Two weeks ago I had the privilege of speaking at a HB Litigation sponsored event, dubbed the NetDiligence Cyber Risk & Privacy Liability Forum. The event took place Oct 11 and 12th and was held at the Ritz Carlton in Marina Del Ray. It was a fascinating symposium that covered topics ranging from privacy audits, encryption standards, costs associated with data breaches, and how to create a playbook for when your IT infrastructure has been attacked and/or compromised. There was a wealth of experience that resulted in some incisive insight on dealing with cyber attacks from either a technical, legal or policy point of view.
There were a couple of talking points that resonated with me, particularly one about the inevitability of data theft. It was a continually repeated point amongst the various panelists, and I have to admit I found it surprising. I had always assumed that data theft could be circumvented with proper policy, procedures and, of course, a shored up database. However, the panelists all indicated that it was just a matter of time before a company’s database was to be breached, as the technology landscape is constantly evolving. The more technically inclined panelist offered anecdotal examples involving Havij, a freely available hacking tool used by whitehats and blackhats alike to penetrate databases, and how often it was used to get access to some large banking institutions. While I found this situation to be eye opening, it further illustrated the need for web administrators to be prepared and have a gameplan on how to deal with the inevitable attacks against their sites.
I had the opportunity to speak about with New Data Protection Technologies, alongside the following panelists:
Vinny Sakore, ICSA Labs (Moderator)
Jason Glasgow, Travelers Bond & Financial Products
Winston Krone, Esq., Kivu Consulting
Grayson Lenik, Trustwave
I was able to detail the differences between data breach/hacking versus a DoS attack, as well as what types of damage and costs are associated with a DoS attack (eg. Lost revenue, compromised SEO, brand diminishment). I learned a great deal from my fellow panelists, specifically about targeting from hackers. Again I was surprised to hear that many data breaches were not because the company was being targeted, but rather hackers were just scouring around in cyber space, rattling the figurative doorknobs to see which ones they could open. Once they identified a database that they could breach, these hackers would typically go to some underground marketplace to sell the information. This strategy was in contrast to what we see with DOS attacks, where an attacker is much more focused and calculated in directly targeting the victims.
We finished the panel on a discussion point about operation centers, and how despite one’s best efforts to implement technologies to mitigate and alarm for a data breach and/or attack, a lone person that fails to take notice or interpret the information correctly could undo it all. I wasn’t surprised to hear some of the horror stories as I have seen my fair share over the years, and reminded why we went to great length to ensure we had no such weaknesses in our own operational flow.
It was a fantastic event, and I would like to thank the organizers and attendees, and look forward to attending future conferences with Netdiligence. Below is a picture of my panel. From left to right: Vinny Sakore, Winston Krone, Jason Glasgow, Grayson Lenik, and myself.
Jag Bains,
CTO, DOSarrest Internet Security
