Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Why assuming data is secure is dangerous and stupid

Rob Enderle | Nov. 7, 2016
The latest news concerning Hilary Clinton’s email has columnist Rob Enderle ticked off because it highlights an ongoing problem regarding security breaches, assuming we are secure.

Stuart realized, and this is particularly pertinent given that recent DOS DNS attack, that any server could be vulnerable. In fact, after talking to Stuart I went on the web and apparently you can buy compromised servers in almost any company for about $5-$6 and use them to your heart’s content. Pick a company, and there are a surprising number of tech companies that are unaware they have hacked servers in their shops being sold on the dark web.

I clearly missed that update and I’m willing to bet you did too, and, I expect, the only reason Clinton’s email server isn’t on this list is because it has been taken down. Think about it -- if there are secure government servers on this list what are the odds that an unsecure email server would be on it?  

Perimeter security is dead

A few years back in 2013, Kaspersky said something to the effect that there are two kinds of companies, those that know they have been hacked that those that don’t know they have been hacked. Three years later we still don’t seem to be taking this problem very seriously. If anyone thinks perimeter security is working let’s hope those folks aren’t responsible for it, because they’ll soon be out of a job. Our homes and businesses aren’t secure, and rather than assume they are we should assume they aren’t and focus on mitigating the damage.  

It is particularly annoying that both candidates have been hurt by breaches in security. Clinton the DNC email breach, and Trump the NBC breach that put his “off the record” comments on newspapers radio and TV.   You’d think both would prioritize a fix but the only thing either can seem to talk about is that they aren’t the other person.

Assume the worst hope for the best

This is the only advice I can suggest because we can’t be sure we haven’t been penetrated. In fact, we can be almost certain we have been. The best we can do is find a way to limit the damage, and when we can, aggressively go after the attackers.

Varonis shared one final story, one of their accounts flagged the head of HR who was suddenly downloading tons of confidential documents. Likely thinking they had a disgruntled executive problem they instead discovered the poor guy had been hacked and his machine turned into a Zombie.   Why this hit home is that I’d been recently called in to help on a case where a child after graduating had been expelled for sending sexually explicit material to a teacher. It came from his school-issued PC and the school was apparently covering up that this PC had been hacked. I expect this will eventually reach national attention and no one will look good.  

 

Previous Page  1  2  3  Next Page 

Sign up for CIO Asia eNewsletters.