Earlier this week, the Internet buzzed with rumors about a hack at T-Mobile when the alleged hacker posted information on the security forum Full Disclosure. T-Mobile has now confirmed that the posted information is from one of its documents, but it denies that the information was obtained through a hack and says that no customer information was compromised. This is great news for the company. It's even better news for their customers. But it also points to the most common threat to an organization’s data: the corporate insider.
We have no knowledge of how this information was obtained at T-Mobile, but in an industry that has many employees, contractors, third-party suppliers and partners all with access to a wealth of customer data, it should be no surprise that an insider is very likely involved. It was predicted. Telecommunications service providers have long taken the “defend the edge” approach to security, with a focus on keeping threats off the network. This makes is more difficult to monitor and block an insider from accessing information. For all carriers, assume that your data is under scrutiny from the inside as well as outside and take this week’s happenings as a call to action.
Reports are emerging today of a suspected breach on T-Mobile’s network, with hackers offering to sell customer and financial data to the highest bidder. Since Saturday, security analysts and T-Mobile have been trying to verify the breach and to determine exactly the type and amount of data compromised. What makes this potential breach especially unnerving is the weaknesses it shows in standard data protection among carriers. Earlier this year, leading communication service provider Verizon issued a report that found that 285 million electronic records were breached in 2008 and that organized criminal gangs were behind a large percentage of these breaches.
Since their inception, carriers have taken an externally facing, ‘at-the-edge’ approach to security. In simple terms, they focused on protecting the edge of the network from external attacks, believing that most threats would initiate off the network, and the edge would be the place where hackers and others would gain access. This completely ignores the risks posed by their own staff, contractors, suppliers and partners. What has occurred almost simultaneously is the rise of multifunctional phone devices that act as wallets, contact databases, email terminals, mini-computers, organizers, etc. Any carrier network now contains a wealth of personal and financial information and, with dedicated criminal organizations going after data to steal and sell, the carrier database is a natural target. Indeed, T-Mobile has been here before, as Paris Hilton no doubt remembers.
The “deflect at the edge” approach will not stop these types of criminals, who have shown the ability both to bypass these external controls and to infiltrate an organization with the prime purpose of stealing data. Therein lies the problem facing those who wish to protect the carrier database: just how do you get a clear, immediate snapshot of what is occurring, including whether or not data has been stolen? If this T-Mobile proves threat to be a hoax, which it may well do, it should still act as a wake-up call to all carriers as to the vulnerabilities inherent in protecting data. To ensure full protection and data integrity, the database should be protected from the inside out to the network edge, rather than the other way around. This approach would alert administrators to data movement or unusual activity around the database, protecting unauthorized access from both internal and external sources.
I am saddened to hear that the current crisis in the UK parliament over members' expenses has resulted in the demise of the Home Secretary. I enjoyed being interviewed last year on national radio to comment on her claims that the UK government's proposed ID card system would be "unhackable". A bold claim indeed, and I said as much at the time.
Anyone involved in IT security will recognize that there are no absolutes as strong as "unhackable" and that there are threats from more than outsiders. (Her claim was that as the ID card database would not be connected to the outside world it would be safe.)
When they pushed her off the docks in Belfast harbour they said that the Titanic was unsinkable. It is a shame the Home Secretary has found herself in need of a lifeboat.
