The technology breakthroughs of the information age have allowed organizations to be more productive and automate many interactions with consumers and stakeholders through the Internet. This has had unfortunate drawbacks; individuals can now utilize the Internet to gain unauthorized access to an organization, putting sensitive data at risk. An IT professional must be aware of these risks, as well as the numerous laws and regulations that his or her organization must be in compliance with.

In a previous chapter, you learned about various regulations that define an organization's obligation to secure information. This section explores a few laws that cover unauthorized access of that information: the federal Computer Fraud and Abuse Act and the Digital Millennium Copyright Act.

Most states have laws that apply to unauthorized access to confidential information. Because they have many parts in common, this section covers one law in depth. The California Identity Theft Statute will give you a basic understanding of state laws designed to protect data.

The California Identity Theft Statute requires businesses operating in California to notify customers when the business has reason to believe that personal information has been disclosed through unauthorized access. Personal information is defined as Social Security number (SSN), driver's license number, physical address, that is maintained in digital form. This statute applies to all businesses operating in California.

As soon as an organization realizes that there has been an unauthorized disclosure, the organization must notify the owner of the information that a breach has occurred. The law further provides for any individual damaged by the breach to bring a lawsuit to recover any loss incurred due to the information disclosure and failure of the organization to issue a timely notification.

The purpose of the California Identity Theft Statute is to provide sufficient notice to individuals whose personal information was stolen, so that they can take appropriate actions in a timely manner to prevent further damage by the data thieves.

The following are some of the elements of the California Identity Theft Statute that apply to data access and handling:

Furthermore individuals, commercial entities, and certain governmental entities including public universities and colleges may not:

Financial institutions are prohibited from sharing or selling non-directory personally identifiable information without obtaining the consumer's consent.

Even the most strict and thorough access control policies are prone to human error. This was vividly demonstrated in 2010 when a Virginia couple slipped past security and into a state dinner at the White House. The couple was subjected to all of the normal security screening procedures and was never a threat, but they were not on the guest list. They got in due to human error—the guard at the entry gate did not follow proper procedure and verify the couple was on the guest list.

Although the couple was not a threat and the situation was humorous, this type of failure could pose a grave risk. They could have been spying for a foreign government, or planning an attack on the dignitaries attending the event. This is a perfect example of failure in the human element of access control. An organization can have sound access control procedures, but without proper training and buy-in from all employees, the system can be easily defeated.

In the White House example, there were multiple layers of defense in place, including metal detectors and bomb-sniffing dogs. This ensured that even if someone got through they would not be armed. This does not mean that they could not be a threat. This is also true in computer security. Network antivirus may keep malware from infecting other systems, but a connection from an unauthorized laptop could still be a threat.

The party crashers are also a good example of social engineering. They dressed properly and acted with confidence that they belonged. These types of attacks along an organization's human vector are all too common.

In another example, a penetration testing team, called a tiger team, was testing the security and integrity of a major financial institution's customer data. The corporation had an IT office in a major metropolitan skyscraper. The bottom floor had a publicly accessible restaurant, automated teller machines (ATMs), and washrooms. Dressed as a maintenance man, one of the tiger team members hung an out-of-service sign on the public washroom.

Another tiger team member, dressed as a businessman with a briefcase, talked his way past the security at the door into the secure area of the office complex under the pretext of needing to use the washroom. This was a clear violation of security protocol. This access control failure was compounded by allowing the man to go to the washroom unescorted. Once in the washroom, the intruder accessed network cables in the drop ceiling and inserted a wireless access point into the network. From there, another member of the team sitting in the restaurant used his laptop to access the wireless network.

While inside the network, the team didn't have access to the system yet—but were able to access unencrypted data, like customer debit card numbers and Windows password hash in the supposedly secure internal network. Although there were intrusion detection systems and network-based antivirus systems running, passively sniffing network data did not trip any alarms. They were able to compromise hundreds of customer card accounts in a few minutes and leave undetected all because of a failure in the human element of physical access control procedures. Luckily, in this example, it was a tiger team working for the financial institution and not malicious data thieves. If this had been a real incident, it would have been a major problem for the institution. Needless to say this caused the team in charge of securing this information to re-evaluate their security assumptions.

Sometimes the best access control systems can be bypassed due to a failure in technology. No computer system is bug-free. Anything from an organization's operating system to its choice in Web browser or instant messaging client could be an access point for unauthorized access to its systems. Let's look at some technological failures that could lead to unauthorized access.

Microsoft Windows operating systems prior to Windows Vista had the possibility of running very weak password encryption. Passwords in Windows NT, 2000, and XP that were less than 15 characters long as well as any password on a Windows 95, 98, and ME system were stored in a file called a LAN Manager (LM) hash. This file employed Data Encryption Standard (DES) encryption; unfortunately, it did so in a predictable manner. This allowed for quick-and-easy brute-force attacks on the password files. Some systems could be accessed by brute force in a matter of seconds. Starting with Windows 2000, administrators have the ability to turn off LM passwords and use a more secure NTLM hash to handle user access.

UNIX/Linux systems had a similar issue in the late 1980s early 1990s. Password hash files and the hash salt were stored together in an unencrypted file. Using that file, a malicious user could brute-force a password offline very quickly. The common acceptance of a more secure shadow password file in 1990 provided a secure alternative.

Web browsers are a major vector for unauthorized access. Every major browser including Firefox and Internet Explorer has had bugs that allow for the arbitrary execution of code. These bugs have been exploited to allow malicious users access and elevated rights on compromised systems. A system could get compromised just by viewing a contaminated Web site.

Servers, especially Web servers and other public-facing systems, are another common entry point for unauthorized access. Not only are Web servers a risk due to the possibility of unsecure code being hosted, some of the languages used on the Web servers have had security flaws. Both PHP and .NET have had arbitrary code execution bugs that allow malicious users to access the Web server.

Besides system bugs, there are other ways that technology can allow unauthorized access. Some file storage formats allow for the censoring and blocking of sensitive information. Unfortunately, if done incorrectly, the device used to block out words can be removed.

Radio Frequency Identification (RFID) badges can also be a vector for unauthorized access. A malicious user could use an inexpensive reader to pull information off an ID badge and then flash a new chip with the cloned information. Security researchers have already demonstrated this technique by cloning the new RFID-enabled U.S. passports.

You have seen how both technology and humans can be the cause of unauthorized access. It is important to take steps to mitigate these possibilities, never relying on just one method to secure sensitive information.

There are a number of different types of security breaches. This is also a moving target as technology evolves. Here are some of the types of security breaches an organization may have to face:

This isn't a comprehensive list, and new vectors of attack are always being developed, but it does give you an idea of what the IT security field is facing.

The why of a security breach is almost as diverse as the how, but can be generalized into two categories, monetary gain and vandalism of systems.

Monetary gain takes numerous forms. Intruders in a system could look for valuable data to sell, personally identifiable information to steal and use, and physical equipment can be resold. Insider information to gain an advantage in stock trading is also often targeted. Accounting and human resources are also tempting targets. There have been cases of direct deposit information being tampered with causing paychecks to get deposited into the incorrect account. DoS and DDoS attacks have even been used in extortion.

Monetary gain motives may not even involve the organization attacked, just their servers. Spam re-mailers commonly get installed during Web server security breaches. Malicious code can also be injected into a company's Web site to try and infect customer computers for identity theft purposes.

Vandalism is the other major category for security breaches. This can be as harmless as kids having "fun" or trying to make a name for themselves amongst their peers, to groups making a political statement, and even individuals and groups protesting an organization.

Computer security is a critical issue for any organization. A breach in system security that damages organizations' computer systems can result in financial costs, loss of customer trust, and legal penalties.

There is also the possibility of ongoing system security issues. Did the intruder build themselves some additional backdoors for later access?

What disclosure must happen after the breach? Depending on the industry an organization is in and what was taken, an organization may be obligated to disclose the breach to the public. This must be done in a timely manner, especially if customer data was accessed. Not only is it a good business practice—allowing customers a chance to ward off identity theft—it may also be legally mandated.

An organization will also have to take a long look at its security procedures. Was it a failure in the technology utilized? If so, what will it take to mitigate the issue, and does the organization need to upgrade or change systems?

Was it due to a human failure? If it was human error, more awareness training may be in order. If it was due to malicious users or rouge employees, access audits may be in order to make sure that no one has access to information that they do not need.

The breach may also be due to a failure in procedure, if this is the case new procedures must be developed.

Security breaches can have serious consequences for an organization. They can rely on lax physical security, inadequate logical access controls, or a combination of both. Let's look at some examples of failures in both logical access controls and physical security.

Sometimes security breaches happen, not because of eternal attacks, but due to internal failures. Let's take a look at an example from the United Kingdom (UK).

On November 22, 2007, the UK government admitted that one of its departments, Her Majesty's Revenue & Customs (HMRC), had lost in the mail two CDs containing the unencrypted personal details of 25 million UK residents.

In response to a request by the National Audit Office (NAO), a junior member of HMRC's staff was instructed to send details of child benefit recipients to the NAO. The details were burned onto two CDs as unencrypted files, and then sent to the NAO using regular mail. At the time this was standard procedure at HMRC. To compound the security lapses, HMRC decided it was too costly to remove unneeded information from the files before they were sent. This included addresses and bank account information. NAO explicitly requested that the bank account information be removed, and HMRC ignored the request.

The UK Data Protection Act of 1998 specifies that if information is to be sent it must be subject to safeguards, and only the necessary data required for processing be sent. In this case HMRC violated both points of this law.

Once the data loss became apparent, HMRC started an investigation of the loss. They attempted to track down the CDs and contacted law enforcement for assistance. Unfortunately, the UK does not have the same reporting laws the U.S. does. Instead of immediately reporting the data loss to the public, HMRC waited ten days, plenty of time for accounts to get compromised. The UK does have an Information Commissioner, but unfortunately with no disclosure requirements. He was not informed of the issue until well after the event. The commissioner also had very limited powers to enforce the Data Protection act. All governmental departments were exempt from prosecution, and there was no one to force HMRC to comply. The commissioner could only investigate or audit a department with HMRC's consent.

The fallout from this breach has been major: the Information Commissioner's powers have been expanded, his office can now audit departments at will, and they have enforcement powers. Due to the loss of public confidence in the HMRC, other projects have been put on hold, most notably the national ID card program. There was also the cost of the search for the disk, and affected citizens needed to close existing bank accounts.

Security breaches do not always come from targeted attacks. Untargeted, general attacks can also cause a security breach in an organization. Let's look at the CSX Corporation virus incident in August of 2003.

The SoBig computer virus infected CSX Corporation's computer network at its headquarters in Jacksonville, Florida. These infected systems flooded the internal network with infection attempts and spammed the equivalent of an internal DDoS attack. No critical systems got infected, but the network congestion disrupted signaling dispatching and other mission critical systems.

Freight trains were delayed and at least 10 Amtrak long-distance trains were canceled or delayed up to six hours, and commuter trains in Washington DC were canceled. Half-hour delays continued for the next few days. The initial damage ran into the millions in late delivery penalties, and customer refunds, and millions more were spent in updating and expanding the antivirus and network systems to mitigate any further issues.