Data Breach at Security Firm Linked to Attack on Lockheed

We are saddened to report another very serious data breach problem. This one is so vast, encompassing both national security mission-critical targets and potentially posing a risk to Fortune 500 companies and therefore a danger to the entire economy of the United States.

The New York Times reported, "Lockheed Martin, the nation’s largest military contractor, has battled disruptions in its computer networks this week that might be tied to a hacking attack on a vendor that supplies coded security tokens to millions of users, security officials said on Friday.

The SecurID electronic tokens, which are used to gain access to computer networks by corporate employees and government officials from outside their offices, are supplied by the RSA Security division of the EMC Corporation."

This is also a great example of what we have been arguing for years. Data breaches DO NOT RESULT IN IMMEDIATE ATTACKS but often have a significant delay period before the confidential information that was stolen is put to use in criminal or military/security attacks. The data from EMC was stolen in a March breach. It took almost three months before evidence began to surface that the stolen "tokens" were being illegally used.

By the way these tokens provide security " ... beyond a user name or password by requiring users to append a unique number generated by the token each time they connect to their corporate or government networks." So, if you steal the token the YOU TOO can get the magic "new number" when you start hacking these sensitive web sites!

“The issue is whether all of the security controls are compromised,” said James A. Lewis, a senior fellow and a specialist in computer security issues at the Center for Strategic and International Studies, a policy group in Washington. “That’s the assumption people are making.”

So now even the highest level security access, the one used by military contractors and other "high end" users, has shown us how inherently weak all of our network security systems really are. We need a whole new architecture, a new concept, for Internet security and the industry seems incapable of inventing that because until recently security cut into profits and no one was demanding higher vigilance.

Children's Identity Theft - A Serious and Growing Problem

We have blogged about the risks to children's identity before and it is in both our books. We also hammer away at this terrible risk in all of our lectures and seminars all over the United States and Canada. BUT, it can never hurt to hammer away again! Below is a very useful and interesting (as well as scary) report from MSNBC which was sent to me by a former student who is specializing in kid's ID theft but who prefers to remain unnamed here.

Stop ID thieves from stealing your kid's credit
Crooks are targeting children's pristine credit records. What parents can do about it

By Bob Sullivan Technology correspondent
msnbc.com msnbc.com
updated 5/12/2011

http://today.msnbc.msn.com/id/42997608/ns/today-parenting/t/stop-id-thieves-stealing-your-kids-credit/

"Parents struggling to keep track of their kids' vaccinations, homework, dance classes and veggie intake have precious little time for other worries, but a serious new threat is demanding their attention: Identity thieves are increasingly targeting children, in some cases stealing their identities even before they are born.

As an investigation by NBC’s Jeff Rossen and TODAY revealed Thursday, criminals routinely use a child’s pristine credit record to their advantage and get away with it for years or decades — even if law enforcement knows exactly where the imposters live. TODAY showed this in dramatic fashion, hunting down two alleged child imposters and capturing their comments on camera.

Rossen’s story on TODAY also features a 9-year-old girl who is in default on utility bills, a teenager with $750,000 in debt, and a 2-year-old with a pile of credit card bills.

So parents should obtain their child's credit report as soon as they are born, correct? Not really

"http://AnnualCreditReport.com. Requests for information on a juvenile from the site will be immediately rejected. There are legal reasons for this, according to Susan Henson of Experian, one of three major credit reporting bureaus — the Children's Online Protection Act restricts the collection of information about kids under 13 years old. Also, information about a third party can only be disclosed after the requester provides proof of legal guardianship, and that can't be provided through the website. So all three bureaus require direct contact to get kids' credit reports."

Our entire national legal system regarding parents checking their child's credit record is weak and broken. Of course, we all understand "privacy" rights of infants and minors but we assume the parents are the crooks (unfortunately sometimes they are) when in fact it is a horde of criminal strangers who are assaulting the system.

as our ridiculously insecure Social Security-based "national identity card." Yes, I call it a National Identity Card because, although there is a pretense that the United States does not have and does not want an national Id card as some countries have, we in fact do. Try and conduct any business, change anything on your credit card, buy a house or car, enroll in a school or university, apply for a job, buy insurance, open a 401K, open a bank account, buy a firearm, and you will be asked for your National Identity Number - the Social Security number! Unfortunately we don't have a secure and fraud proof ID card to go with that number. So, anyone who gets hold of your name, place of birth, date of birth, and SS number can now be YOU!

We need serious and immediate reform because identity theft could undermine the economic and national security of this country and I am not blowing hot air here. How will we conduct business or provide health care if we cannot be sure of the identity of people we are dealing with? And, what if a terrorist organization gets hold of several thousand American born children's identities and the uses them to build a cadre of terrorists who now have American-sounding names and American birth places? We need action but unfortunately Congress is too busy fighting amongst themselves over trivial ideological issues to address this issue.

The Identity Theft Resource Center is a very useful resource and they have a sample letter to request a child's credit report. http://www.idtheftcenter.org/artman2/publish/v_templates/Letter_Form_120.shtml

Our ID theft prevention education seminar.

A new on line ID theft awareness certification class, offered by me through the Iowa State University College of Engineering on line learning system, covers the many risks. If you have employees who handle sensitive customer data it might be a good idea to have them take this inexpensive and engaging Internet seminar. At the end of the course upon successfully completing the user-friendly quiz they are issued a certificate of completion. You may find out more about the seminar here

http://www.eol.iastate.edu/Professional-Development/Courses/idtheft.html

WARNING! ONLY this address will take you to the legitimate Engineering web site! We have published the full URL instead of hot linking a word so you can see the address.

Steffen Schmidt, PhD. Professor of Public Policy and Information Security