Why those corporate data breaches are happening
Robert H. Sloan and Richard Warner
Perspecsys Photos via Flickr
Imagine that suddenly there were frequent security incidents at Chicago's United Center. Would you leap to blame the fans who attend the games or the Bulls' starting roster? No, you would rightly say that changes were needed with whoever was providing stadium security. We should react in the same way to the recent massive data breaches.
In that spirit, we offer zero advice to consumers about checking credit cards, credit scores or the like. Instead, our concern is with the poor security that creates the problem in the first place.
So how does computer security work? A lot like security at the United Center. If you were in charge of security there, you would find out where the doors are, lock the ones you don't need and post guards at the rest to check credentials (tickets, press passes, etc.). Nothing's perfect, so you also would put guards inside to monitor behavior. Computer and network security is the same. We lock doors (shut down access points), post credential-checking guards (verify authorization) and deploy behavior-monitoring guards (ranging from home computer antivirus programs to multimillion-dollar systems defending corporate networks). In short, you would defend in depth.
In the well-documented Target Corp. breach, the retailer had a $1.6 million, state-of-the-art system to prevent unauthorized access. It worked, sounding alarms that hackers had penetrated the network.
• Are consumers going back to cash after credit card breaches?
• Illinois attorney general looking into JPMorgan data breach
• Are Target hackers behind Home Depot data breach?
Evidently, Target failed to heed the warnings. This is not unusual. The explanations are typically that there are too many false alarms and that corporate culture discourages the disruptions from responding to those alarms.
In the case of both Target and Home Depot, "open doors" also were a problem. Credit card data was not encrypted when cards were swiped — the equivalent of leaving money out on a counter — and there were other open doors that let hackers in. Security experts can do a much better job closing doors and locking up money through encryption and other means.
ANSWERS IN EUROPE?
For instance, the United States should switch to European-style chip-and-pin credit cards that contain a microchip. To make a purchase, the cardholder enters a PIN that has to match what is on the card's microchip. Chip-and-pin is more secure because hackers can't copy the chip.
Improvements also are possible in the point-of-sale terminals where consumers' cards are swiped. A POS terminal is a simple desktop computer, and, like any computer, it runs programs. It should be set up to run only those from an approved white list (and thus not the programs hackers give it). What stands in the way? Time, effort and money. It takes a lot of each to improve security.
Society would be better off if we made the investment. But consumers have been unwilling to pay for the added value of security through slightly higher retail prices or credit card fees, and companies dependent on consumer sales don't offer what consumers don't want. But consumers end up paying even more to cover the high cost of data breaches.
The way out is to change the incentives. That requires thoughtful changes to policies, laws and norms to give incentives to improve security to the people who hold our data. That, not the technology or consumer behavior, is the hard problem we need to solve.
The law should define and require best practices for online security, such as encryption, use of chip-and-pin cards and POS white-listing, for large businesses that store sensitive consumer data. No defense is perfect, so it should be easier than it currently is for consumers to resolve problems when identity theft does occur.
Difficult problems remain. How do we formulate practices with sufficient detail to provide genuine guidance but with enough flexibility to encourage innovation and keep pace with rapid change? And who is required to conform to what practices? Standards appropriate for resource- and expertise-rich corporations will not make sense for mom-and-pop retailers. History shows that such problems are typical of rapid technological and economic change, and history shows that we find solutions.
Robert H. Sloan, right, is a professor and head of the Department of Computer Science at the University of Illinois at Chicago. Richard Warner is faculty director of the Center for Law and Computers, a professor and Freehling Scholar at Chicago-Kent College of Law. Both are co-authors of "Unauthorized Access: The Crisis in Online Privacy and Security."
Dakota pipeline expansion would be all risk for Illinois
Chicago doubling down on dangerous 'securitized bonds'