Common Insecurity

Computerworld - What do people who renew their driver's licenses, buy hard liquor or donate to a home for elderly and disabled veterans have in common? In New Hampshire, people who did any of those things within the past six months may have had their credit card numbers stolen because of computer security issues (see N.H. state server eyed in possible credit card data breach ).

No, there hasn't been a rash of hacker attacks or virus outbreaks. All three groups are potential victims of a single piece of malware found earlier this month on one state-owned server.

How it got there is now under investigation. Why all those different victims ended up on one server is a different problem.

According to the New Hampshire Office of Information Technology , the compromised machine was one of the state government's smaller servers. But it was used by the Division of Motor Vehicles for processing payments by credit or debit card. And by the state Liquor Commission as a backup system for processing sales at state-owned liquor stores. And for collecting donations to support the New Hampshire Veterans Home.

It's not hard to figure out how they got lumped together on the same box. That's what IT consolidation is all about, isn't it? Three separate, unrelated agencies had a similar need: processing credit card transactions. There was enough spare capacity on the DMV's server to handle the Liquor Commission's overflow and to pick up the small number of donations to the Veterans Home. Why buy two extra servers?

It must have seemed like a good, frugal idea at the time. It was only data, after all. On the server, why shouldn't drinking and driving mix?

And the consolidation worked fine -- as long as nothing went wrong. But with nothing separating the three sets of transactions, a single security breach turned into a three-fer.

It's hard to fault the state IT people for their response. They knew they were stretched too thin on security, which is why they were testing an automated intrusion-detection tool. That's how the Cain & Abel program, which can capture credit card numbers, was discovered.

And once it was found, they acted. Potential victims were notified. The FBI was called in. The infected server was carted away for forensic analysis. One IT employee was put on paid leave, though the state won't yet say why.

What they couldn't do was turn back the clock and do their consolidation differently so that, even if the server was breached, they'd be contacting victims from only one agency -- not three.