A week after shutting down its PlayStation Network (PSN), Sony has admitted that its 70 million users’ personal information has been compromised – including names and addresses, dates of birth and passwords. The company is also warning that hackers could well have gained access to users’ credit card details. Here are some initial comments from IT security firms.
Phil Lieberman, CEO and founder of Lieberman Software has over 30 years programming experience and in this short opinion piece he gives his viewpoint on the Sony PSN hack and how to protect yourself from similar breaches.
“Taking a baseball bat to a hornet’s nest is never an advisable strategy. Sony’s strategy in defending its intellectual property was heavy handed and has triggered the “nuclear option” with those that it engaged. Perhaps Sony could learn a few lessons from Microsoft in how it has handled XBOX 360 and Kinect intellectual property.
My suggestions for consumers:
1) Don’t provide your correct DOB or other personal information to this type of vendor (ie playing games on-line)
2) Use a throw-away email account
3) Use an anonymous debit card for these types of on-line transactions
4) Use a unique password per site
5) Always assume that the company gathering your personal information in totally incompetent at securing the data, and consider what you share with them and how you are going to recover your personal identity after they lose your information.
The reality of cloud data security and PCI today are that they are ineffective and there are no consequences for many companies that under-invest in security. You can be sure that the CIO and CSO at Sony responsible for this situation will probably not be fired or held accountable for their poor decisions. Similarly, the auditor responsible for the Sony account will similarly (in all probability and looking at these situations historically) not be held accountable. The loss of your personal information will (not likely) be nothing more than a “cost of doing business” for this type of company-you will take the pain and they will take a hit to their reputation (maybe).
It is for this reason we are fundamentally opposed to hiding PCI results as well as SAS70 reports from the public. If you don’t have access to the full internal security report of a vendor you are dealing with, you should expect that they have little to no real security and that your data will probably be compromised.
There is abundant technology to prevent this breach and/or limit its scope, but Sony chose to not implement it. Putting this much data in a single database that is publicly extractable with no limits is shameful given what is available today to protect against this type of loss.”
Lag alarm
“One of the most alarming aspects of this latest major breach is the time it has taken Sony to reveal the extent of the damage,” said Ross Brewer, vice president and managing director, international markets, LogRhythm. “Compromised user accounts were discovered as early as 17 April and PSN was closed down last Wednesday, yet it has taken seven days to warn users that they are now at increased risk of email, telephone, and postal mail scams, as well as credit card fraud.”<br><br>The PSN breach joins Epsilon, Play.com and Lush as the latest in a line of high profile security incidents to affect end user data. The regularity with which they occur suggests, according to LogRhythm, issues in distinguishing malicious from legitimate behaviour – an issue highlighted recently by security minister Baroness Neville Jones when she claimed that many organisations miss security threats because they do not know enough about their own systems to understand what normal functioning looks like.<br><br>“Sony will more than likely claim that the delay was due to attempts to protect customers while investigations continued, however, like many organisations today, the truth is more likely that adequate log management and forensic analysis was not employed. This kind of protective monitoring is now essential as traditional security products are failing to prevent initial intrusions – organisations require solutions that can analyse 100 percent of logs, provide accurate correlation of events and a real insight into the root cause of incidents across IT networks.<br><br>“An incident this size is sure to have significant repercussions for Sony. Relations with existing customers have been damaged and its ability to attract new ones reduced. Recent LogRhythm research found that that 66 percent of UK customers try to avoid future interactions with organisations found to have lost confidential data, while 17 percent resolve never to deal with them again.*”<br><br>(*OnePoll survey, 5000 UK consumers, November 2010.) <br><br>Users of Sony’s PlayStation Network are at risk of identity theft after hackers broke into the system and accessed the personal data of videogame players, says IT security firm Sophos.<br><br>The implications of the hack, which resulted in the service being offline since last week, are only now becoming clear as Sony has confirmed that the hackers, who broke into the system between April 17, and April 19, were able to access the online gamers’ personal information. According to computer security firm Sophos, users should take immediate action to ensure that their online identities are secure, and that fraudsters cannot take advantage of stolen credit card information.<br><br>"If you’re a user of Sony’s PlayStation Network, now isn’t the time to sit back on your sofa and do nothing. The fraudsters won’t wait around – for them this is a treasure trove ripe for exploiting. You need to act now to minimise the chances that your identity and bank account become casualties following this hack," said Graham Cluley, senior technology consultant at Sophos. "That means, changing your online passwords (especially if you use the same password on other sites), and considering whether it would be prudent to inform your bank that as far as you’re concerned your credit card is now compromised."<br><br>Sony has warned that hackers have been able to access a variety of personal information belonging to users including:<br><br> * Name<br> * Address (city, state, zip code)<br> * Country<br> * Email address<br> * Date of birth<br> * PlayStation Network/Qriocity password and login<br> * Handle/PSN online ID<br><br>In addition, Sony warns that profile information – such as history of past purchases and billing addresses, as well as "secret answers" given to Sony for password security may also have been obtained. Sony also admits that it cannot rule out the possibility that credit card information may also have been compromised.<br><br>"The fact that credit card details, used on the network to buy games, movies and music, may also have been stolen is very disturbing," continued Cluley. "If Sony loses your credit card information, it’s no different from you losing your credit card – you should cancel that card immediately. Questions clearly have to be asked as to whether Sony was ignorant of PCI data security standards and storing this and other personal data in an unencrypted format. All in all, this is a PR and security disaster for Sony."<br><br>For more information visit the Sophos Naked Security site at: http://nakedsecurity.sophos.com/2011/04/26/playstation-network-hacked-personal-information-of-up-to-70-million-people-stolen/
