When we said as part of our 2014 predictions that there would be one major data breach per month, we actually hoped we’d be wrong. Unfortunately, so far, we’ve been proven right: the latest victim of a massive data breach is the well-known auction site eBay.
To recap, earlier this week eBay disclosed in a blog post that they had suffered a breach that compromised a database containing “encrypted passwords and other non-financial data”. While they said there was no evidence of unauthorized activity or access to financial information, as a best practice they asked all users to change their passwords.
The scale of the attack is difficult to understate. In a separate FAQ, eBay stated that all 145 million of their users would be affected. By any standard, this represents one of the largest data breaches (by number of affected users) of all time.
The breached information included the following details of users:
- Name
- Encrypted password
- Email address
- Physical address
- Phone number
- Date of birth
There’s really only one thing that end users of eBay can do: change their passwords. If you’re an eBay user and you haven’t changed your password yet – open a new tab and do it right away. If you have difficulty remembering a password, use a password manager. (We’ve previously given out tips on password security.)
System administrators may look at this incident and think: how do I make sure this doesn’t happen to me? After all, if a large, presumably well-funded organization like eBay could be attacked and breached, what more a smaller company with fewer resources?
We have created a special report on data breaches, which looks at the overall data breach threat. Looking at this specific incident, some things stand out that other organizations can learn from. First of all, let’s remember how the attack started: with compromised employee credentials. It is quite likely that these were compromised via some form of spear-phishing. We had earlier discussed the entry points of targeted attacks.
Some technical and non-technical solutions are possible to improve a network’s defenses at this stage. For example, internal usage of two-factor authentication systems can lessen the risks associated with any single password being compromised. Training staff to identify and avoid potential spearphising attacks may also be useful.
As for the data itself, all organizations should consider the increased (and correct) use of encryption. Items that people would consider as sensitive information (like those compromised in this data breach) may or may not be stored in an encrypted format.
Just as importantly, the encryption has to be used correctly. Best practices have to be followed throughout the entire process – from what algorithms are used, to how the encryption is carried out, to how keys are generated, etcetera. In the best of circumstances, cryptography is hard, let alone when it is not done correctly.
There’s no single solution that can remedy all potential security problems. That, however, is the point of a layered security solution: there are various ways that an attack can enter a network, and various ways that it can be detected as well. A properly designed custom defense solution will provide the best opportunity to detect and mitigate these threats.
