What I Learned From the Top Five Security Events of 2007

Prat Moghe of Tizor Systems draws five key lessons from five data breaches.

By Prat Moghe

December 03, 2007 — CSO —

By Prat Moghe, CTO and Founder, Tizor Systems

2007 has been a Blockbuster year in terms of data security breaches.  The scope and sheer volume of the data breaches that have dominated the headlines in the past 12 months mark a new era of data insecurity.  From brand names like TJX and DuPont to the inside threat and the professional data thief, breaches have materialized in every shape and color. In the hopes that history will not repeat itself, let’s analyze these breach events to understand how to better secure data in the future.  Here’s a recap of some of the more memorable breaches: 

January 25, 2007: TJX – This popular off-price retailer now carries the distinction of the largest data breach on record. At last count, 94 million records were affected. To put this into perspective, 94 million is nearly one third of the US population. This event punctuated the efforts of the credit card industry and it’s PCI Data Security Standard. As the number of breached records kept growing (reported estimates were revised three or four times, most recently in October), it became painfully obvious that TJX did not know what was going on with customer data even over a year after the initial breach.  The breached data was eventually linked to fraudulent charges which also intensified the debate over who is ultimately responsible for the financial repercussions of breached data.  The book is far from closed on this one as several state and federal cases are still pending. The incident and fall out has put retailers on notice about inadequate data security measures.

Febuary, 14, 2007: Dupont  –   An insider pilfered the Intellectual Property belonging to this leading chemical firm  in an attempt to take it to a competitor. In addition to highlighting the insider risk in a rather Hollywood way, this breach proves that data breaches are not just about credit card data and financials; chemical formulas and virtually any other proprietary, internal corporate document could cause serious damage in the wrong hands. It also demonstrated the efficacy of monitoring data access to determine if trusted insiders are actually untrustworthy. The details are still a bit fuzzy, but Dupont somehow determined that an unusually large volume of data was downloaded, alerted federal officials and caught the employee before damage was done. In Dupont’s case the outcome was positive, others haven’t fared as well.

• Print