Security Vendor Breach Fallout Justified

Attendees at last week’s ShmooCon security conference were transfixed when news broke that a hacker breached part of Kaspersky Lab’s U.S. support site by exploiting a flaw in the site’s programming.

Looking around the conference hall in Washington D.C., I could see large groups of people staring at the news on their mobile phones and expressing a variety of opinions.

The incident was small compared to security breaches suffered by the likes of TJX and Heartland Payment Systems. But it was a big deal to the security practitioners at the conference because Kaspersky is a security vendor, entrusted by its customers to keep this sort of thing from happening to them.

Confidence in security vendors was shaken further when F-Secure admitted days later that its site had been the victim of a SQL injection attack.

Both vendors deserve credit for their candor.

Kaspersky Senior Research Engineer Roel Schouwenberg put it bluntly: “This is not good for any company, and especially a company dealing with security,” he said. “This should not have happened, and we are now doing everything within our power to do the forensics on this case and to prevent this from ever happening again.”

David Frazer, director of technology services for F-Secure’s North American division, admitted it’s embarrassing when a security company suffers a breach, no matter the size.

The honesty is appreciated, but they should be embarrassed.

When security is your company’s business, even the smallest breach is worthy of scorn. If you can’t keep the bad guys out of your own database, how can customers reasonably expect that you’ll keep theirs safe?

Of course, no company is 100 percent immune from attack, even the security vendors. The key is for the vendor to be up front about that reality when the customer signs on from the outset.

Kaspersky and F-Secure have solid reputations in the industry and will get through this. The hope is that other security vendors take careful study of what happened and plan accordingly.

That means doing a double take at their own internal security, and being honest with customers that like everyone else, they too are at risk.

About FUD Watch: Senior Editor Bill Brenner scours the Internet in search of FUD – overhyped security threats that ultimately have little impact on a CSO’s daily routine. The goal: help security decision makers separate the hot air from genuine action items. To point us toward the industry’s most egregious FUD, send an e-mail to bbrenner@cxo.com.