The last 3 days of the DNC convention has brought Cyber Security back into the limelight, but with a new twist.
The most recent leak of hacked emails from the Democratic National Committee allows all of us outsiders an inside look into the world of politics we only hear whispers about.
While the political intrigue is interesting, as a professional in the IT CyberSecurity industry, I find the new normal of hacked emails servers an easy target for lessons learned.
It’s not always a financial target - I often tell clients there are many types of breaches, but there are three types they need to focus on.
- A. There is the obvious financial breach when they are going for credit card data, bank transfers, ransom, or some type of quick financial win.
- B. There is the resellable data that will not necessarily lead to an immediate financial payoff. For example, they are grabbing all your customers with SSN. They can’t immediately use this data, but they can resell it.
- C. There are secret things that aren’t worth anything but are things you don’t want anyone to know.
I find that many of the organizations I work with dismiss the last category, C. So often, it’s those secret things that get overlooked. Over the past decade, because of DLP and better end user education, email is not as prime a candidate for A. or B., but email is still a huge candidate for very sensitive organization data, especially strategy data. Think about where else in your company, beyond email, your sensitive data that could prove very embarrassing is currently stored. Is that data as protected as it should be?
- Make the investment - If you are Debbie Wasserman Schultz the former Chair of the DNC, what would you give to go back and change your opinion on the value of IT Security in your organization? I know we could say this about many organizations that have been hacked in the past few years, but this one seems so simple. Can anyone say Watergate? Stealing political information has been the norm for years, this was an easy “investment” she didn’t make. (As a side note, whoever did the DNC annual cyber security audit, might want to look at your discovery process, especially around email...)
- How it happened doesn’t always matter - Cyber security is HOT right now. Just a little background, I’ve been in the industry for over 10 years, and an active participate for nearly 30 (that’s right, I was dialing into mainframes back in 1988 for anyone checking dates). The last 2 years we have seen an explosion of security start-ups. An area that has become very popular, post the Target hack, is the forensics or post-breach investigation business. While in many cases it is necessary to know what happened, in the case of the DNC, they are focusing on the wrong thing. However “They” got your data, “They" got your data, who cares / “Game over man, Game over." Focusing on who was the hacker is most likely all political theater and misdirection in this case. For the reader or my client, if you had the same issue, I would tell you to spend very little time or money figuring out if it was the Russians or Trump. I would begin the hard work of locking the future down! To be clear, in many cases finding out who and how is important, but not in this case.
- Secure Email - Email has become so insecure over the years, it is really becoming a joke. Our end users have been pushing and pushing for ease of use when it comes to email. They want to read and respond from any device in the world! Friends, your corporate email is not your gmail. We can no longer support ubiquitous email. It is time organizations and companies that want the public trust to begin the move to a more secure, token, multi-factor email solution. Ok, so in a more secure email world, you can't check your ultra sensitive email from a plane at 30,000 feet on your friends iPad because your new email doesn’t work in that scenario? Is that the problem? Hmmm, um #sorrynotsorry. It’s time to make the change, and secure email, even if it means giving up on some functionality!
We will know in a few months if this most recent Democrat security issue will ultimately affect them at the ballot box. If it does, they are going to lose far more than just face for sabotaging Bernie. Losing a national election for President can cost you Trillions. This could be the largest financial loss because of a Cyber Security breach ever. I’m just wondering, do you have to report that to the American people? We are their customers, correct?
