Recognizing Computer Threats – Data Breach Awareness, Part I

By Chris Williams

Data breach

If it seems like data breaches are becoming more and more commonplace all the time, that’s because it’s true: the frequency of data breach and security incidents that result in some level of data leakage is on the rise. On top of that, the public’s perception of these incidents is becoming more acute. This is in part because a larger percentage of data breaches are being publicized than ever before. Due to the prevalence of both national and state laws which require companies to notify consumers when their personally identifiable information (PII) is compromised, it is essentially unavoidable: organizations must have procedures in their incident response plans to deal with these types of contingencies. Private organizations such as Payment Card Institute (PCI) have their own rules concerning how breach notifications must take place; they typically enforce such policies through audits and by assessing non-compliance penalties.

Breach notifications

Best practice after a data breach is to send breach notification notices out as soon as the scope of the incident has been reasonably well determined; this is both for compliance purposes as well as for good “public relations”. On the other hand, companies that are slow to publicize data breaches are often maligned in the court of public opinion. Despite the bad PR that can occur when a company’s security practices are implicated after a security incident, some public forgiveness can be gained by simply being forthcoming. Additionally, when organizations provide supplemental services such as credit monitoring to data breach victims, the extra expense is typically justified by the positive effect on consumer confidence. Transparency, expediency, and ownership of the incident are surprisingly effective tools in retaining customers after an incident occurs.

All this being said, with the sheer number of incidents happening, consumers still need to understand how to minimize their risks. It is important to know what steps to take if an incident occurs targeting a service provider or retailer that they utilize. It is also vital to recognize that not all organizations are forthcoming when a breach occurs, even if the law says they should be.

Webmail accounts: use unique passwords

A data breach that compromises your email account password can mean more than just a loss of privacy (although that is of course the primary concern since most of us are uncomfortable with the prospect of strangers reading our emails). Exposure of personally identifiable information (PII) is often linked to identity theft and other forms of fraud; criminals may use this info directly or sell it via black market. This information is used to open fraudulent bank accounts, make purchases with compromised payment cards, and so on. Many users fail to consider the considerable level of PII that is exposed during a data breach. The following non-comprehensive list includes a few good examples:

Correspondences with companies you do business with, including healthcare providers (noteworthy because of the depth of information these companies retain); lists of personal friends, family members, and associates; employment-related messages such as recruitment or application emails; vacation plans; event invites; receipts for purchases, often with partially visible payment information; billing and shipping addresses; and much, much more.

A compromised webmail account can provide hackers with tremendous detail regarding your personal life—and accounts you may have with e-commerce sites and other services—therefore it is important not to re-use any passwords across multiple different services.

Scenario: compromised webmail password

Tom uses Yahoo for webmail. Tom’s yahoo.com email address is also the user name for his Amazon account, and the passwords for his Yahoo and Amazon profiles are identical. Let’s imagine his Yahoo password is stolen during a mass data breach; hackers can then gain access to his inbox, and read all of his messages. From there they determine that he has an Amazon account by skimming through transaction emails. Their next step will of course be Amazon.com. By simply entering the same password used to access his Yahoo inbox they will easily gain access to Tom’s Amazon account, because the password was re-used for both accounts; by contrast, they could not have done so if the passwords were different. (They would, however, still have his Amazon user name since it’s the same as his Yahoo email address).

Amazon, like most e-commerce retailers, allows customers to re-use payment cards that they have previously saved.  Whoever has access to Tom’s account also has access to make unauthorized purchases—without even having to provide a credit card.

The takeaway

Breach notification laws exist to protect consumers whose protected information may have been affected by a security breach. Unfortunately, these laws are not as comprehensive or as compelling as they could be, and so many companies are still slow to report & publicize incidents.

Using the same credentials for multiple email and/or other accounts is inadvisable. This practice creates a single point of failure by which attackers can gain access to all of your private data. Monitor your inbox for unsolicited messages, and check your Sent folder from time to time. Again, just because your webmail provider has not announced an incident does not mean no such event has taken place.

There’s plenty more so say about this topic: we’ll be back soon with part II!

Copyright © 2016 ParadoxPrime IA, All rights reserved

Leave a Reply

Your email address will not be published. Required fields are marked *