Posts Tagged ‘security breach’

Security Breach at Shell Reveals Personal Employee Information

February 27th, 2010

Security breaches can happen anytime, anywhere, and can affect practically anyone in an organization. In the past, we’ve covered several examples where breaches revealed customer’s passwords and social security numbers. Today, we explore a different type of breach- one which leaked the personal details of 170,000 employees and contractors of Royal Dutch Shell. This incident is important because it provides a perfect example of how storing unencrypted data on company computers can be dangerous and have serious consequences that can strike a company from the inside.

The situation is particularly difficult for the infamous oil corporation- the database of names and personal contact details has been e-mailed to several non-governmental organizations, including Greenpeace, Friends of Earth, and Shell Guilty. Shell has attempted to prevent the NGOs from publishing the information, explaining that in doing so, they would be breaking the law. Additionally, Shell is launching a full scale investigation in an effort to figure out how their employee information ended up accessible to third-parties. While it’s difficult to guess at the techniques used by the hackers involved, one thing is clear- Shell computers aren’t protected by full disc encryption services and, as a result, are much more vulnerable to online threats.

Shell’s Information is a Serious Problem

Understandably, Shell is trying to prevent the security breach from being seen as a serious problem. An article from TimesOnline included a statement from the company:

Yesterday Shell sought to play down the leak. A statement said: ‘Certain data concerning Shell employees and other individuals on our internal address list has been disclosed to some external parties. The data is mainly business-related.’

While there may be some truth in the statement’s claims about much of the information being publicly available and not damaging the company, it’s likely that Shell’s employees feel differently. According to a report by the BBC, some of Shell’s workers had their private home telephone numbers leaked. Even if no personal telephone numbers were leaked, the breach brings attention to the poor status of computer security at Shell. Employees can’t work well knowing that their personal details aren’t well-protected. This last complication is troublesome, at least for Shell, which will need to improve the way it does business in order to reassure its employees that their private information is safe. Dealing with the aftermath of a crisis, such as Shell’s security breach, can be extremely costly and in many cases, a damaged reputation can’t ever truly be recovered, regardless of how much money is spent.

Lessons to Learn

Ironically, Shell’s security breach came at a convenient time- had Shell discovered the breach in April, a new set of laws (covered here and here) would have allowed the company to be charged fines of up to £500,000. However, even without the monetary cost, Shell lost something extremely valuable: the trust of its employees. Shell workers are much less likely to remain loyal to a company which isn’t proactive about protecting its internal information.

In order to earn and maintain the trust of its workers, a company needs to employ solutions which are easy to use and keep data secure. Had Shell been using our Alsertsec Xpress computer security software, the company may have avoided the embarrassing security breach and kept its positive reputation among employees. Our software is specifically designed to keep all business parties happy and secure- it encrypts data, making it much more challenging for the others to access it.

Further Reading
 Shell investigates posting of personal data [TimesOnline]
Shell security breach reveals employee details [BBC]

Reblog this post [with Zemanta]

1 comment »

Posted in Data Protection, Encryption, Lawsuits and settlements

Tags:

Security Updates are Signs of Insecurity

February 21st, 2010

Mainstream software providers continually add security updates to their programs. While the practice is common and ensures that end users are protected from the latest threats and exploits, it highlights a scary truth: most computer software relied on every day by businesses and individuals isn’t secure. The fact that computer programmers constantly need to provide updates is yet another reminder of just how dangerous technology can be.

Unfortunately, it’s not just specialized software which requires security updates. Microsoft’s Windows operating system is infamous for having weekly, if not daily, security upgrades. Security vulnerabilities are just as common with computer programs like Firefox and Adobe. Organizations need to be aware of the risks created by technology and invest in additional computer protection solutions.

A Security Update’s Hidden Message

It’s not unusual to log into your computer and have a security update window pop up, prompting you to install the latest version of some software. These updates, which are created by software developers, patch any recent security holes that have been discovered and upgrade the the code to be more secure. At first glance, these events seem innocent- it makes sense for software to evolve in order to always beat new threats. However, the frequency of these updates reveals a scary truth- most computer applications can be exploited by hackers and aren’t as secure as you’d like them to be.

As anyone who uses Microsoft’s Windows OS can attest to, even well-protected and reputable technologies often have mandatory security updates. The sad reality is that, in many cases, the security patch is developed only after an exploit is discovered by a cyber intruder. For example, Google’s infamous security breach revealed fatal coding errors in Microsoft’s Internet Explorer browser. In response, Microsoft rushed to release an emergency patch which fixed the problem.

Unfortunately, security patches are rarely a final solution. Software developers have to continually look for ways by which outsiders could manipulate their code to infiltrate a computer’s defenses. Sadly, in most cases, third parties end up finding the security flaws first. This is shown perfectly with Microsoft’s “quick fix” to solve the vulnerabilities in IE: a few days after the patch’s release, a security company claimed that the browser was still an easy target for hackers and full of possible exploits. Microsoft’s only response, a generic PR statement:

Microsoft is investigating a responsibly disclosed vulnerability in Internet Explorer. We’re currently unaware of any attacks trying to use the vulnerability or of customer impact, and believe customers are at reduced risk due to responsible disclosure. Once we’re done investigating, we will take appropriate action to help protect customers.

Additional Protection is Required

Organization that seek to protect their digital assets, which include proprietary information and customer data, can’t rely on the software they use to be impenetrable. The flow and amount of security updates show that companies need to invest in additional measures to protect their computers. Encryption software, such the Alertsec Xpress full disc encryption service we offer, adds that extra layer of security and helps defend your machine when the software you use fails.

Further Reading
Microsoft releases emergency Internet Explorer patch [The Telegraph]
Internet Explorer ‘hit with new set of security flaws’ [The Telegraph]
Image [Hall Media Blog]

No comments »

Posted in Data Protection, Encryption

Tags:

Antivirus + Encryption = Total Security

January 17th, 2010

It’s important to understand that encryption software is very different from antivirus software. Many companies consider the two security solutions to be the same and fail to realize that they complement one another. While antivirus software is a perfect way to ensure that your computer is safe from the trojans, viruses, and rootkits, it only goes so far. Antivirus software doesn’t add an extra level of data security by encoding your hard drive. If an outsider gets their hands on a company notebook, antivirus won’t be able to prevent them from directly accessing the information stored.

A recent post from ComputerWeekly brings up a great point:

“…for as little money as it costs to install anti-virus software on your laptop, you can install encryption software, and protect your organisation not only from a data breach but also against any backlash…”‘

Companies need to understand the differences between antivirus and encryption and accept both as standards in their company’s defense. Most, if not all, data breaches or hacking attempts can be prevented and avoided by the right combination of security software.

Protecting your business is in your best interests and that’s where we step in- we provide a powerful and effective encryption method which works alongside all antivirus protection to ensure that your computer is secure. Using industry standard encryption, our software prevents unauthorized users from accessing private company information. Best of all, our software is affordable and manageable for pretty much any business. To learn more about our encryption solution, click here.

If you have any questions about how antivirus and encryption work together or would like to share an experience, leave a comment.

Further Reading
Data encryption is simple safeguard against data breaches [ComputerWeekly]

1 comment »

Posted in Data Protection, Encryption

Tags:

Losses from high-tech security breaches nearly double in 2009

October 5th, 2009

canadian-data-breachA new Canadian study from the Rotman School of Management reveals a major increase in annual losses related to Information Technology (IT) security breaches. According to this study, which surveyed more than 600 IT security professionals across the country, the costs associated with security breaches include:

  • IT security breaches cost the average Canadian organization an estimated $834,000 in 2009 – a 97 per cent increase from the $423,000 reported by the study last year.
  • Similarly, the average number of reported IT security breaches also increased 276 per cent to 11.3 per organization in 2009 – compared with an average of three in 2008.

While every type of organization incurred an increase in breach costs during 2009, the increases were different across sectors:

  • Government organizations more than tripled their average annual cost of breaches to $1,000,000 in 2009, up from $321,000 in 2008.
  • Private companies more than doubled their cost of breaches to $807,000 up from $294,000 in 2008.
  • Publicly traded companies reported a moderate increase of only six per cent year-over-year.

These alarming numbers bring with them a silver lining, as the increase in the number of reported cases could be attributed in part to higher detection levels due to compliance regulations.  At the same time, it is a shame that IT departments are not adopting data encryption software like they should be.  Even with increased reporting, proper use of tools like Alertsec could have led to a decrease is losses due to security breaches.

The study highlighted the value of IT investments in security as the top-performing respondents (those without breaches) spent at least 10 per cent of their IT expenditures on security, with the average security budget was seven per cent of the total IT spending. The study reports that Canadian organizations are finding it difficult to improve their security posture within the current economic climate – but the cost of ownership for hosted encryption services is a drop in the bucket for the millions that are spent on security.

stolen-laptopWith a 56-per-cent jump in occurrences of laptop or mobile hardware devices being stolen in Canada alone, encrypting files on laptops should be so obvious a solution!  File encryption is not a new technology – it’s an established technology. However, too many organization weigh security and convenience and land on the convenience side – not realizing how simple hosted encryption can be!

2 comments »

Posted in Encryption

Tags:

Stolen Laptop – Who do you tell?

June 11th, 2009

When an Information Technology manager is notified of a lost or stolen PC the first things that they worry about are replacing the laptop, changing the passwords, turning off accounts – all the fun details.  But, what many IT managers don’t realize is that there may be legal requirements for their company to actually report this event if the computer (laptop or desktop) opens up a potential security hole to the network.

Over 40 US states have breach notification laws and each state law varies (and other countries have laws pending).  Trying to get a handle on them could be a full time job in itself and many of the decisions require legal determinations “what is reasonable risk” that go far beyond the role of Information Technology alone.

  • Was there consumer data on the PC? For the most part these laws only apply to the loss or potential loss of consumer data – so that does eliminate many IT departments from this risk.
  • Was the data encrypted? California, which has the toughest laws, allows exemptions for encrypted data that’s lost.
  • How much data was exposed? In California there is no such thing as an immaterial breach, while other states do have a definition of immaterial breach.  So the potential loss of unencrypted data on one customer is a reportable incident in California, but may not be in other states.
  • What type of data was exposed - Some laws specifically mention financial data, others have been expanded to include  compromised medical and health insurance information.
  • How likely is it that data was exposed? Was there a chance of a breach or was there actually a breach?  What harm could come from the breach? California, for instance, uses an “acquisition standard” that requires companies to notify consumers each time their data has been acquired by an unauthorized person. Other states, such as Delaware, Arkansas and Florida require companies to notify consumers of breaches only if the companies believe there’s a reasonable risk of harm.

Highlighting California’s tough laws, the California State Senate has approved a new law requiring companies to provide victims of a data breach with additional information. The new law, SB-20, would require that companies tell customers what type of personal information was breached and when the breach occurred. The previous law required only that companies say that a breach had occurred.

The fact that California, with these tough laws, respects the work companies do to encrypt the data should be a compelling reason for Information Technology shops to explore encryption.  In fact more than 25 states have now enacted this same exemption for encrypted personal data.  That means encryption at all levels where access is possible.  Having the data on the server encrypted is valuable – but if you have a stolen PC with access to the unencrypted data then you still have that security risk.

The bottom line is that if your company is dealing with consumer data – you are liable to a wide range of repercussions if you don’t report potential breaches of the data.  Just one of many reasons why Information Technology managers the world over are investing in data and drive encryption.

1 comment »

Posted in Data Protection, Lawsuits and settlements

Tags: