Data Theft

In today’s blog, we will discuss the issues concerning insider data theft and the selling of customer data. I would also like to hear your views on information risk management. Enjoy!

Over the last couple of years, insider data theft has become an major issue that companies are dealing with and seeking preventative controls. Even more shocking, some employees and contractors that have access to customer information have managed to make extra income in selling this information to the “electronic black market”.

The Issue:

The FBI has cited that 85% of data theft is caused by internal employees that have access to confidential data. In the month of July alone, two major data theft cases made headlines. Certegy Check Services, a subsidiary of Fidelity National Information Services, has announced that it has discovered that an employee sold identifying data on 2.3 million customers to a data broker and, more recently, a subcontractor working for a company that processes and fulfills orders for the Disney Movie Club sold credit card numbers and other account information belonging to an unknown number of customers to undercover law enforcement agents. The data stolen in both cases contained names, addresses, birth dates, and account information.

The Consumer Data Black Market:

The following types of information are being sold in the black market as follows:

* $980-$4,900 - Trojan program to steal online account information
* $490 - Credit card number with PIN
* $78-$294 - Billing data, including account #, address, Social Security number, home address, and birth date
* $147 - Driver's license
* $147 - Birth certificate
* $98 - Social Security card
* $6-$24 - Credit card number with security code and expiration date
* $6 - PayPal account logon and password


Major Cause of Data Breach:

Nearly fifty percent of professionals take corporate data with them when they changed jobs, according to a recent online survey, with many of them simply e-mailing it to themselves or storing it on a peripheral device. In fact, a CSI/FBI survey reported that the most serious financial losses occurred through theft of proprietary information. Much like other security vulnerabilities, non-malicious errors—otherwise known as social engineering—contributes largely to the problem. The leading cause of a data security breach is non-malicious employee error (39 percent), followed by malicious employee activities (30 percent) and hacker or external penetration (16 percent). Other data breaches include:

* Stolen Laptops
* Social Engineering
* Dumpster Diving
* Information left on printing and fax devices


Some Solutions:

Once the initial identification and classification of sensitive data has been determined, one can implement a number of automated methods to maintain these classifications. Linguistic signatures or forensic-based “file crawlers” can watch and sustain classifications as the original files change and new files are added to protected directories. These devices can be configured to navigate through file systems to watch protected files and directories in a number of ways:

* Protect and watch specific files. As the file contents change, so will the data in the signature repository.
* Protect all contents of a directory. File crawlers can be set to watch and protect directories containing proprietary source code.
* Protect all files matching a specific template within a directory. As file names and content within documents change all drafts of the document are protected.
* Protect all files with a given extension in a directory. For example, selecting the .xls extension enables protection for all Excel spreadsheets in the finance department’s directories.


Other solutions includes notifying departments to new threats and risk areas, it enables them to fully understand the cause of the threat thus allowing them to determine how to mitigate it; implement new controls; and then apply that knowledge to other areas. Finally organizations should review the following file system security components and implement security controls to mitigate the risk of data theft:

* File System Permissions
* Access Management and Frequent Monitoring/Review
* Network Access Management
* Hardened Systems and Hosts


In Closing:
In order to minimize the risk of data theft, organizations should consider the following approaches:

* Risk Assessment (RA): Organizations must periodically assess the risk to organizational operations
* System and Information Integrity (SI): Organizations must: (i) identify, report, and correct information and information system flaws in a timely manner; (ii) and (ii) monitor information system security alerts and advisories and take appropriate actions in response.
* Personnel Security (PS): Organizations must: (i) ensure that individuals occupying positions of responsibility within organizations (including third-party service providers) are trustworthy and meet established security criteria for those positions; (ii) ensure that organizational information and information systems are protected during personnel actions such as terminations and transfers; and (iii) employ formal sanctions for personnel failing to comply with organizational security policies and procedures.
* Physical and Environmental Protection (PE): Organizations must: (i) limit physical access to information systems, equipment, and the respective operating environments to authorized individuals


I would like to hear your views on the following:

1. IT risk assessment strategies; what is your process and approach?
2. Have you made the transition from information security to information risk management?
3. How are you measuring information risks?
4. How does your information security governance strategy fit into your organization’s corporate governance process?


Thank you