Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
Mobile Tech
24/7/365 Network Uptime!
Average Rating:
Rate this article:  
Vendor To Blame for AT&T Data Breach
Vendor To Blame for AT&T Data Breach

By Jennifer LeClaire
June 17, 2014 8:34PM

    Bookmark and Share
Jon Rudolph, senior software engineer at Core Security, said AT&T's statement indicated the company could not or did not sufficiently limit the partner access to its data. As Rudolph sees it, AT&T is talking about the behavior of the partner when it should be talking about how this customer data was exposed to a breach in the first place.
 



AT&T has confirmed a data breach but there are yet many unknown details. The telecom giant said it recently learned that three employees of one of its vendors accessed some of its customer accounts without proper authorization. AT&T did not disclose the number of accounts or what information was breached.

"This is completely counter to the way we require our vendors to conduct business," AT&T said in a published statement. "We know our customers count on us and those who support our business to act with integrity and trust, and we take that very seriously. We have taken steps to help prevent this from happening again, notified affected customers, and reported this matter to law enforcement."

An undisclosed number of call records and Social Security Numbers were accessed sometime between April 9 and April 21, AT&T confirmed. The accounts were accessed as "part of an effort to request codes from AT&T that are used to 'unlock' AT&T mobile phones in the secondary mobile phone market," the company said.

Customers can request that phones be unlocked once they have fulfilled their wireless contract. AT&T believes the aim of the breach was to spoof customer identities in order to unlock phones, which are worth more on the secondhand market.

Accounting for Shades of Gray

We caught up with Alberto Solino, a technical program manager at security software and services firm Core Security, to get his take on the breach. He told us this is another example of companies failing to understand the risks that come along with third-party access -- and facing a crisis that may have been prevented by proactively seeking out or understanding potential attack paths.

"You can't make assumptions when it comes to security," Solino said. "You have to find these attack paths and validate them before someone else does or your business and most critical assets will always be at risk."

Andy Rappaport, chief architect at Core Security, told us privileged partners are in a gray area between insiders and outsiders. Security enforcement, network access, identity- and access-management entitlements, and auditing must account for these shades of gray.

Rappaport said he understands that business efficiency thrives on efficient supply-chains and federated partnerships. Security and access control are necessary to allow speed, he said, just like cars ultimately need brakes in order to safely travel fast.

"A company's attack surface grows as an exponent of the reliance on partners, outsourcing and even Software-as-a-Service," Rappaport said. "They are relying on not only their security policy and enforcement, but also on their partner's. It stretches the trust boundaries beyond the enterprise." (continued...)

1  |  2  |  Next Page >

 

Tell Us What You Think
Comment:

Name:

Eric:

Posted: 2014-06-16 @ 12:16pm PT
My account was accessed by someone trying to buy phones on my account. They had all my info. What stopped the fraud from occurring was they could not pronounce my last name....red flag...lol...



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Mobile Tech
1.   Apple Smart Watch Patent Surfaces
2.   iPhone 6: Bad for Apple Tablet Sales?
3.   GoTenna: Work-Thru for Dead Zones
4.   Nokia X Phones Had Identity Crisis
5.   Microsoft Axes Android Phones


advertisement
Android SMS Worm on the Loose
Malware lets bad actors cash in.
Average Rating:
Review: Microsoft's Surface Pro 3
Is it a tablet and laptop replacement?
Average Rating:
iPhone 6: Bad for Apple Tablet Sales?
Most likely, it will be a huge hit.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
34 European Banks Hit by Android-Skirting Malware
Criminals have been finding gaping holes in Android-based two-factor authentication systems that banks around the world are using. The result: 34 banks in four European countries have been hit.
 
New Web Tracking Technologies Defeat Privacy Protections
Recently developed Web tracking tools are able to circumvent even the best privacy defenses, according to a new study by researchers at Princeton and the University of Leuven in Belgium.
 
Juniper DDoS Solution Aims at High-IQ Networks
In the face of more complex attacks, Juniper Networks is boosting its DDoS Secure solution to help companies mitigate the threats with more effective security intelligence throughout the network fabric.
 

Enterprise Hardware Spotlight
Contrary to Report, Lenovo's Staying in Small Windows Tablets
Device maker Lenovo has clarified a report that indicated it is getting out of the small Windows tablet business -- as in the ThinkPad 8 and the 8-inch Miix 2. But the firm said it is not exiting that market.
 
Seagate Unveils Networked Drives for Small Businesses
Seagate is out with five new networked attached storage products aimed at small businesses. The drives are for companies with up to 50 workers, and range in capacity from two to 20 terabytes.
 
Another Day, Another Internet of Things Consortium Is Born
In the emerging Internet of Things, zillions of devices will be talking to each other. Samsung, Intel and Dell just formed a consortium to ensure each thing can understand what others are saying.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | Small Business | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.