After 2017’s Many Data Breaches – How to Protect Your Company’s Identities
“400,000 British identities compromised”- this and similar headlines have appeared frequently in the UK during 2017 where a number of high profile data breaches have exposed personal identity data of millions of British citizens.
The United Kingdom has long held a strong reputation of diplomacy, integrity and stability. It holds the fifth largest economy, Forbes recently named it the best place for business. These enviable characteristics also make the UK a lucrative target for data security breaches, as hackers work to steal data from some of the world’s top companies.
The UK currently ranks a distant second behind the United States as far as data breaches. It’s a sophomore ranking which it would be glad to relinquish. Survey results from research firm Statista show that data security breaches in large UK companies average around $20,000 GBP, which is ten times the cost of small business.
Recent UK government research found that about half of all firms in the UK have experienced a cyber breach over the past year or so (7 in 10 large businesses), which is a fairly staggering statistic. Spending on IT security products and services has been growing steadily over the past decade or so, which you would think would have reduced the number of attacks. However, organizations still struggle with the “identity challenge” – verifying who a user really is and understanding what systems and data they should have access to.
Identity-powered security safeguards like Identity and Access Management (IAM), can help you protect customer and corporate identities. To better understand the strategic value of IAM, let’s first look at (in no particular order) five of the biggest UK data breaches of the past year, and the impact it made on the companies that suffered them.
1. Tesco Bank
In November of 2016, Tesco bank records of over 9,000 of Tesco’s customers had their private banking data compromised. A security vulnerability within a mobile application was exploited to gain access to client records, which resulted in the suspension and corruption of several online transactions, which resulted in the bank having to reimburse 2.5 million pounds to its clients.
Lloyds Banking Group, Britain’s largest mortgage lender then suffered a Denial of Service attack, which was detected and somewhat thwarted by the Lloyds security team, and their systems, but the impact to client record access did suffer over a period of days. The Royal Bank of Scotland and HSBC have been targeted by DoS and Distributed Denial of Service attacks as well.
Enable strong authentication:
All businesses, including banks like Lloyds and Tesco should implement Identity and Access Management solutions to make user logins and passwords more secure. 22% of data breaches are caused by compromised credentials.
The safety of your valuable data should not depend on a single password. With Safewhere’s multi-factor authentication (MFA) functionality you can protect your resources by requiring a second set of information for authentication, such as an SMS code or email. Even if a password is compromised, MFA makes it difficult for hackers to gain access.
2. Wonga
Proving that financial services companies are one of the most frequent targets of cyber attacks and data breaches, payday loans company Wonga was hacked in April of 2017. 250 thousand customer records were compromised, including bank account details, email addresses, physical addresses and phone numbers.
The sort of data that was stolen can be used by cyber criminals for additional attacks, such as compromising identities and passwords on other organizations’ systems.
3. Three Mobile
One of the top mobile telecommunications carriers in the UK, Three Mobile, has had a couple of data breaches in the past few years. The identities and passwords of over 200,000 customers were compromised in March of 2017, after they recovered from a similar event in 2015. Individual customers could also see the account details of other Three Mobile clients, which is a violation of Data Protection Act legislation.
This breach was the result of a single employee’s network credentials, which resulted in a much larger breach of client data. This event is possibly the clearest example of where IAM, and advanced identity protection through tactics like Multi Factor Authentication could have prevented such a catastrophic event. If the breach had been detected sooner, Three Mobile could have reduced the damage to its reputation and to its customers private data.
Respond quickly to threats: With Safewhere IAM, you can track your user’s behavior across your entire system with real-time monitoring. You can see what applications and data users are accessing and react quickly to any sudden changes in their behavior that might indicate a breach. If you do experience a breach during audit reporting, it’s easy to identify how a breach happened, and then work to troubleshoot and minimize the damage.
4. ABTA
In February of 2017, the UK’s largest travel services provider had their data security perimeter breached by opportunistic hackers. Personal identity information for over 43 thousand people was compromised by a website cyber attack. The people behind those identities were already escalating claims of sub-standard travel services by travel providers, so it certainly added injury to insult in this case.
The ABTA offered the effected individuals a free identity theft protection service, which was a costly service, and seems like closing the barn door after the horses have already escaped.
Eliminate security blind spots: When a services firm like ABTA doesn’t know who has access to sensitive company and client resources, it can leave a business with security blind spots. In circumstances like when an employee is leaving, it’s important that his/her access to corporate systems is removed as quickly as possible to reduce possible hacker entry points.
Safewhere provides automated user provisioning to help you make sure that when employees depart, all their access privileges are revoked for all applications at once and their user accounts are immediately disabled.
5. Debenham’s
In April of 2016, the Financial Times published a study of the most secure retail e-commerce websites. It also mentioned that fifteen of the top eighteen UK ecommerce sites were not up to the standards of retailers such as Marks & Spencer’s (M&S).
One of the retail e-commerce websites which the Financial Times, and UpGuard, the firm which conducted the security testing of the sites in the study found to be lacking in security measures was flower franchise Debenham’s. Which should have motivated Debenham’s to improve their security posture.
Yet in April of 2017, a security breach of Debenham’s e-commerce hosting provider, Ecomnova, occurred, leading to the theft of personal and payment details of 26,000 customers. This is a strong signal to companies that outsource their technology management to managed services providers. Contracting the management of your data doesn’t guarantee its security, companies still need to do their due diligence of companies they partner with for data management. Data out of sight doesn’t equate to out of mind.
Of the 500 largest and most successful companies in the world, twenty-six are based in the UK. UK businesses and organizations of all types and sizes are at risk of having their data breached, as well as that of their respective clients, partners and constituents. Improve the security posture of your internal and external users with an Identity and Access Management solution from Safewhere.
