Comments
yourfanat wrote: I am using another tool for Oracle developers - dbForge Studio for Oracle. This IDE has lots of usefull features, among them: oracle designer, code competion and formatter, query builder, debugger, profiler, erxport/import, reports and many others. The latest version supports Oracle 12C. More information here.
Cloud Expo on Google News
SYS-CON.TV
Cloud Expo & Virtualization 2009 East
PLATINUM SPONSORS:
IBM
Smarter Business Solutions Through Dynamic Infrastructure
IBM
Smarter Insights: How the CIO Becomes a Hero Again
Microsoft
Windows Azure
GOLD SPONSORS:
Appsense
Why VDI?
CA
Maximizing the Business Value of Virtualization in Enterprise and Cloud Computing Environments
ExactTarget
Messaging in the Cloud - Email, SMS and Voice
Freedom OSS
Stairway to the Cloud
Sun
Sun's Incubation Platform: Helping Startups Serve the Enterprise
POWER PANELS:
Cloud Computing & Enterprise IT: Cost & Operational Benefits
How and Why is a Flexible IT Infrastructure the Key To the Future?
Click For 2008 West
Event Webcasts
Equifax Is an Enron Moment | @CloudExpo #AI #DX #SDN #Cybersecurity
What makes this specific breach even more damaging is the type of the stolen data

Equifax Is an Enron Moment, But Not the Way You May Think

Enron changed how U.S. public companies audit and report their financial data. There is also an opportunity to use the Equifax data breach to create a framework for better protection of our data in future.

The credit reporting agency reported one of the largest data breaches in the history. Hackers were able to steal sensitive information from its internal servers. The stolen data include name, Social Security Number (SSN), date of birth, and also credit card numbers and driver license numbers in some cases. A massive breach like this can haunt the victims for years to come.

What makes this specific breach even more damaging is the type of the stolen data. If someone steals your credit card number, you call your bank and get a new card hopefully before the hacker is able to make use of the stolen card. But, if a hacker gets your date of birth, good luck trying to change it. In fact, thieves are known to sit idle for months waiting for increased awareness after the breach to subside before hitting the underground market with stolen SSN and dates of birth. If you are one of the 143 million people affected by this breach, get used to the feeling of being haunted. Hackers may use stolen data tomorrow or in multiple years from now. They have all the data needed to reset bank passwords, access health records, open credit card accounts on your behalf, etc. You will never know when or how they will misuse your data.

Equifax has been less than forthcoming in describing how the hackers were able to get to the most sensitive data. Baird Equity Research attributes the breach to a flaw in Apache Struts, one of the most popular software for developing Java-based web applications. A new vulnerability was reported recently in Apache Struts that allows hackers to remotely run arbitrary commands on the server. It's conceivable and even probable that either this vulnerability or another one like it was used for this hack. What's troubling is these vulnerabilities have existed for long time but were identified and mitigated only recently. Such vulnerabilities provide hackers enough time to target organizations with prized data and steal the data for nefarious use.

Albert Einstein is credited with the saying that the definition of insanity is doing the same thing over and over again, but expecting different results. If we, as a society, are to get better at protecting our most critical data, we have to try something new. Obviously, the law enforcement agencies will be spending a good amount of time reviewing Equifax's security processes, response, and the unfortunate timing of their executives trading stocks. However, this data breach is just one of the many, and while it looks pretty jarring, there is this uncanny feeling there is worse to come.

Some have argued for not using SSN as a means of identification. SSN was designed to track income and not a way to identify or authenticate people. However, such a move misses the big picture. SSN is one of the sensitive pieces of information we have, but as past breaches have taught us there are plenty more - date of birth, passwords, health record, employment history, etc. How are doing to protect them? We need a method to protect all sensitive data. Fortunately, technology can now offer such a required solution and with a little bit of public help, we can make meaningful progress in stopping the incessant data thefts.

One approach to preventing some of these mega breaches, including Equifax, is an innovative use of encryption. Encryption already secures data at rest. For example, if you use self-encrypting hard drives, or Microsoft Bitlocker, you are securing your data using encryption when it's sitting idle. Similarly, encryption secures your data in transit. When you connect to your bank website using your browser or mobile phone application, Transport Layer Security (TLS) protects data as it moves from you to the bank servers. When the banks provide the data to Equifax, they also use TLS. However, once the data is used by Equifax, it's decrypted and exposed. The exposed data works like a magnet for hackers and they try all possible vulnerabilities to find and steal the exposed data. In the case of Equifax, Apache Struts provided the path for the hackers to connect to the exposed data.

Encryption during runtime keeps data encrypted when applications are using the data. This allows organizations to limit access to data to the actual business logic running on the server. Had Equifax encrypted data during runtime, even with vulnerable Apache Struts hackers would have accessed only encrypted data which they wouldn't be able to decipher. Encryption during runtime understands that hackers will always be able to use vulnerable applications to connect to the servers. The best strategy is to ensure that even when this happens, the data we care about remains encrypted and therefore undecipherable to hackers.

Encryption during runtime is certainly not a panacea and cannot protect from all threats. For example, if the business logic itself is vulnerable, the data could still be compromised. However, it protects the data from all vulnerabilities that are found in code other than the business logic. An approach that combines encryption with best practices in developing secure applications can reach new limits in securing data.

When the Enron scandal was reported in 2001, the Congress legislated the Sarbanes-Oxley Act that increased audit requirements and made it harder for companies to fudge their financial numbers. It has been effective in avoiding another Enron-like scandal. If you don't want to see a repeat of the Equifax data breach, a good place to start may be with your congressman. Ask him or her to strengthen data breach laws and to require organizations to disclose how they protect your data in use. Disclosure of the internal security practices along with regulatory requirements can create a virtuous cycle where the most secure organizations are rewarded with more business. No bank would dare to operate their website without TLS today. Otherwise regulators, customers, security analysts, social media, etc., all will publicly punish and shame them. We need encryption during runtime for processing sensitive data.

About Ambuj Kumar
Ambuj Kumar is CEO and Co-founder of Fortanix. Prior to founding Fortanix, he was lead architect at Cryptography Research Inc. where he led and developed many of the company's security technologies that go into millions of devices every year. Previously, he worked for NVIDIA where he designed the world's most advanced computer chips including the world's fastest memory controller. He has a Bachelor of Technology from IIT Kanpur and an MS from Stanford University, both in EE.

In order to post a comment you need to be registered and logged in.

Register | Sign-in

Reader Feedback: Page 1 of 1

Latest Cloud Developer Stories
With more than 30 Kubernetes solutions in the marketplace, it's tempting to think Kubernetes and the vendor ecosystem has solved the problem of operationalizing containers at scale or of automatically managing the elasticity of the underlying infrastructure that these solutions n...
The deluge of IoT sensor data collected from connected devices and the powerful AI required to make that data actionable are giving rise to a hybrid ecosystem in which cloud, on-prem and edge processes become interweaved. Attendees will learn how emerging composable infrastructur...
When building large, cloud-based applications that operate at a high scale, it's important to maintain a high availability and resilience to failures. In order to do that, you must be tolerant of failures, even in light of failures in other areas of your application. "Fly two mis...
Machine learning has taken residence at our cities' cores and now we can finally have "smart cities." Cities are a collection of buildings made to provide the structure and safety necessary for people to function, create and survive. Buildings are a pool of ever-changing performa...
As Cybric's Chief Technology Officer, Mike D. Kail is responsible for the strategic vision and technical direction of the platform. Prior to founding Cybric, Mike was Yahoo's CIO and SVP of Infrastructure, where he led the IT and Data Center functions for the company. He has more...
Subscribe to the World's Most Powerful Newsletters
Subscribe to Our Rss Feeds & Get Your SYS-CON News Live!
Click to Add our RSS Feeds to the Service of Your Choice:
Google Reader or Homepage Add to My Yahoo! Subscribe with Bloglines Subscribe in NewsGator Online
myFeedster Add to My AOL Subscribe in Rojo Add 'Hugg' to Newsburst from CNET News.com Kinja Digest View Additional SYS-CON Feeds
Publish Your Article! Please send it to editorial(at)sys-con.com!

Advertise on this site! Contact advertising(at)sys-con.com! 201 802-3021



SYS-CON Featured Whitepapers
ADS BY GOOGLE