But, identity theft incidents are fast-becoming ideal cash cows for many of today's cyberthieves.
And just how they are getting this information has little to do with the oft-talked about vulnerabilities in software. Citadel's Michael Wiser points to a Gartner stat that supports this assertion, which estimates that some 65 percent of penetrations into a network are due to misconfigured systems. Only 25 percent take advantage of vulnerabilities in software (10 percent are due to malicious code).
He cites the example of a Russian crime ring that recently broke into a company's credit card database after taking advantage of a common misconfiguration. The criminals watched the financial records to discover frequently occurring charges. Armed with this info, they set up accounts for a few companies and began charging a couple of unnoticeable extra expenditures to individual statements each month. In 60 days, they earned about $20 million.
So just as ID theft is a highly critical occurrence organizations must protect against, so too must they more clearly understand and defend the vectors of attacks. While vendors must do their part for security by providing stronger software -- we all know they must get better -- there's also the need for businesses to configure devices comprising corporate networks properly. That means, for instance, nixing unnecessary services or addressing unknown account problems.
It's apparent to many corporations that setting baseline configurations for devices and then monitoring them for any improper changes is vital, especially given compliance demands. The battle now is actually getting there. And that requires the proper budget, the necessary support from bosses and colleagues, the right tools, and the time and clarity to do this work -- a mixture of things many enterprises still founder at giving security divisions.
Let's hope it won't have to take more online gangs to convince some executive leaders otherwise.
Illena Armstrong is editor-in-chief.
