numbers, google sites and online gaming sitting on a tree

devinieke article

[updated 30/1/2020]


Cost of Data Breach – do the numbers mean anything?

Okay, here are some numbers that should help get our heads out of the clouds or douse that ego with some lukewarm water. At least, a quarter of all data breaches in 2018 were as a result of human error, bear in mind that this is from a report by the revered SkyNet wannabe IBM in collaboration with the IT privacy think tank Ponemon Institute. The study aptly named ‘Cost of Data Breach‘, further showed that across over 500 organizations in 16 countries (the breath of the study) and 17 industry sectors, human error accounted for 24% of data breaches -think faulty entries, system glitches and the like- through the study period i.e. July 2018 to April 2019.

Firstly, libations must be poured for the lost interns responsible for those “critical” excel docs, because as cynical assumptions will allow, if one takes into consideration the fact that the healthcare industry suffered the most as far as data breach cost is concerned (almost $6.5m), they will bear the immediate brunt of any blowback. ThreatPost also reported that even as healthcare data and information is the most important, the industry itself is still struggling to adopt security standards that are reflective of the kind of data processed on a regular basis. Meanwhile, this wet towel of a report still has some info that will probably be ignored; although the extensive use of encryption in concerned information systems helped mitigate cost of data breach by $320k, extensive migration of systems to cloud providers ended up costing $300k in data breach cost…is this an ‘apples to oranges’ situation? Or are patterns being spotted where none exist.

“Healthcare data is some of the most significant and yet the healthcare industry is struggling to implement standards that reflect the caliber of sensitive data that their systems process.” George Wrenn – CyberSaint Security


The Invulnerable Google…not!

The Google Sites product is a simple tool that allows a person with minimal experience to quickly create webpages using drag-and-drop UI controls for that purpose. Well, that sounds interesting and colorful like their logo but ThreatPost…the trusty ThreatPost has reported that cash-card skimmers are masking domains as those of google sites in a bid to grift unsuspecting web visitors of their hard earned coins. Apparently, this is done by implanting malicious JavaScript code in the target website after which the victims performs normal transactions whose details are discreetly transferred to a separate server. The web address is purposely made to look as close to the original as possible in order to reduce chances of detection. Sucuri, a web security team found recent occurrences of this issue on a website making use of Magento an e-commerce content management system (owned by Adobe by the way) and showed that the malicious code had been loaded after the visitor reached a compromised URL.

The team also found that the JavaScript code does not copy any inputted data off the website if it detects certain conditions that can expose its actions are satisfied -not AI level yet, just dedicated criminals covering all bases.

Essentially, the take away here is; be careful of links you click, be sure of the spelling of the website URL you want to look at, make sure sites where you make transactions carry a padlock in the address bar or that ‘https://’ precedes the website name. Not foolproof, but will definitely reduce chances of being taken unawares when making those purchases.


Oh Ye Online Gamers! You are Prey!

Keep in mind that a lot of people will have the same online account tied to their MineCraft, FortNite and Blizzard profiles making them easy pickings for hackers. An Enzoic staff is quoted in an interview as saying that with multiple accounts to one person, hackers can swipe as much as $40 per active account. With high scores and next stages as driving interests, only few care about security practices, meaning weak passwords and such, help place targets on these unsuspecting high score hunters. Gaming forums and websites are not helping issues either with ArmorGames, HBgames, BlankMediaGames etc. being recent examples of compromised websites according to data breach directory Vigilante. In this case as expressed by Wilson of Enzoic, gaming companies basically calculate that it is better for business to allow customers quickly make purchases and transactions with ease and speed at the cost of better security, rather than make sure customer info is kept secure. Well, no surprise there, the bottom line rules all. Read this one I wrote to confirm this.


….end transmission….

If you enjoyed this, consider sharing it

Leave a Reply

Your email address will not be published.