Pratum Blog

The Catholic Diocese of Des Moines was involved in a computer security breach last month in which thieves were able to steal more than $600,000 from their automated clearing house (ACH) account at Bankers Trust.  To the credit of Bankers Trust, they were able to detect the fraudulent activity and notify the Diocese within a matter of days.  Unfortunately the funds were already gone by then.

According to the Diocese press release and other media reports, the FBI has seized several computers from the Diocese but no employees of the Diocese or Bankers Trust are suspected to be involved.  This either means one of two things.  Either law enforcement is trying to divert attention away from the true angles they are working or the systems themselves were to blame.

If the computers are part of the problem we can assume they were either not patched and vulnerable to attacks or end users allowed some sort of malware to be installed and siphon data.  Either way, this points to a break down in very rudimentary security practices.

This should be a warning to all organizations.  Patch your systems, scan them for malware and please, please, please...educate your users.  There is no patch for the human factor.

In my last blog post, I discussed the increase in reported breaches caused by insiders.  What I didn't tell you was that the loss from those breaches was primarily (49%) embezzlement and related fraud.  Only 3% of the records breached were from inside attacks.

This is important to note.  The controls you need in place to prevent embezzlement, skimming and other types of fraud may be different than those you need to protect static database records or file type data.  Understanding where your attacks are coming from and the target of those attacks can be very useful in selecting and placing controls.

On the flip side, 98% of the records compromised (customer, patient, etc.) were from external sources.  Of this, 85% of the records were attributed to organized crime.  WOW!  I knew the number was high but that was surprising to me. 

Makes me second guess my career choice.  Here I am tracking organized crime for a living and I don't even get to carry a gun.  All kidding aside though.  This too should be a wake up call.  Knowing where our attacks are coming from is important.  Organized crime has the resources, capital and manpower to do significant damage when they want to.  The days of implementing simple security controls which are not interconnected and sharing information will come to an end.  As the attacks get more complex so must our defenses.

Don't read too much into all of this though.  As pointed out in the report, 96% of all breaches were unsophisticated.  Start small and work you way into a robust risk management and security program.  Like the old addage only have to be faster than the slowest gazelle.  That's if there's only one lion.

At the last ISSA meeting in Des Moines, we reviewed the 2010 Data Breach Investigations Report published by the Verison RISK Team in cooperation with the US Secret Service (USSS).  This was the first year the USSS provided data for the report.  The additional information expands the scope of the report and only helps to add credibility.  Not that the report wasn't credible in the past, but Verizon's client base is going to favor those larger clients who can pay for their services.  The USSS data helps to broaden the scope.

Two things caught my eye this year.  The first was the 26% increase in breaches caused by insiders.  The addition of USSS data helps reveal what we've known for a long time.  Inside threats are very real and we must be prepared to prevent or detect them. 
The second interesting fact was that 96% of all breaches were avoidable through simple or intermediate contols.  This means it's not difficult or expensive to stop this epidemic.  Why does it continue?

I believe the biggest reason is risk management.  IT leaders are not proving their case well enough. When asking for budgets to mitigate risk we're not providing the detail or clearly communicating the risk.  I'll bet if you asked every executive involved in that 96% of breaches if they would rather have paid for the controls up front you'd get a 100% affirmation rate.

This week make a concerted effort to ensure you are clearly communicating risk to the organization.  Don't pull a "chicken little" routine but spend the time to have facts and numbers which show the entire picture to your management.  You might be surprised how quickly they respond.

I'll add some additional thoughts on the report next week.  If you are local to central Iowa and are interested in joining us at the next ISSA meeting, plesae check out our website at

Get our blog posts delivered to your inbox:

The information we track while users are on our websites helps us analyze site traffic, optimize site performance, improve our services, and identify new products and services of interest to our users. To learn more please see our Privacy Policy.