It took only a modicum of skill for a cybergang to steal 94 million credit and debit card payment records from the TJX retail chain -- and follow that up by hauling in 130 million records from credit card processor Heartland Payment Systems.
Court records reveal that those record-setting break-ins were almost too easy. Even more surprising: The thieves were able to take their sweet time extracting the data  , in each case going undetected for more than a year.
What happened to TJX and Heartland was not unusual. And details unveiled in the prosecution of gang members involved in both thefts have shed fresh light on a business truism demanding more scrutiny: Workplace networks have turned out to be much more porous and difficult to defend than anyone ever anticipated.
Overly complex IT systems are producing endless opportunities for cyberthieves, who need only to master simple hacking techniques to get their hands on sensitive data. The result: Data breaches continue to plague companies, hospitals, universities and government agencies -- any entity that collects data and conducts business on a digital network.
The vast majority of organizations routinely fail to take simple defensive measures, such as shoring up common Web site weaknesses or uniformly enforcing the use of strong passwords. "Networks have become a hodgepodge of components stitched together, creating security holes that can easily be taken advantage of," says Barmak Meftah, senior vice president at applications security firm Fortify Software.
Though companies are loath to publicly disclose data losses, about 656 data breach cases made headlines in 2008, up from 446 in 2007, according to the non-profit Identity Theft Resource Center. Through nine months this year, ITRC has archived new stories chronicling 391 data thefts.
With IT staffs stretched thin -- and concentrating on adding digital services -- data heists are going unreported, or unnoticed, security analysts say. "The problem for any organization is, 'How do I make sure all the doors and windows are closed, and how do I keep them closed, without stalling my business model?' " says Steve Dauber, marketing vice president at security assessment firm RedSeal.
Data thieves, in turn, are having a field day using well-understood hacking techniques to carry out increasingly refined cyberthefts. "They know where the money is," says Ivan Arce, CTO of security assessment firm Core Security Technologies. "And they're getting to where the money is faster and with less noise." (continued...)
© 2009 USA TODAY under contract with MarketWatch. All rights reserved.
|
Rackspace: It makes a difference when you focus on support.
House Lawmakers Push Ban on Peer-to-Peer Software
GAO: Los Alamos Computer Security Has Weaknesses
Computer Security Firm Fortinet Plans IPO This Week
Flat Shipments Hurt Dell Despite Increased Earnings
New Pogoplug 'Personal Cloud' Does Social Networking
Apple Tablet Rumored Delayed as Publisher Gears Up
Smartphones: A Bigger Target for Security Threats
FBI Says Hackers Targeting Law Firms, PR Companies