both measures can be implemented rapidly and will raise the overall level of security because we know in detail who is authorized to access the information and where the information is stored.

In addition technical measures like an integrated Tagging/DLP solution could be applied to support the employees in enforcing the company’s security policy. In my opinion encryption is  the last line of defence.

The eBay data breach – Is hashing of passwords the appropriate response?

10 June 2014

The news about the data theft at eBay have almost electrified me. Not due to fears of losing my private data, I am not eBay customer, but the details under which the theft took place are interesting for me from a professional point of view.

My first thought was: This was an Insider Attack!

The IT departments of large companies are doing a very good job in operating the servers connected to the internet. I would have been very surprised about an attack through servers at the company’s border to the internet.

The information published by eBay at 21 May 2014 [1] saved my day:

‘Cyberattackers compromised a small number of employee log-in credentials, allowing unauthorized access to eBay’s corporate network.’

I am not at all surprised that eBay discovered the loss of customer information with a two month delay. According to the Ponemon Study 2013 [2] the average time to resolve attacks by ‘malicious insiders’ is 65.5 days in 2012 (57.1 days in 2011). That fits well even in this case.

But I am somewhat puzzled by the discussion in some blogs whether encryption is the adequate method to protect sensitive and private data from unauthorized access. Hashing is praised as a better method for protecting passwords.

In my opinion this discussion goes hardly far enough. The loss of e-mail address, physical address, and date of birth is to take at least as seriously as the loss of passwords, since this information enables e.g. professionally made targeted phishing attacks. And, as we all know, an experienced hacker can attack even a hashed password, in particular if he has enough time behind closed doors. See [3] for amazing details about cracking of hashed passwords.

Just new technology will not necessarily increase the overall security because the root causes for this data breach are more likely a lack of security awareness and training. Therefore, only the classic PPT approach, which includes People, Processes and Technology, will lead to an increased overall security.
PPT - People, Processes, Technology

PPT – People, Processes, Technology