Jaime Chanaga, CISSP, CISA

AT&T Wirless Network Outage - Dallas/Ft. Worth Area

Normally I don't complain about anything on-line.  However, today I will make an exception.  My AT&T Wireless cell phone service started to have issues this morning.  I have just spent the last 30 minutes on the phone with Customer Service, only to be told there is a potential network outage (voice/data) on the AT&T Wireless network in Texas, affecting the Dallas area.

The only information I have at this time are two technical support trouble ticket numbers TT000009764939 and TT000009768806.  As soon as I find out more information I will post it here.

I have been a loyal premier business customer of AT&T Wireless for a very long time and hope they can find a resolution to this network outage.  I have posted this on twitter under #ATTWireless if you would like to follow any further updates to my experience on this issue affecting users of AT&T Wireless services.

Data Breach at University of Rochester

The University of Rochester has disclosed (see official notice) that a non-academic student database was compromised resulting in the data theft of social security numbers of current and former students.  Estimates by the university are that approximately 450 people are affected in this incident.

The University has notified the FBI, the New York State Attorney General, the Consumer Protection Board, and the Office of Cyber Security.  The University is also offering to pay for credit monitoring services for the victims affected by this data breach. 

Information Security Challenges for 2009

As the new year begins, I'm hopeful that despite the negative forecasts for the U.S. economy, there will be areas of business and technology growth driven by increasing regulatory and compliance mandates for organizations across many industries. Organizations should begin to look at ways they can leverage and optimize their use of information security management programs and technologies to enhance the operational and financial efficiency of their information technology services portfolios. Regulatory compliance as a stand alone business function does not add value to the financial bottom line of any organization.

It is up to those responsible for information technology and security management to find ways to add operational and financial value to their organization. To my fellow information technology and security colleagues, I urge you to make 2009 a year in which you actively brainstorm and produce tangiable added value to your organization. Let's do our part to help the economy grow--every action of added value can help! One thing I'm confident about is the ingenuity and resourcefulness of information technology and security professionals.

If you have an idea on how information technology and security can bring added value in 2009 to any organization, please share it with me or the readers of this blog.

Best wishes for success in 2009!

Data Breaches Caused By Negligent Insiders 75%, External Hackers 1%

A study just released by Compuware, the 2008 Study on the Uncertainty of Data Breach Detection, shows that among surveyed companies the leading cause at 75% for data breaches is negligence on the part of company insiders.  Malicious intent by insiders only accounted for 26% of detected data breaches.  Not surprisingly 1% of all data breaches are attributed to external hackers.   Although 1% of data breaches being attributed to external hackers may be underreported as organizations are careful to avoid the perception of being vulnerable. 

For more information on the 2008 Study on the Uncertainty of Data Breach Detection, please visit Compuware at: www.compuware.com/databreach

2008 U.S. Presidential Election At Risk For Posssibility Of Electronic Voter Fraud

As Election Day approaches in the 2008 U.S. Presidential General Election, I'm growing more concerned we could see more widespread electronic voter fraud attempts.  Given the climate of this highly charged political climate, it is no wonder that supporters of either ideological camp may be tempted to tamper with electronic voting systems to favor their respective political candidates.

Despite the public scrutiny of electronic voting machine systems by various researchers, universities, and state governments, there much more to be desired in terms of guaranteeing the integrity and transparency of the electronic voting process.

Some State Governments including California have taken leadership in conducting comprehensive, public, and well intentioned information security audits of electronic voting systems.  Although these tests have revealed serious flaws in the hardware and software security of commonly used electronic voting machines and tabulation systems, little is being on a national level to address the concerns of serious security researchers and technology industry experts. 

In this democracy, it is up to each one of us as citizens to require from our elected political leaders transparency and integrity in our efforts for national electronic voting adoption.   We should not allow this democracy be blinded or held hostage by partisan interests.

Articles & Resources on Electronic Voting

Wikipedia - Electronic Voting
Ohio Secretary of State - Study: Voting Systems Vulnerable
California Secretary of State - Top-to-Bottom Review
Debate hot over e-vote security
MIT - Does Your Vote Count? It Depends On Who's Counting Your Vote
States Ready E-voting Systems
Interview - The Grill: Avi Rubin

Shell (NYSE: RDS-B) Warns Employees Of ID Theft Risk Caused By IT Contractor

Shell Oil Co. is warning (click here for link to notification) U.S. based staff that a database containing the names, dates of birth, and social security numbers (SSN) for former and current employees was misused by an IT contractor. 

The allegation is that the IT contractor filed false unemployment claims using the identities of four Shell employees.  Shell has terminated its contract with the IT contract firm in question and is cooperating with local and State of Texas authorities to completely investigate this fraud incident.

Shell should be applauded for their prompt action to investigate and find ways of mitigating the impact of this incident.  Hopefully those guilty of conducting this fraud successfully prosecuted for their egregious breach of trust.

Healthcare Industry and Business Leaders Advancing Health Information Security

The Health Information Trust Alliance or HITRUST (http://www.hitrustalliance.org) is an independent organization working with leaders and leading organizations in healthcare, business, technology and information security to help advance the quality improvement and cost effectiveness of the protection of electronic information within the healthcare system in the United States.

In working towards this goal, HITRUST is currently developing a Common Security Framework (CSF) Program to enable healthcare related organizations to gain better understanding and adoption of the various industry regulations and international standards for information security such as:  ISO 27001, ISO 27002, PCI DSS, CoBIT, HIPAA, and others.

"The HITRUST Common Security Framework Program, through the collaboration of HITRUST and organizations that represent the full spectrum of the healthcare, professional services, information technology, information systems and information security, is establishing the HITRUST Common Security Framework (CSF), a comprehensive, certifiable set of tools to aid organizations in protecting their information assets and managing related risks, costs and complexities." (http://www.hitrustalliance.org/programs/)

As a former CISO in the healthcare industry with an understanding of the challenges faced by healthcare organizations I welcome the efforts of HITRUST.

The Bank of New York Mellon Reports Data Breach Impact Affecting 12.5M Customers

The Bank of New York Mellon (NYSE: BK) suffered the loss of 10 unencrypted data tapes in May 2008.  At the time of this incident, the bank estimated the tapes contained the personal information on approximately 4.5 million customers. 

After subsequent computer forensic examination of the data tapes, the bank is now reporting that the data tapes could contain the personal information on as many as 12.5 million bank customers.

Opinion: A lesson that all businesses should learn is to consider data encryption as another layer of security when storing sensitive personal and financial information.  Encryption won't prevent data breaches or accidental disclosure of sensitive business information, however encryption can prevent your sensitive business information from falling into the wrong hands.

Bank of NY Mellon data breach now affects 12.5 mln
http://www.reuters.com/article/domesticNews/idUSN2834717120080828?sp=true

The Princeton Review Exposes Personal Data and Test Scores of 100,000 Students

The New York Times broke the story that The Princeton Review's website exposed the personal data and standardized test scores of approximately 100,000 students. 

The New York Times article - Student Files Are Exposed on Web Site

Stanford Univeristy Data Breach Affects 62,000 Current And Former Employees

Stanford University has announced that a data breach related to the physical theft of a laptop computer has potentially put at risk the identities and social security numbers of 62,000 people currently or previously employed by the university.

Stanford University has provided an extensive FAQ regarding this incident located at: http://www.stanford.edu/privacy/faq/