Data Breach , Governance , Incident Response

Here's more evidence how a data breach can have a major financial impact. U.K. telecommunications giant TalkTalk announced last week that its October 2015 breach will likely cost it up to £65 million ($94 million) and has led to the loss of 95,000 customers. That assessment was delivered as part of the company's third quarter financial report, which covers the period from Oct. 1 to Dec. 31 of last year.

See Also: Tips for Improving Your Overall Security Posture

The company says it lost an estimated £20 million ($29 million) in revenue while its site was down because new customers couldn't sign up for many types of services. Plus, TalkTalk literally resorted to paying existing customers not to leave by offering free upgrades after it took flak for controversially stating that no customers would be legally permitted to break their existing contracts - for example for mobile phone subscriptions - without paying a penalty, unless they could prove that they had suffered financial damage as a result of the hack. Privacy experts said that proving such damage would likely be impossible.

But paying customers to stay didn't come cheap. TalkTalk estimates that the free upgrades, plus the breach remediation itself, cost £40 million to £45 million ($58 million to $65 million). That includes "the exceptional costs of restoring our online capability with enhanced security features, associated IT, incident response and consultancy costs, and free upgrades," TalkTalk says.

To recap, the company says the breach resulted in 157,000 individuals' personal information being accessed by attackers, including 16,000 bank accounts and related sort codes, plus 28,000 tokenized credit card numbers. British police, as part of their investigation into the hack attack and a related ransom demand, have arrested five suspects, four of whom are teenagers (see TalkTalk Lesson: Prepare for Breaches).

Advanced 'Sequential Attack'

When it came to responding to the breach, TalkTalk initially moved slowly. CEO Diana Mary "Dido" Harding initially said attackers had wielded a "sequential attack" against her company, by which she appeared to mean a SQL injection attack. Many security experts say injection vulnerabilities are easy to spot and eradicate, provided businesses take the time and effort to do so.

Despite Harding's apparent discomfort in front of the camera, however, she wasn't reluctant to issue mea culpas in media interviews - and via YouTube - over the fact that her company had suffered its third data breach in just 12 months.

The head of the publicly traded company is now attempting to spin its $94 million breach bill as having been not that bad, and portraying the 14 percent of customers who snapped up freebies as being a strong response. "It is encouraging to see the business returning to normal after a challenging quarter that was dominated by the cyberattack," Harding says in a statement. "Our customers have responded well, with almost half a million customers choosing to take up our unconditional offer of a free upgrade."

A TalkTalk spokeswoman tells me that while year-on-year quarterly revenue would have increased by 4.8 percent, breach-related costs ate 3 percent of that increase.

Embarrassing Security Failures

Another surprising - if belated - result of the breach investigation has been the discovery of an apparent scam attack against the company's customers. TalkTalk says in a Jan. 27 blog post that its breach incident-response team uncovered evidence that three employees at India-based Wipro, which provides call center services to TalkTalk, had stolen customers' data and were tied to attempted telephone scam campaigns targeting the telco's customers.

"Acting on information supplied by TalkTalk, the local police [in Kolkata] have arrested three individuals who have breached our policies and the terms of our contract with Wipro," TalkTalk says. "We are also reviewing our relationship with Wipro."

What remains unclear, however, is how many customers will drop TalkTalk once they can leave without paying a financial penalty.

Breach Notification , Data Breach

The Internal Revenue Service in January was the victim of yet another hacker attack, and IRS Commissioner John Koskinen acknowledges that more such attacks should be expected.

See Also: Tips for Improving Your Overall Security Posture

"We have to recognize that this is going to be an ongoing problem," Koskinen testified at a Feb. 10 Senate Financial Services Committee hearing, adding that IRS systems are attacked or pinged 1 million times a day. "The caliber of the enemy we are facing is increasingly more sophisticated and more global. We're dealing with organized crime syndicates all around the world."

On Feb. 9, the IRS said it identified and halted a January attack, generated by an automated bot, on its Web application that taxpayers use to produce personal identification numbers for electronic tax filings. Using personal information stolen elsewhere, the attackers used malware to produce electronic filing PINs so they could file for false tax refunds, according to an IRS statement.

Notifying Taxpayers

The IRS says it's notifying affected taxpayers by mail that their personal information was used in the latest attempt to access the IRS application. The agency says it's protecting those taxpayers' accounts by "marking them to protect against tax-related identity theft."

The IRS says it identified unauthorized attempts involving some 464,000 Social Security numbers, including 101,000 that were used to successfully access e-file PINs. No personal taxpayer information was compromised or disclosed from IRS systems. "They weren't cyber breaches in the sense that our database was accessed," Koskinen says.

In last year's attack on the IRS Get Transcript system, thieves may have accessed as many as 334,000 taxpayer accounts (see IRS Hack Much Wider Than First Thought).

Both attacks represent "sophisticated forms of ID theft," the commissioner says. "The criminals already had all of the personal info of the taxpayer they needed."

Koskinen told the Senate panel the IRS over the past year has toughened its cyberdefenses, in part, through knowledge garnered from an information-sharing program established last year with tax-filing providers and states' taxing authorities. "We have been attempting to move from being solely reactive to pulling together the resources we need and the partnerships we need to try to get ahead of the game, get a head of where the criminals are going," he said.

Seasonal Attacks

Attacks on the IRS and tax-preparation companies are seasonal events. "Such operations are especially common starting in January and February, when many employers and financial institutions, among other entities, distribute tax documents," according to iSight Partners, a cyberthreat analysis company. "Fraudulent tax filings in the U.S. will likely increase over the next months leading to the tax deadline."

A year ago, tax preparation software provider Intuit temporarily suspended electronic filings via its TurboTax offering because the service experienced a dramatic increase in suspicious filings and criminal attempts to leverage stolen identities in order to claim tax refunds.

"It is axiomatic that we and every financial institution in the world are under attack," Koskinen says. "That's because criminals already have a vast amount of personal information and they're trying to figure out how to monetize that information."

Security Controls' Deficiencies

Though the attacks on the IRS' e-file PIN application and Get Transcript did not involve a breach of core IRS databases that store details on taxpayers' personal information and finances, a November audit by the Government Accountability Office took the tax agency to task for deficiencies in internal information security controls, including missing security updates, insufficient audit trails and monitoring for certain key systems and the use of weak passwords (see GAO: Taxpayer Data at Increased Risk).

"Until IRS takes the necessary steps to address these control deficiencies, its financial and taxpayer data will remain at increased risk of inappropriate and undetected use, modification or disclosure," Cheryl Clark, GAO director of financial management and assurance, said in the audit report.

The security profession is at a crossroads. The average age of today's practitioner is in the early forties, per industry figures. Consequently, even as demand for security increases, the profession is at risk of losing more people to retirement than it can attract through recruitment. Many in the industry dread that if the members of the community do not come together and address this issue, they are collectively digging themselves a deeper hole.

David Shearer , CEO of the International Information Systems Security Certification Consortium, believes that more needs to be done to bring younger minds into the profession. Shearer succeeded Hord Tipton as CEO of (ISC)² in 2015. As part of the older generation, Shearer believes the current crop of security professionals needs to lay the ground work to help younger pros be successful (see: New (ISC)² Head Tackles Staffing Crisis)

"We're seeing companies go under and CEOs lose jobs. But we haven't seen yet any major critical infrastructure attacks that have life, limb and property implications," he says. That's a clear possibility in the future, and so those that enter the profession today need to be groomed to be the defenders of the future, he says.

One of the ways (ISC)² is trying to make a difference and get youngsters interested is through its Safe and Secure Online program, Shearer says, through which volunteers spend time with parents, students and school administrators to show how children can be safe online. That's an opportunity to make them aware of cybersecurity at a very young age, he says. This program, by extension, is followed through in high school and then through to universities.

"We need more people," he reiterates. For every piece of technical convenience that is out there to help an average citizen use technology, the bad actors are finding a way to spin that into an attack vector. The attack surface is expanding exponentially, he says, even as practitioners today struggle to plug the holes, keep their heads down and deal with day-to-day security challenges. One big mistake the industry is making today is its faith in the latest and greatest tools, he says. The average company today can't afford some of these tools.

"It's easy to say the latest and greatest tools are available today, but there are thousands and thousands of companies out there just scratching and clawing, just to have some semblance of a perimeter security posture for their organization," he says.

In this exclusive audio interview with Information Security Media Group (see player link below image), Shearer shares the developments he has seen in the last year as the CEO at (ISC)². He speaks to some of the challenges facing the profession from a skills gap perspective and how this can be addressed, also touching upon:

Shearer is the CEO at (ISC)². He has more than 27 years of business experience, including serving as chief operating officer for (ISC)²; associate chief information officer for International Technology Services at the U.S. Department of Agriculture; the deputy chief information officer at the U.S. Department of the Interior; and the executive for architecture, engineering and technical services at the U.S. Patent and Trademark Office. Shearer has been responsible managing and providing services via international IT infrastructures, and he has implemented large-scale SAP enterprise resource planning projects.

Breach Preparedness , Compliance , Cybersecurity

How will federal banking regulators respond to growing criticism of the Cybersecurity Assessment Tool issued by the Federal Financial Institutions Examination Council?

See Also: Public, Private & Hybrid Cloud: Why Compliance (Done Right) is the Easy Part

There is no formal response yet, but the Federal Deposit Insurance Corp. has issued a new publication that leads some banking and security experts to believe no new guidance is forthcoming.

In its winter edition of Supervisory Insights, the FDIC's Division of Risk Management Supervision provides a synopsis of cybersecurity guidance, tools and best practices - all of which is meant to hammer home the point that regulatory examiners will continue to scrutinize whether banking institutions are carrying out these recommendations.

Al Pascual, head of fraud and security at Javelin Strategy & Research, is among those predicting that, based on the issuance of the synopsis, no new guidance is on the way. Instead, examiners likely will continue to use the FFIEC's Cybersecurity Assessment Tool, even though its use is supposedly voluntary.

"They cite a wealth of information and resources available to FIs [financial institutions] for managing cyber risk," he says. "It would seem to me, in keeping with sound regulatory practice, that the FDIC would not further raise the compliance burden of FIs, especially on such a fast-moving topic, if there is timely information elsewhere that they are implicitly standing behind."

Amy McHugh, an attorney and former IT examination analyst with the FDIC who now works as a banking consultant for CliftonLarsonAllen, notes: "This is an interim response to the issues raised recently by the industry about the lack of guidance. Instead of providing additional guidance, they just summarized previous information."

Criticisms of Cyber Assessment Tool

In recent weeks, bankers have been critical of examiners' use of the FFIEC's Cybersecurity Assessment Tool because its use is supposed to be voluntary (see Banks to FFIEC: Cyber Tool is Flawed).

But McHugh says it's likely the tool will continue to be used during the examination process, even though this most recent edition of the FDIC's Supervisory Insights suggests banks should rely more heavily on the National Institute of Standards and Technology Cybersecurity Framework.

"Use of the [NIST] cybersecurity framework is not intended to replace a bank's traditional information security program, but rather modify the program to address emerging cyber risks," according to the article, which is credited to Michael B. Benardo and Kathryn M. Weatherby of the Cyber Fraud and Financial Crimes Section of the FDIC's Division of Risk Management Supervision. "A bank's information security program should evolve as the operating environment and the threat landscape change. An effective information security program is not static and should be regularly evaluated and updated."

Bank management must incorporate the cybersecurity principles noted in the NIST framework into the bank's overall risk-management framework, the authors note in their synopsis.

McHugh contends, however, that while using the NIST framework as a guidepost for security makes sense, most of the regulatory examiners that are currently evaluating the cybersecurity soundness of banking institutions are less familiar with than they are the Cybersecurity Assessment Tool.

"The CAT [Cybersecurity Assessment Tool] will continue to be a discussion point in exams for 2016," she says. "If they have the time, I would recommend FIs [financial institutions] begin familiarizing themselves with the NIST framework but focus on the CAT for this year."

Matt Neely, director of strategic initiatives and management consulting at financial consultancy and compliance firm SecureState, says regulators' mention of the Cybersecurity Assessment Tool "continues to show the importance of this tool."

"More so, it further hints to the fact that this tool is more mandatory than optional," he adds. "We have seen more regulators using this tool during their audits, which in the past hasn't been regarded as requirement."

The FDIC's Division of Risk Management Supervision's release of the synopsis suggests that banking regulators want to make sure existing guidelines, tools and best practices are being applied, Neely says. "For example, we are seeing that more of our clients are needing to do more in-depth security testing on their Web and mobile applications, because past testing was deemed as failing to meet requirements," he says.

12 Regulatory Actions, Resources of Note

The FDIC synopsis points to 12 key regulatory actions and resources:

Cybersecurity attorney Chris Pierson, who also serves as CISO of payments and invoicing provider Viewpost, says the FDIC wants to reiterate that cybersecurity controls and governance are top priorities.

"It seems less likely that wholly new guidance will be out, but, rather, that the FDIC and other prudent regulators (e.g., the Federal Reserve, OCC) are communicating that all the guidance is available, and for banks to take action on these risks and controls."

Cybersecurity , Data Breach , Risk Management

Presented by Delphix     60 Minutes     Every financial institution is being challenged by its executives to move faster. With software applications at the forefront of innovation, IT organizations are under increasing pressure from lines of businesses to deliver applications faster while meeting internal IT directives to cut costs, protect customer information, and comply with heightened regulatory requirements. Given these varied priorities, what steps can be taken to do more with less? Mobile banking applications have become the front line for acquiring and retaining customers in the midst of competitive pressures. On the back end, IT organizations are constantly looking to modernize, rationalize, and consolidate their application portfolios to reduce costs and improve efficiencies. Private and public cloud onboarding has become a strategic, cost-effective initiative for many large banks, but securely migrating applications containing sensitive customer data is cost prohibitive. Aside from these impediments, financial institutions face heightened regulatory pressures and must invest in costly compliance programs. On the whole, these competing requirements compound the demands for data, making Data as a Service an integral component of any enterprise data management strategy. In this webinar we will discuss: Current market trends and the importance of software innovation in the financial services industry; Technology debt and other impediments to developing applications that are critical to customer experience and competitive advantage; The advantages of using an integrated data masking and delivery solution to solve critical bottlenecks in the software development lifecycle; Case studies of financial services institutions that are using Data as a Service to accelerate application releases and unlock innovation. You might also be interested in … UK Police Arrest Suspect Over CIA Director's Email Hack

Breach Response , Data Breach

To the annals of "corporate responsibility," add this gem: Hong Kong toymaker VTech has revised its end-user license agreement to make clear that it can't be held legally responsible for any data breaches. The move follows a high-profile hack of its "connected" toy services that earned the company fourth place on our Top 10 Data Breach Influencers list for 2016 - and not for good reasons (see Why VTech Breach is So Bad - and So Avoidable).

See Also: Defending the Attack Surface: Protecting Data and the Web Apps That Access It by Protecting Data Where it Resides and the Web Apps That Access it

The breach also left VTech with an image problem: Why should consumers trust a company that sells Internet-connected toys - and more recently home automation and security systems - if the business can't even keep children's profiles and chat messages with their parents safe from a hack?

Yet VTech's latest response looks almost laughably flat-footed: It's rewritten the 2,400-word terms and conditions that govern its products - and, let's be frank, which few people read. As Vice first reported, the revised T&C's "limitation of liability" subsection now includes such language as: "You acknowledge and agree that any information you send or receive during your use of the site may not be secure and may be intercepted or later acquired by unauthorized parties."

Responding to VTech's latest move, Australian information security expert Troy Hunt says it shows the company failing to step up to its responsibilities, including where children's data is concerned. Furthermore, he argues, consumers must be able to trust businesses to keep their data secure.

"Look, I'm the first person to acknowledge that there are very few absolutes in security and there always remains some sliver of a risk that things will go wrong, but even then, you, as the organization involved, have to take responsibility," Hunt says in a blog post. "If they honestly don't feel they're up to the task of protecting personal information, then perhaps put that on the box and allow consumers to consciously take their chances rather than implicitly opting into the 'zero accountability' clause."

'Skilled Hacker' Breached Toymaker

What rankles, of course, is that VTech's move comes in the wake of it suffering a serious November 2015 breach. The company says databases for its Learning Lodge, Kid Connect bulletin boards and PlanetVTech website databases were compromised, resulting in the exposure of 7 million kids' profiles and 5 million parents' profiles, including photos and chat logs. About 1.2 million of those kids also had a service called Kid Connect enabled, which allows them to chat with parents via their toys. VTech has blamed the breach on "a skilled hacker," noting that a related police investigation continues. So far, that investigation has resulted in the arrest of one man by British police (see VTech Breach Suspect Arrested).

VTech recently announced that on Jan. 23 it restored its Learning Lodge online service and related app store, which had remained offline following it learning of the Nov. 14, 2015, attack. VTech says its bulletin boards will be reopened later, but that its PlanetVTech site will not.

VTech is now defending the change to its terms and conditions, with spokeswoman Grace Pang noting that while it's "worked hard" to improve security since the breach, "no company that operates online can provide a 100 percent guarantee that it won't be hacked."

She adds: "The Learning Lodge terms and conditions, like the T&Cs for many online sites and services, simply recognize that fact by limiting the company's liability for the acts of third parties such as hackers," noting that "such limitations are commonplace on the Web."

Time for a Boycott?

But multiple security experts continue to question the company's move, noting that VTech was hardly suggesting before its breach that it was 100 percent hack-proof (see Why "Smart" Devices May Not Be Secure). "If VTech thinks that those T&Cs are the answer to their problems, I think they should be given a bigger problem to deal with," Ken Munro, a partner at penetration testing firm Pen Test Partners, tells the BBC. "Boycott them and take your money somewhere else."

Callum Murray, head of commercial technology at law firm Kemp Little, also tells the BBC that VTech's move is legally questionable. "It's unusual to see these terms in consumer contracts, and it's questionable if they would be enforceable," he says.

But is VTech's legalese move "commonplace," as the company suggests? "I don't see this as any different than any other CYA language in response to FTC [U.S. Federal Trade Commission] enforcement actions or lawsuits," the privacy-rights blogger known as Dissent tells me via Twitter (see LifeLock Settles FTC Case for $100 Million).

I really don't get the brouhaha over vTech changing their T&C. So many other companies have already done the same thing over the past 1+ yr.

If VTech's attempt to legally absolve itself from hack attacks is the legal norm, what does that say about the state of our information security, and the security of "smart" products marketed in particular to children?

Enter the EU

Thankfully, help is on the way, at least for Europeans, in the form of the EU's General Data Protection Regulation - GDPR - which is scheduled to take effect in two years. "As of spring 2018 any organization trading in any EU member state - that'll include you, VTech - that collects personal data is legally obliged to properly protect that data," Munro says in a blog post, noting that personal data means any information that could be used to identify a person, including location data, IP addresses and not limited to names. Compliance with the new EU law will be mandatory, and backed by penalties of up to 20 million euros ($22.7 million) or up to 4 percent of a company's annual worldwide profits for the preceding year - whichever is greater.

"VTech, you have two years to get your house in order," Munro says.

This story has been updated to include additional commentary from Munro.