What Businesses Need to Know in the Wake of the Equifax Breach

What Businesses Need to Know in the Wake of the Equifax Breach

By Jason Tan, CEO of Sift Science

Online businesses everywhere are going to be dealing with the effects of the recent Equifax breach. It’s a tough truth to swallow, but these large-scale data breaches have become a fact of life – and it’s not just the breached business that pays the price. As fraudsters mine the valuable data that’s been compromised, all e-commerce sites and financial institutions need to be on alert.

Keep an eye out for signs of account takeover.

Last year, 48% of online businesses saw an increase in account takeover (ATO), according to the Sift Science Fraud-Fighting Trends report. And the Equifax breach is likely to exacerbate this trend, potentially flooding the dark web with names, addresses, Social Security numbers, and other personal information that fraudsters can leverage to gain access to a legitimate user’s account. They then make purchases with a stored payment method or drain value from the user’s account.

Some of the signals that could point to an ATO:

• Login attempts from different devices and locations
• Switching to older browsers and operating systems
• Buying more than usual, or higher priced items
• Changing settings, shipping address, or passwords
• Multiple failed login attempts
• Suspicious device configurations, like proxy or VPN setups

Keep in mind that taken individually, each of these signs may be normal behavior for a particular user. It’s only when you apply behavioral analysis on a large scale, looking at all of a user’s activity and all activity of users across the network, that you can accurately detect ATO.

Monitor for fake accounts and synthetic identity fraud.

Fraudsters can also take all of the different pieces of personal data leaked in the Equifax breach to steal someone’s identity and create new accounts. They may also pick and choose pieces from various people’s accounts – like a birthday, Social Security number, and name – and mix them together to create an entirely new ID.

To keep tabs on fake accounts, you can monitor new signups to look for risky patterns, like a sudden spike in new accounts that can’t be attributed to a specific promotion or seasonal trend. If the average time it takes a new user to sign up suddenly gets much faster, that may point to fraudsters using a script to quickly create accounts. And seeing multiple new accounts coming from the same IP address or device is a red flag for a single person creating many accounts.

Stay focused on maintaining user trust.

Even if a breach doesn’t happen on your site, any downstream fraud attacks still happen on your watch. If you don’t invest in protecting your users from the devastating effects of ATO, identity theft, and fraud, you will soon lose their trust. Trust is earned in drops, but lost in buckets.

At the same time, e-commerce businesses and financial institutions should make sure they aren’t overly cautious to the point where they’re rejecting good customers and denying legitimate accounts. Preventing fraud is a delicate balancing act, and the right technology – which looks at a range of data points to make an accurate prediction about what is and isn’t fraudulent – can help you strike the right balance.

About the Author:

Jason Tan is the CEO of Sift Science, a trust platform that offers a full suite of fraud and abuse prevention products designed to attack every vector of online fraud for industries and businesses across the world.

Data Theft Rising Sharply, Insider Threats Cited as Leading Cause

New Study: Data Theft Rising Sharply, Insider Threats Cited as Leading Cause

New Ponemon Institute Report Finds Most Employees Have Too Much Access, Multiplying Damage When Accounts Are Compromised

London, UK, August 9, 2016 – Three out of every four organizations have been hit by the loss or theft of important data over the past two years, a sharp increase since 2014, according to a new survey of more than 3,000 employees and IT practitioners across the U.S. and Europe. The report, released today, was conducted by the Ponemon Institute and sponsored by Varonis Systems, Inc.

The rise in data loss and theft, according to the survey, is due in large part to compromises in insider accounts that are exacerbated by far wider employee and third-party access to sensitive information than is necessary, and by the continued failure to monitor access and activity around email and file systems – where most confidential and sensitive data moves and lives. 

The survey report, “Closing Security Gaps to Protect Corporate Data: A Study of U.S. and European Organisations,” resulted from interviews conducted in April and May, 2016, with 3,027 employees in the United States, United Kingdom, France, and Germany.  Respondents included 1,371 end users and 1,656 IT and IT security professionals, in organizations ranging in size from dozens to tens of thousands of employees from a variety of industries including financial services, public sector, health care and life sciences, retail, industrial, and technology and software.
Among the key findings:

• Seventy-six percent of IT practitioners say their organization experienced the loss or theft of company data over the past two years. This is a significant increase from 67 percent of IT respondents who gave the same response in the 2014 study conducted by Ponemon for Varonis.
• IT respondents say insider negligence is more than twice as likely to cause the compromise of insider accounts as any other culprits, including external attackers, malicious employees or contractors.
• Seventy-eight percent of IT people are very concerned about ransomware, a type of malicious software that that blocks access to files until a sum of money is paid. Fifteen percent of organizations have experienced ransomware and barely half of those detected the attack in the first 24 hours.
• Eighty-eight percent of end users say their jobs require them to access and use proprietary information such as customer data, contact lists, employee records, financial reports, confidential business documents, or other sensitive information assets. This is sharply higher than the 76 percent recorded in the 2014 study.
• Sixty-two percent of end users say they have access to company data they probably shouldn’t see.
• Only 29 percent of IT respondents report that their organizations enforce a strict least-privilege model to ensure insiders have access to company data on a need-to-know basis.
• Only 25 percent of organizations monitor all employee and third-party email and file activity, while 38 percent do not monitor any file and email activity.
• Thirty-five percent of organizations have no searchable records of file system activity, leaving them unable to determine, among other things, which files have been encrypted by ransomware.

Dr. Larry Ponemon, Chairman and Founder of Ponemon Institute, a leading research center dedicated to privacy, data protection and information security policy, observed, "Despite all the technology available and the spike in highly publicised attacks, data breaches continue to rise. The most valuable data featured in most breaches is unstructured data such as emails and documents. When emails and files are surfaced, they tend to cause scandal, forcing the breach to have a lasting effect on the company’s reputation. This survey raises key points as to why hackers are able to maximise impact – too many employees have too much access, beyond what they need to do their jobs. On top of this, when employees access valuable data and their activity is not tracked or audited, it becomes far too easy for an external hacker or a rogue insider to get away unnoticed.”

Yaki Faitelson, Co-Founder and CEO of Varonis, said, “Right now we’re in a technology arms race with hackers and insider threats. Unnecessarily excessive internal access combined with a lack of monitoring and auditing sets organizations up for disaster. Sony Pictures, the Panama Papers and the recent Democratic National Committee intrusions all concerned the theft of files and emails that were not protected well enough from insider threats or outside attackers that compromised insider credentials, causing major damage to those organizations and their reputations. These new findings, alongside the fallout from those breaches, should keep executives awake at night. What will be the straw that makes businesses focus their efforts on protecting their precious information assets? Varonis is helping thousands of organizations around the world address these challenges, prepare for and stop ransomware and other malicious threats that get inside and impersonate insiders.”

Survey: Retail IT Professionals Confidence in Cyber Security Capabilities Increase as Data Breaches Rise

One-third of retail IT professionals say a data breach has occurred at their company

PORTLAND, Ore. - April 26, 2016 - Tripwire today announced the results of its 2016 retail cyber security survey. Conducted by Dimensional Research, the survey evaluated the attitudes of over 200 IT professionals in the retail sector and compared their responses to a similar survey Tripwire conducted in 2014.

According to a report by Arbor Networks, it takes retailers an average of 197 days to detect advanced threats on their networks. However, Tripwire’s 2016 survey found that ninety percent of the respondents believe they could detect a data breach on critical systems in one week or less. In 2014, seventy percent of respondents believed they could detect a breach in one week or less.

"Unfortunately, these results indicate that we can expect retail breach activity to continue in the future," said Tim Erlin, director of IT security and risk strategy. "The increase in confidence connected with speed of breach detection is particularly surprising, especially in combination with partial implementation of detection tools. Together these results indicate while retail organizations might feel better about their cyber security capabilities, there's still a long way to go to close the gap between initial compromise and detection."

Additional findings from the study include:

• Seventy-five percent of the 2016 respondents believed they could detect a breach within 48 hours, compared with forty-two percent in 2014. 
• Retail data breaches involving personally identifiable information (PII) have more than doubled since 2014. When asked if a data breach occurred at their organization where PII was stolen or accessed by intruders, one-third (thirty-three percent) of the respondents said, "yes," compared with fourteen percent in 2014. 
• Implementation of breach detection technology has remained flat. In both 2014 and 2016, fifty-nine percent of the respondents said their breach detection products were only partially or marginally implemented. Both surveys defined breach detection as anti-virus software, intrusion detection systems, malware detection, white listing and file integrity monitoring.
• •Companies with larger revenues monitor configuration parameters on critical payment assets less frequently. Sixty-five percent of respondents working for organizations with revenues of less than $100 million check their compliance at least weekly, and only fifty-five percent of respondents with revenues of more than $100 million answered similarly.

Trend Micro recently reported that malware that affects point-of-sale (POS) systems grew sixty percent in the third quarter of 2015 alone. According to Verizon's 2015 Data Breach Investigations Report, attacks on POS systems continue to be the top source of confirmed data breaches.

Erlin continued, "Partially implemented tools are a serious liability for information security. Organizations need to move from a checkbox approach to measuring gaps in their security coverage. If you're not monitoring one hundred percent of your endpoints, you're leaving room for attackers to gain a foothold."

Why Most Companies Are Easy Prey for Cyber Attackers

Alarming Data Reveals Why Most Companies Are Easy Prey for Cyber Attackers

LONDON, UK, March 22, 2016 – Varonis Systems, Inc. today revealed the results of a year of anonymous data collected during risk assessments conducted for potential customers on a limited subset of their file systems. The 2015 results show a staggering level of exposure in corporate file systems, including an average of 9.9 million files per assessment that were accessible by every employee in the company.

Of the insights gleaned from dozens of customer risk assessments conducted in mid-to-large enterprises prior to remediation, in a subset of each company’s file systems, Varonis found the average company had:
35.3 million files, stored in 4 million folders, meaning the average folder has 8.8 files

• 1.1 million folders, or an average of 28% of all folders, with “everyone” group permission enabled –open to all network users
• 9.9 million files that were accessible by every employee in the company regardless of their roles
• 2.8 million folders, or 70% of all folders, contained stale data – untouched for the past six months
• 25,000 user accounts, with 7,700 of them or 31% “stale” – having not logged in for the past 60 days, suggesting former employees, employees who changed roles, or consultants and contractors whose engagements have ended

The ‘everyone’ group is a common convenience for permissions when originally set up. That mass access also makes it astonishingly easy for hackers to steal company data.

Some individual companies’ lowlights that were gleaned from the Varonis risk assessments:
In one company, every employee had access to 82% of the 6.1 million total folders.

• Another company had more than 2 million files containing sensitive data (credit card, social security or account numbers) that everyone in the company could access.
• 50% of another company’s folders had “everyone” group permission and more than 14,000 files in those folders were found to contain sensitive data.
• A single company had more than 146,000 stale users – accounts whose users had not logged in for the past 60 days.  That’s nearly three times more users than the average FORTUNE 500 company has total employees.

David Gibson, Vice President of Strategy and Market Development at Varonis, said, “Although this data presents a bleak look at the average enterprise’s corporate file system environment, the organizations running these risk assessments are taking these challenges seriously. Most of them have since implemented Varonis, embracing a more holistic view of the data on their file and email systems and closing these gaping, often unseen security holes before the next major breach causes heavy damage. Our software is able to provide a granular look at where sensitive data lives, where it is over-exposed within an organization, who is accessing that data, and how to lock it down. While that remediation process is running, our ability to start detecting and stopping many types of insider threats has been a major revelation for our customers.”