By James B. VanBokkelen
Dec. 18, 2006
The year 2006 may go down in computer security history as the year of
the breach. As of Dec. 1, more than 36 million people in the United
States might have had their personal information compromised this year
by hackers, laptop computer theft or information security blunders. More
than 97 million records are potentially at risk of identity theft
because of nearly 300 separate breaches, and the year isnt over.
Those security breaches happened nationwide, and their victims cut
across age, race, socioeconomic and geographic lines. However, people
affiliated with universities, government agencies and the military are
most likely to have their personal information compromised. The
inadvertent disclosure of the records of 26.5 million veterans and their
families, including more than 2 million active-duty members, was the
largest data breach of its kind in history. Large institutions face
greater risks. They have larger volumes of data storage to plunder and
potentially a greater number of disgruntled insiders, or former
insiders, with malicious reasons for trying to gain access to the data.
Of the 30 largest data breaches so far this year, at least 10 were the
result of unauthorized access a network. In a majority of those cases,
investigators could not determine the date the breach occurred or were
unwilling to report it publicly.
In many cases, the organizations didnt know whether the breach involved
outsiders or insiders or whether the culprit ignored, merely viewed or
stole the personal information. Information technology departments often
do not have the proper technology to ascertain the basic facts about a
breach, such as when it occurred, its source or the reasons for the
IT departments can remediate those data gaps with increased security
budgets, better-trained and more qualified employees, and software that
captures and examines the needle of evidence in a haystack of data.
Network forensics and analysis tools gather and analyze data about a
security incident. Such tools have allowed organizations to find
malicious hackers; determine whether sensitive data was ignored, viewed
or compromised; and prevent future attacks.
A network forensics and analysis tool wont help find a missing laptop.
It wont strengthen the defenses of a weak or improperly configured
network or magically clear up intransigence and miscommunication
regarding security policy. But good forensics software, properly
configured, will allow IT administrators to see precisely what is
passing through an organizations networks. Aided by network forensics
tools, network administrators have identified suspicious or anomalous
traffic patterns to and from specific sites at certain times of the day
For institutions affected by data breaches in 2006, network analysis
tools could have assisted in identifying perpetrators, determining
whether data had been stolen, and saving time and money for security
upgrades not to mention saving organizational face.
VanBokkelen is president of Sandstorm Enterprises, a network security
Subscribe to InfoSec News