This week’s speculation (and at this point it truly is only speculation) that Home Depot might be the target of a massive data breach is rocking the retail-confidence boat a bit.
When I heard the news, I chewed on the topic of whether data breaches influence consumer buying habits. Studies claim to say yes. And I think common sense backs that up. It all falls under the banner of brand integrity, and big black eyes like data hacks lead to bad publicity and brand injury. It can be crippling for SMBs that already toe the line of profitability.
Retail and hospitality firms are the popular targets due to their sheer amount of Electronic Data Interchange (EDI). But banks are right there too, as are insurance companies, healthcare providers and payers – the list goes on.
Any company should ask itself a simple question: What is the cost of brand injury versus the cost of server hardening and best-practice security compliance? If a company does $30 million yearly in sales, brand injury through a major data breach might easily impact sales by 2% or more in the first year. On the other hand, TxMQ can a company get started with scoping, scanning and even systems auditing for a fraction of that cost.
For a confidential and free consultation, contact company president Miles Roty: 716-636-0070 x228, miles@txmq.com.
Tag: Security
Potential Security Issues fixed In IBM WAS 8.0.0.8
Beware potential forgery.
WebSphere Application Server (WAS) could be vulnerable to a cross-site request forgery, caused by improper validation of portlets in the administrative console. By persuading a user to visit a malicious web site, a remote attacker could exploit this vulnerability to obtain sensitive information.
CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/81014 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server (IBM WAS) Versions are affected:
Version 8.5
Version 8.0
Version 7
Version 6.1
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM72275, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.25:
Apply Fix Pack 27 (7.0.0.27), or later.
For V6.1.0 through 6.1.0.45:
Apply Fix Pack 47 (6.1.0.47), or later.
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-4053 (PM90949 and PM91521)
DESCRIPTION: WebSphere Application Server using WS-Security and configured for XML Digital Signature using trust store, could allow a network attacker to gain elevated privileges on the system, caused by improper checking of the certificate.
CVSS:
CVSS Base Score: 6.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/86505 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:P/I:P/A:P)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
Version 6.1
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF for WebSphere Application Server as noted below:
For IBM WebSphere Application Server (PM90949)
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
For V6.1.0 through 6.1.0.45:
Apply Fix Pack 47 (6.1.0.47), or later.
OR
APAR Interim Fix:
Find your applicable Version for APAR Interim Fix PM90949
Ensure you are at the minimally required Fix Pack Level before installing the APAR Interim Fix, then
Apply the APAR Interim Fix
For IBM WebSphere Application Server Feature Pack for Web Services (PM91521)
For V6.1.0 through 6.1.0.45:
Apply Fix Pack 47 (6.1.0.47), or later.
OR
APAR Interim Fix:
Find your applicable Version for APAR Interim Fix PM91521
Ensure you are at the minimally required Fix Pack Level before installing the APAR Interim Fix, then
Apply the APAR Interim Fix
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-4052 (PM91892)
DESCRIPTION: WebSphere Application Server could allow a cross-site scripting attack, caused by improper validation of input in the UDDI Administrative console. A network attacker could exploit this vulnerability using a specially-crafted URL to inject script into a victim’s Web browser within the security context of the hosting Web site.
CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/86504 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
Version 6.1
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM91892, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
For V6.1.0 through 6.1.0.45:
Apply Fix Pack 47 (6.1.0.47), or later.
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-5414 (PM92313)
DESCRIPTION: WebSphere Application Server could allow existing users to gain elevated privileges on the system caused by incorrect Administration Security roles being assigned after migration from version 6.1 or later.
NOTE: If a migration from WebSphere Application Server Version 6.1 or later has already been performed, all users designated with “adminsecmanager” (Administrative Security Manager) role need to be evaluated to determine if they should have both “admin” role and “adminsecmanager” role. Some users may not need both designations and the privileges should be removed accordingly.
CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87476 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM92313, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
Workaround(s): If a migration from WebSphere Application Server Version 6.1 or later has already been performed, all users designated with “adminsecmanager” role need to be evaluated to determine if they should have both “admin” role and “adminsecmanager” (Administrative Security Manager) role. Some users may not need both designations and the privileges should be removed accordingly.
Mitigation(s): none
CVE ID: CVE-2013-5417 (PM93323 and PM93944)
DESCRIPTION: WebSphere Application Server could be vulnerable to cross-site scripting, caused by improper validation of application HTTP response data.
CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87479 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing APAR PM93323 for IBM WebSphere Application Server Full Profile or APAR PM93944 for IBM WebSphere Application Server Liberty Profile, as noted below:
For IBM WebSphere Application Server Full Profile
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
For IBM WebSphere Application Server Liberty Profile
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-5418 (PM96477)
DESCRIPTION: WebSphere Application Server could allow a cross-site scripting attack, caused by improper validation of input in the Administrative console. A remote attacker could exploit this vulnerability using a specially-crafted URL to inject script into a victim’s Web browser within the security context of the hosting Web site.
CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/87480 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM96477, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.0:
Apply Fix Pack 1 (8.5.5.1), or later.
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-6725 (PM98132)
DESCRIPTION: IBM WebSphere Application Server may be vulnerable to cross-site scripting, caused by improper validation of input in the Administrative Console. A remote attacker with Administrative authority could exploit this vulnerability using a specially-crafted URL to inject script into a victim’s Web browser within the security context of the hosting Web site.
CVSS:
CVSS Base Score: 3.5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/89280 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:S/C:N/I:P/A:N)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM98132, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.1:
Apply Fix Pack 2 (8.5.5.2), or later (targeted to be available 28 April 2014).
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
Workaround(s): None
Mitigation(s): none
CVE ID: CVE-2013-6325 (PM99450)
DESCRIPTION: IBM WebSphere Application Server could be vulnerable to a denial of service, caused by improper handling of requests by a web services endpoint. By passing a specially-crafted request, a remote attacker could exploit this vulnerability to consume available resources.
CVSS:
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/88906 for the current score
CVSS Environmental Score*: Undefined
CVSS String: (AV:N/AC:M/Au:N/C:N/I:N/A:P)
AFFECTED VERSIONS: The following IBM WebSphere Application Server Versions are affected:
Version 8.5
Version 8
Version 7
REMEDIATION: The recommended solution is to apply the Fix Pack or PTF for each named product as soon as practical
Fix:
Apply a Fix Pack or PTF containing this APAR PM99450, as noted below:
For IBM WebSphere Application Server
For V8.5 through 8.5.5.1:
Apply Fix Pack 1 (8.5.5.2), or later (targeted to be available 28 April 2014).
For V8.0 through 8.0.0.7:
Apply Fix Pack 8 (8.0.0.8), or later.
For V7.0 through 7.0.0.29:
Apply Fix Pack 31 (7.0.0.31), or later.
Workaround(s): None
Mitigation(s): none
IBM SDK: Please refer to this security bulletin for SDK fixes that were shipped with WebSphere Application Server Version 7.0.0.31
http://www.ibm.com/support/docview.wss?&uid=swg21655990
Important note:
IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.
Reference: http://www-01.ibm.com/support/docview.wss?uid=swg21661325&acss=danl_334_email
(Photo courtesy of Flickr contributor brykmantra.)
WNY CIO Summit: Register Today!
WNY CIO Summit – Enterprise Data Breach
When: Wednesday, February 12, 2014, 8:00 a.m.
Where: University at Buffalo – Center For Tomorrow
Register Now
How much could an enterprise data breach cost you? Are you prepared to handle the repercussions, potential lawsuits and class action suits that may be included in the fall out?
Join TxMQ selected WNY area CIO’s for a candid conversation about how how you can protect your business from an Enterprise Data Breach.
Have questions about CIO Summit: Enterprise Data Breach? Contact Tom Grimm – TxMQ, Inc
What's Worse Than Being Robbed?
What would you say is worse than being hacked? My answer is “not knowing” who hacked you. Without having any idea of From where, By whom or Why, some companies have trouble even determining what was stolen when today’s pirates only copy the information and leave it in place. I have coined these types of attacks as “in-place attacks!” These are hacks where the target does not even know anything is missing so no security measures are taken after the fact.
For example, someone takes your wallet out of your jacket at a party. They copy your credit card and address from your driver’s license. They then return everything back to your coat pocket without you knowing that it was ever missing. Your account could be wiped out without you even knowing you were robbed.
In the case of Target being hacked, authorities are now still trying to figure out who hacked the large retailer. A 17 year old? The Russian mob? They have figured out the how. They know the why. They almost know the location from which it was done. But there are still many questions that remain. Was that the only intrusion? Are there other access points? Are they safe now? The fact that the Target stock price has yet to regain its strength demonstrates that consumers are wondering the same thing.
As embarrassing as this incident is for Target, it gives businesses today a “heads up.” How secure is your online commerce site? Do you truly have a grasp on your vulnerabilities? When was the last time you had a 3rd party assessment done, end to end? Have you securely closed all of your “windows and doors” in your infrastructure? How long would it take you to know that you were a victim of an in-place attack?
At TxMQ we have specific skills on governance, security and eCommerce that will allow you to build a new system or “harden” an existing one. We also offer assessment services where we can help you identify current gaps.
What do you think?
TxMQ: Learn more!
Breach Etiquette: Target's Responsibility
Just as retailers were in the throes of the holiday madhouse, Target – the second largest retailer in the US – was breached. Forbes recently posted an article outlining seven lessons that could be learned from the way Target handled the situation.
The link to the Forbes article is here – Target’s Worst PR Nightmare: 7 Lessons From Target’s Well-Meant But Flawed Crisis Response – but what do you think?
What I always find surprising in these cases in which consumer portal sites are breached/hacked is that there’s always so much talk about how to handle the consequences. But what about an explanation of what will be done to prevent this from happening again? The same issue happened last year with the PlayStation Network, when millions of credit-card numbers and customer information was exposed. Another scenario was the ObamaCare website: The site went down because it wasn’t properly architected and stress tested. We heard a lot about “why” but not a lot about the “what” is being done to prevent it from happening all over again.
Obviously, when you open your business to the world, you’re now exposed to a world of attacks. You can only do your best to prevent a hacker’s attack. However, your best must include an ongoing and robust test plan, executed by an experienced team that keeps up with the latest technologies, methods of attacks, and the ever-changing demographics of user communities and methods of access.
TxMQ has expert infrastructure architects, portal architects and load-testing expertise to help companies address these issues through cost-effective, consulting engagements.
Find out more. Email our consulting leaders in confidence, consulting@txmq.com, for more information.
Cyber Security: 10 Tips For Small- To Mid-Size Businesses
I’ll start with a personal story about cyber security. Quite a few years ago (I won’t bore you with all the detail), my personal trainer’s email was hacked by a slightly saavy and jealous, ex-client’s boyfriend and personal emails between me and my trainer were distributed in a malicious manner to everyone in my trainer’s email network.
Needless to say, the backlash of this saga was incredible. My trainer escaped relatively unscathed, but the beating I took on it served as a lesson to me for the rest of my life. Don’t put anything into words via email or text that you wouldn’t say directly to someone’s face. Words on paper cannot be forgotten and it’s apparently incredibly easy to hack into someone’s “safe” network, download documents and use them as a weapon against said person or company.
When we went to the police with the breach, they scratched their heads, looked at us dumbfounded and essentially told us there was nothing we could do. It wouldn’t have mattered if there was. Reputations were already smashed, relationships and friendships were ruined and that sense of security and invincibility became an abstract thing of the past.
So this may sound like an exaggerated personal problem, but it happened and it was a traumatic event. Now imagine it’s your company and all your secure files. It’s your employees’ social security numbers, your business-banking routing numbers, your personnel files.
TxMQ attended an this morning titled “The Virtual Reality of White Collar Crime” where the discussion was about cyber attacks. The numbers are staggering.
There are an estimated 1 million cyber attacks per day. That breaks down to 50,000 attacks per hour, 840 attacks per minute and about 15 attacks per second. And they’re coming from all areas of the world.
Trends of late have seen organized cyber crime move from aiming at large, hard targets such as banks and financial institutions to softer small- and mid-size businesses.
Why?
Because it’s easier to hack into the SMB space. There are hackers who only focus the hard targets. They beat their heads against the wall until they chip away a brick, they move that brick and get one name and contact info. Then they start all over again, beating their heads against the wall to remove just one more brick, then one more, then one more. A painstaking process…
Now think about the SMB environment, where it’s much easier to export data and multiple files. Chip one brick away and all of a sudden you have the names and personal info of a thousand people. These professional services providers hold deeds and financial records, personal information and trusts.
Fact: 60% of small- and mid-sized businesses that suffer from a cyber attack go out of business within 6 months due to the cost of recovering from the attack. The average cost to recover from a cyber attack is $5.5M. Be proactive.
Fact: Cyber breach represents the largest transfer of wealth in US history. Businesses lose $250 billion a year to cyber breach and lose another $140 billion in downtime from the attack. That’s almost $400 billion per year. Process that for a moment.
And the truth of the matter is, it’s not even a matter of if it happens, it’s when. Within the past year, my personal credit card number has been stolen and used overseas three separate times.
Here are 10 recommendations for how small- and mid-sized businesses can protect themselves against a potential attack:
- Employee Background Checks
- Signed Security and/or NDA
- Written Policy as Part of Employee Handbook
- Provide Meaningful Education & Training (make sure what you have works)
- Secure Your IT Infrastructure
- Establish Password Policy
- Protect CC and Bank Accounts
- Test Your Systems
- Conduct Exit Interviews
- Take Immediate Action
Unfortunately, laws are reactive in nature, not proactive. While cyber crime is still being scoped and defined by the justice system, it’s happening all around us every day.
Get your systems reviewed. How likely are you to get hacked? Call TxMQ or a security firm to be proactive in your approach to protecting your company data.
Can you survive a cyber attack? If you’re a small- or mid-size company, likely the answer is no. And if you do survive, what’s the extraneous cost to your reputation, customers and most of all you?