Who is after the personal customer data you have!
Posted by Bhoopendra Adhikari
Apparently a lot of people and from all over the globe. And they are not your customers. Today’s conviction of 11 persons for the one of the largest ever data breach in terms of records is an indicator of this. What’s so interesting about this? Here are some facts:
- Three of the defendants are U.S. citizens, one is from Estonia, three are from Ukraine, two are from China and one is from Belarus, the DoJ said. One individual is only known by an online alias, and his place of origin is unknown.
- The stolen data was kept in the servers in East Europe and US and sold to criminals over internet. Banks in Eastern Europe were used for transactions.
This is not the plot of a technology thriller but a reality and a costly one too. It cost at least one vendor TJ Max 60 Million USD.
The spread of internet is not without these undesirable consequences. First, low resistance from the target, chances of higher yield, better and farther reach with low skill base and ease of covering your real identity in case of detection are some factors which are attracting a large set of people across the globe to try their luck on your data. Secondly a number of countries have inadequate cyber laws which make it easier to hide and sell the data online.
Add these two and you have a big collaborative internet community waiting for you to loose your oversight and make a fast buck out of it. The bad part is with low entry barriers this community will keep growing and you can’t help it. The good part is, if you have robust set of controls you are not worth spending more time on and they will move on to the target which offers lesser resistance. In other words your effective controls will make you unattractive for large set of these people who are scouting the internet for what they see as a low hanging fruit!
So if you are managing your controls effectively you may be doing better then you believe. You may not be aware but every time a news like this is public, the chances that your organization was the one where it was attempted (unsuccessfully) before the victim are real. There are lots of people around the world who are interested in the data you are trying to secure!
