Computerworld - What do people who renew their driver's licenses, buy hard liquor or donate to a home for elderly and disabled veterans have in common? In New Hampshire, people who did any of those things within the past six months may have had their credit card numbers stolen because of computer security issues (see N.H. state server eyed in possible credit card data breach ).
No, there hasn't been a rash of hacker attacks or virus outbreaks. All three groups are potential victims of a single piece of malware found earlier this month on one state-owned server.
How it got there is now under investigation. Why all those different victims ended up on one server is a different problem.
According to the New Hampshire Office of Information Technology , the compromised machine was one of the state government's smaller servers. But it was used by the Division of Motor Vehicles for processing payments by credit or debit card. And by the state Liquor Commission as a backup system for processing sales at state-owned liquor stores. And for collecting donations to support the New Hampshire Veterans Home.
It's not hard to figure out how they got lumped together on the same box. That's what IT consolidation is all about, isn't it? Three separate, unrelated agencies had a similar need: processing credit card transactions. There was enough spare capacity on the DMV's server to handle the Liquor Commission's overflow and to pick up the small number of donations to the Veterans Home. Why buy two extra servers?
It must have seemed like a good, frugal idea at the time. It was only data, after all. On the server, why shouldn't drinking and driving mix?
And the consolidation worked fine -- as long as nothing went wrong. But with nothing separating the three sets of transactions, a single security breach turned into a three-fer.
It's hard to fault the state IT people for their response. They knew they were stretched too thin on security, which is why they were testing an automated intrusion-detection tool. That's how the Cain & Abel program, which can capture credit card numbers, was discovered.
And once it was found, they acted. Potential victims were notified. The FBI was called in. The infected server was carted away for forensic analysis. One IT employee was put on paid leave, though the state won't yet say why.
What they couldn't do was turn back the clock and do their consolidation differently so that, even if the server was breached, they'd be contacting victims from only one agency -- not three.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts