What is a Data Breach?
A data breach occurs when there is any unauthorized access to electronic information. A data breach can involve access to personal information, such as a patient's medical history, personally identifiable information, financial information and trade secrets. It doesn't matter what the data is; it's the fact that someone who shouldn't have access to the data was somehow about to access the information.
Examples of data breaches
Some of the most well-known data breaches occur with the leak of customer financial information. Most notably, Target had a significant data breach that resulted in its shoppers' credit and debit card information being spied by an unauthorized individual. When something of such sensitive nature happens to a store or other business, it can take quite some time before people feel comfortable enough to continue to give it their business. A data breach can result in a perceived betrayal of trust.
Target isn't alone as a victim of a data breach. Home Depot, Sony, the Department of Homeland Security, LinkedIn and other well-known organizations have all had data breaches recently. In the case of retailers, credit card numbers are usually the data that's accessed. With LinkedIn, it was usernames and passwords that were accessed. In the case of the Department of Homeland Security, it was the names, titles and contact information of about 9,000 employees. In most cases, the data accessed has value, while in others the data has value for a cause.
Who and how?
It's no longer just a savvy computer user who tried to access data; it's more frequently a criminal or government that it the user or organization who wants the data. In the case of the criminal, it's to profit from the sale of sensitive data, such as credit card accounts or corporate secrets. With a government data breach, the data can be used for identity theft or espionage. Regardless of the data breach, it's not a random act but planned.
The attacker typically chooses a target, either a company, organization, or government, and then research the computer systems to find vulnerabilities in the information security systems that are meant to protect access to restricted data. The attacker then uses a variety of tools to gain access to computer systems.
Sometimes this is done with software programs that attackers use that can compromise the security of the data, and sometimes it's done with the help of people that already have access to the organization's data by tricking or baiting an employee into giving access to the attacker. Even though organizations advise their employees never to share their password or login information, people are often trusting and either voluntarily reveal their account credentials, or are sometimes manipulated and show them.
Once the attacker can access the data, the attacker often doesn't want their attack to be visible. This time allows the attacker to continue to access data and sell any information they've obtained without the organization being aware of the breach. Most data breaches are considered criminal acts.
What's stolen?
The goal for a criminal is to sell any information taken in an attack, so any data that has value is a target. The types of data targeted can include a broad range of information such as:
- user accounts
- member names
- date of birth
- credit card numbers
- email addresses
- member identification
- telephone numbers
- bank or financial account numbers
- claim information
- clinical information
These items are just a shortlist of the most useful information that's typically stolen, and for businesses and governments, the information taken could even include patents, product designs, software programs, and confidential email correspondence. If data is useful to someone else that shouldn't have it, that data is a potential target for an attack,
Many instances of data breaches can be accidental. For example, if a person who works at a hospital somehow gets a glimpse at a patient's information on a computer over another employee's shoulder, that can be considered a data breach. The individual getting a glimpse is not authorized to gain access to the information, even if they do so innocently.
What organizations do to prevent data breaches
Information is critical for almost any organization, government or business to operate and is increasingly electronic instead of physical. Credit card companies like Visa and MasterCard have security requirements for any business that has accepted credit cards, companies have security policies that require passwords to be changed every ninety days, and websites increasingly require passwords for users that are difficult to hack.
In spite of all this, anywhere there's data of value is a potential target and is being tested to see if it's possible to access the confidential and restricted data. Companies, governments, and other organizations in data security technology and larger organizations have a dedicated person or team of individuals that focus on keeping the data security from attack using sophisticated technology and tools.
For a free white paper on cloud security challenges you can download one from Makeen Technologies titled "Cloud Computing: Security Challenges & Their Solutions."
Are you likely to suffer a data breach?
Unless you have valuable data on your personal computer systems, or you have access to valuable data because you work for an organization and have a user account, it's often not worth the time and effort for an attacker to target an individual user.
You're more likely to be affected if a website or service you use suffered a data breach. You may have been notified about one already, and received a service to help you monitor your credit, and paying attention to unusual transactions or items you don't recognize is always a good practice. But the best way is to be sure you use common sense.
Don't give your user account or password information to anyone, don't open email attachments from people you don't know, and if you have data with a company that suffered a breach, go to their website to see what they recommend and if they offer any assistance to monitor any personal data.
In the case of the Target breach, many banks sent out new ATM cards and credit cards to consumers, and the breach accelerated the adoption of chip-based credit cards in the United States.
To my way of thinking
When Jesse James was asked by a reporter why he robbed banks, he said: “that's where the money is.” With money now in the form of electronic information, attempts by criminals are always a danger, so being patient with increased data security, like complicated passwords or verifying you're not a robot are important.
Not a subscriber? Don't miss a single issue: