To restore the public’s trust, he announced Tuesday that he fired Department of Technology Services director Stephen Fletcher and hired an ombudsman to shepherd victims through the process of protecting their identities and credit.

“The people of Utah rightly believe that the government will protect them, their families, and their personal data. When they interface with us that is in fact our charge,” Herbert said at an afternoon news conference, adding that one of his family members was among those whose information was compromised.

Click for complete article >>

The contract will be short-lived and will cost between $100,000 and $200,000, according to a solicitation published on May 11.

It calls for building a communications plan to “rebuild trust with the public, specifically those who were directly impacted by the breach and those who rely on the [Utah Department of Health] for critical health services.”

Click for complete article >>

The Tel Aviv district attorney on Sunday charged six people, including a computer programmer formerly employed as a Welfare and Social Services Ministry contractor, in connection with a massive data theft that exposed the personal details of millions of Israelis.

According to the indictment, filed in the Tel Aviv District Court, 55-year-old Shalom Bilik had access to the population registry database as part of his contract computer maintenance work in the Welfare and Social Services Ministry’s information systems department. In 2005- 2006, during his time at the ministry, Bilik began to make copies of the population registry data and sold it, the indictment said.

Click for complete article >>

In its fifth year of publication, the Data Breach Investigation Report (DBIR) by Verizon spans 855 data breaches across 174 million stolen records. Mark Goudie, Managing Principal, Asia-Pacific – Investigative Response, Verizon Business, talked to Jasmine Desai about the latest security threats and solutions for the same

Click for complete article >>

Over the last few years, millions of people have entrusted Facebook with everything from their little moments to their life stories. Now, investors are preparing to entrust Facebook with more than $10 billion in cash, giving the company limitless resources to find new ways to turn data into profits. With the new ownership coming in, and all that money being bet on the ability to turn data into cash, it seems like a good time to make sure the proverbial house is in order. And if you’re not Facebook right now, celebrate their success by going through this same process on your own systems – it’ll be good for you.

Get your data security review started with an updated inventory of databases and file servers on the network. Make sure you go sniffing around to find and catalog all of those systems. It’s the ones that fall through the cracks that are likely to come back to bite you later. Get yourselves some software that will go out and actively probe all the nooks and crannies of your network to find all the data stores that are out there. If you find systems on the network that you don’t use or don’t need – get rid of them!

With your fresh inventory in hand, you can turn your attention to looking for vulnerabilities and misconfigurations on each and every system. You’re looking for default logins, missing patches, weak passwords, and disabled security features that make it easy for someone to gain unauthorized access or disrupt operations. The issues you find in this phase ideally should be fixed, but that’s much easier said than done – so get ready to implement compensating controls.

Before you get into those compensating controls, there is one more issue to look into – user roles and privileges. It’s imperative for you to ensure that access to data is granted on a need-to-know basis, and that only those whose job requires access to a system are given that access. This means identifying who your admins and power users really are, eliminating any access rights that don’t belong. It also means documenting any privileges that should never be exercised, but can’t be revoked, so their use can be closely audited.

Which brings us back to those compensating controls. You may find yourself in need of quite a few of them. Missing a few patches? No problem – as long as you’re monitoring for exploits of those unpatched vulnerabilities. Applications require several insecure database settings? No need to panic – just watch the database 24×7 and make sure nobody abuses it. Got DBAs (those pesky built-in segregation of duties violations that come with each database)? Of course you do, we all do. And they’re usually very nice and quite harmless – but you still need to track everything they do with our data. A daily dose of real-time activity monitoring for your data stores will take care of all this business in one shot.

That’s all it takes. Inventory. Vulnerability and configuration scanning. User rights review. Activity monitoring. Four basic steps to keep all those billions of dollars of data safe and secure. Congratulations and best of luck.

“You get scared because your information might be stolen, like credit card number maybe. It’s really scary,” said a UNCC student.

Students and staff were told in February that some 350,000 of them could have had their social security numbers and financial information exposed on the internet.

Click for complete article >>

Click here to watch the video >>

Mostly, the talk has been focused on understanding the risks and implementing appropriate workarounds. But there seems to almost always come a time in the conversation when someone asks, “How can this be?”

It’s stunning to consider that Oracle sat on this issue for so long. It’s a critical vulnerability that fully compromises any Oracle database. It’s easy to exploit, requires no authentication, and it’s almost undetectable using built-in database features. But through the years and through a major database release, it remained unfixed and under wraps.

Click for complete article >>

As a result, chief information security officers (CISOs) are becoming a more significant presence in corporate boardrooms with a greater input into strategy, and also are shifting more toward risk management than simply reacting to one security incident after another, IBM’s Center for Applied Insights found in its study “Finding a Strategic Voice: Insights from the 2012 IBM Chief Information Security Officer Assessment.”

Click for complete article >>