CS1701

yahoo! fallout
uninhibited, accessing vast quantities of
sensitive data and wreaking havoc. A single
hack could be forgiven as unlucky, but twice
smacks of a complete unwillingness to act
and take the security of its customers'
sensitive data seriously."
As far as he is concerned, there is a
fundamental step missing - damage
limitation. "At whatever point a hacker enters
a network, they must be contained,
restricting the data they can access and the
damage they can inflict before they are
detected. This obvious step is missing from
the cyber security strategies of some of the
world's biggest organisations and is the
reason we are seeing hacks that affect
consumers on such a massive scale.
However, by looking to approaches such as
cryptographic segmentation to contain a
threat, businesses can ensure a hacker
cannot roam freely across its network,
significantly limiting the impact of an attack."
EASY ACCESS
As Steven Malone, director of security
management at email security firm
Mimecast, is at pains to point out, email is
one of the most vulnerable windows into an
organisation - which makes it no surprise
that 91% of cybercrime starts with an email.
"Considering the inherent weaknesses of
email, it is critical that organisations take
proactive measures to secure themselves
from simple phishing emails right through to
impersonation and weaponised
attachments. Nowadays, effective malware is
easily bought online, meaning that criminals
with little to no computer skills are free to
send infected emails. It is also vital that
organisations look to train employees, as
they will always remain the gatekeepers into
organisations. Some alertness can go a long
way, spotting giveaways in the emails so
perfectly crafted they could have be sent by
a colleague or close friend."
FORENSIC EVIDENCE
David Gibson, VP of strategy and market
development at Varonis, believes
organisations should be taking steps not
only to safeguard data, but also provide
forensic evidence when the worst happens.
"The first step in a data security strategy
should be to instrument your environment to
be able to: a) see who is accessing data,
when, and how; b) profile normal behaviour;
and c) alert on abuse. Step two should be to
identify sensitive data and ensure that only
the right people have access (ie, the principle
of least privilege). Step three is to implement
automated processes and human
checkpoints to verify that controls put in
place stay in place, so you don't backslide to
an insecure state.
"Interestingly, if Yahoo hadn't instrumented
their environment to detect evidence of
intrusion, they may never have 'officially'
discovered the recent two data breaches….
The upcoming breach notification
requirements will also place a new burden
on data controllers like Yahoo," Gibson adds.
Under the General Data Protection
Regulation (GDPR), the IT security mantra is
clear: 'always be monitoring'.
TOO LITTLE, TOO LATE
Once the breach had been unearthed, Yahoo
notified potentially affected users, asking
them to promptly change their passwords
and adopt alternate means of account
verification - but that was very much
slamming the barn door shut after the horse
had well and truly bolted. The first breach,
remember, took place in 2014, so whatever
remedial action Yahoo has recommended
since the discovery of the breach in October
this year is all too little, too late. The damage
has already been well and truly done. Yahoo
ARE WE PASSING THE PASSWORD TEST?
New online research commissioned by credit information provider Equifax reveals that how we manage our
passwords could mean we are leaving an 'open door' for fraudsters. According to the responses of over
2,000 people, more than a quarter (27%) change their online passwords less than once a year and 23%
never change their passwords without being prompted. It appears the over 55s are the most lax - with 29%
of them admitting to infrequently updating their passwords.
Lisa Hardstaff, identity fraud expert at Equifax, believes the fact that people now have so many passwords to
remember could be a reason why they don't regularly update their passwords. "Our research revealed that
nearly a third of consumers (31%) have more than five passwords. This demonstrates that people in the UK
are definitely doing the right thing in ensuring that, if a fraudster accesses one of their passwords, they can't
access all their other accounts by using the same password. However, good practice is to ensure that you
regularly change your passwords and, worryingly, over a quarter of Brits do that less than once a year."
Lisa Hardstaff, Equifax.
Passwords can be the first barrier that online criminals face when trying to access someone's personal details,
she adds. "So, understanding what makes a password strong can help keep information safe."
www.computingsecurity.co.uk @CSMagAndAwards Jan/Feb 2017 computing security
19