There has been a lot of news coverage in recent weeks on high profile data breaches across a variety of organizations. The two that stick out perhaps more than others (if for nothing other than the sheer volume of news about them) are the breaches at RSA and Epsilon.
Data breaches are a serious matter, regardless of what data was gleaned in the breach. Even innocuous things such as name and email address are serious losses that could have a high potential damages, and when you get into trade secrets and sensitive data around a massively deployed strong two-factor authentication scheme the ramifications are far reaching indeed.
Working in the AppSec space in infosec I am frequently asked how things like this can happen? Is it that the companies themselves are lazy, complacent – or worse – negligent?
No.
Nobody* wants to see data lost, least of all the company whose systems become compromised. That’s a worst case nightmare scenario that keep us up at night. Except in some rare cases, I wouldn’t consider these organizations negligent. As RSA proved – you can have some of the best perimeter security in the world, but that won’t necessarily protect you should you become a target. The weakest link in the security chain has moved from the infrastructure to the people, and attackers will almost invariably attack the weakest link. Spear phishing and clever social engineering are two of the most serious threats facing businesses today – and recent news reports are showing why.
So, where do we go from here? We learn. We improve. We teach.
Much can be learned by everyone from these breaches. As we learn more details about how these breaches occurred we can improve our security to protect against these new attack vectors. Newer and better controls can be added to our applications and services which can help mitigate these new threats. We can – and should – educate our employees about the dangers of social engineering and spear phishing. We can use this opportunity to increase and refresh their security knowledge.
What we shouldn’t do is point fingers, ridicule, or otherwise blast these vendors (at least with regards to the fact that they got hacked – their PR handling of the incident is open to criticism, should you feel the need). Instead – lets learn from the mistakes made. Let’s collectively improve.
We can do better. We should do better. Let’s take this opportunity to do so.
* Obviously the attacker does want to see data lost. They don’t count 
