wehuberconsultingllc.com

This ZDNET article, “Over 90 percent of data breaches in first half of 2014 were preventable”, had me intrigued but it was their summary that really caught my attention. Since the latest explanation of how the North Koreans hacked Sony was that they stole a system administrator’s password by some method that is not discussed but vaguely confirmed by the NSA, we would have to conclude that the Sony breach was probably a staff mistake.

The Online Trust Alliance says that a high percentage of data breaches were the result of staff mistakes — rather than external hacking.

According to a recent Online Trust Alliance press release about 47% of data breaches was the result of staff mistakes and 40% were the result of external intrusions. Here is what they said.

OTA also announced that it has analyzed over a thousand breaches involving the loss of personally identifiable information (PII) in 2014, as reported by the Open Security Foundation (OSF) and the Privacy Rights Clearinghouse. OTA found that only 40 percent were the result of external intrusions, while 29 percent were caused by employees—accidentally or maliciously—due to a lack of internal controls. The balance of incidents were primarily attributed to lost or stolen devices or documents (18 percent) and social engineering/fraud (11 percent).

There are a lot of loose ends with the Sony hack that bother old IT guys like me. Kim Zetter in the article, The Evidence That North Korea Hacked Sony Is Flimsy, makes the point that nation-state attacks are not normally this noisy. This attack was public and filled with revenge-filled rhetoric that sounded distinctly non-North Korean.

Marc Rogers in the article, Why the Sony hack is unlikely to be the work of North Korea, goes a step farther and says an insider is the likely culprit.

3. It’s clear from the hard-coded paths and passwords in the malware that whoever wrote it had extensive knowledge of Sony’s internal architecture and access to key passwords. While it’s plausible that an attacker could have built up this knowledge over time and then used it to make the malware, Occam’s razor suggests the simpler explanation of an insider. It also fits with the pure revenge tact that this started out as.

So if we are to assume that the attack is from North Korea, we have to ask when, why, and how did they plant a spy at Sony? The mainstream news media seems to be proceeding under the premise that the North Koreans could walk into Sony either literally or electronically and collect extensive knowledge of Sony’s architecture including key passwords in a relatively short period of time. I think this supports main stream media’s agenda that this is technology problem all we need to do is install the latest and greatest firewall. The reality is that this type of hack is typically an inside job so it is a primarily a personnel rather than a technology problem. In most major corporations this type of broad access requires lots of time since security is compartmentalized and transferring passwords to new people is dependent on developing trust. Password management in a large corporation like Sony can be further enhanced by delegating password control to different people. In this case the passwords for administering email, human resources and accounting systems are probably controlled and periodically changed by the people who have operational control of those systems. So if the insider working for the North Koreans is a new hire or contractor then they must have been inserted into Sony months ago. This begs the question of why did the North Koreans target Sony months ago, develop such a sophisticated operation, and then release detailed information about this operation to the world. All of this work for a movie! The North Koreans may be crazy but I do not think they are stupid!

If this hack is not North Koreans consumed by revenge over a movie, we have to conclude the insider was a long time employee or contractor who got the data directly off the servers or via malware installed on certain key computers. We are looking for a person with a Edward Snowden profile. Although some people who are skeptical of the North Korea explanation see a government conspiracy, my guess is our law enforcement agents are temporarily feeding the public misinformation to buy more time to complete the investigation and arrest the suspect while still in the United States.

For a detailed list of the Sony hack events check out the Riskbased Security article, A Breakdown and Analysis of the December, 2014 Sony Hack.

A couple of days I ago I wrote the post, Strengthening 2-Step Verification with Security Key, and yesterday I got the security key. I guess parcel post from France is pretty quick! I had to reboot the computer before I could get the hardware drivers to install. It took about two minutes to register the key with both of my gmail accounts after it finished booting. Pretty cool!

Today I tested it at work. The first step was to insert the security key and let Windows 7 install the drivers. Once again my luck installing the drivers was better after I rebooted. Then I cranked up Chrome and went to gmail. Google asked me to login. After I entered the password, it asked me to install the security key. In a couple of seconds it had validated and I was redirected to my inbox. I took the key out and put it back in my storage bag. Although I have entered my password several times as I browsed my security settings, it did not require access to the security key.

The last task was to create an app specific password for gmail for those applications that will not use the security key.

Last Wednesday my wife and I celebrated our 31^st anniversary at P. F. Changs. We had a nice dinner and they ran our card through a manual imprint system. Today I noticed that they wrote my CVV on the receipt. That is not necessary if they were actually going to process my bill as a manual credit card transaction in which the card is present. By writing the CVV on the receipt that means that they plan to process the charge later as a card not present transaction. For those of you who have jumped through the PCI hoops, you have to wonder what measures they are using to protect these receipts since they now include the CVV. In the PCI world there are some pretty serious restrictions on keeping the CVV information secure. This is a dumpster diver’s gold mine.

Okay, I am really annoyed. What is the best way for a company to continue their business after a data breach without annoying their customers? There are some interesting comments over at Krebs on Security but I have my own recommendation. As a long time developer I look for a good manual procedures to automate. In this case we are going in the opposite direction. We are breaking up a good automated procedure into standalone parts. In this case I would recommend creating a corporate web app to process the credit card transaction that would be very similar to the model used by internet retailers. In fact I would not be surprised if a corporate developer does not already have one they used to get through credit card processing certification. In this case either the waitperson or some other designated person enters the sixteen digit credit card number and CVV to run the transaction. If the transaction goes through then you update the bill in the restaurant’s order system with the confirmation code or reference ID. Is this a little more work? Yes but we literally have millions of people who enter their sixteen digit credit card number and CVV every day without exposing themselves to credit card fraud. There are a whole lot less PCI compliance issues with this procedure than a manual imprint with the customer’s CVV on the receipt.