Computerworld - What do people who renew their driver's licenses, buy hard liquor or donate to a home for elderly and disabled veterans have in common? In New Hampshire, people who did any of those things within the past six months may have had their credit card numbers stolen because of computer security issues (see N.H. state server eyed in possible credit card data breach ).
No, there hasn't been a rash of hacker attacks or virus outbreaks. All three groups are potential victims of a single piece of malware found earlier this month on one state-owned server.
How it got there is now under investigation. Why all those different victims ended up on one server is a different problem.
According to the New Hampshire Office of Information Technology , the compromised machine was one of the state government's smaller servers. But it was used by the Division of Motor Vehicles for processing payments by credit or debit card. And by the state Liquor Commission as a backup system for processing sales at state-owned liquor stores. And for collecting donations to support the New Hampshire Veterans Home.
It's not hard to figure out how they got lumped together on the same box. That's what IT consolidation is all about, isn't it? Three separate, unrelated agencies had a similar need: processing credit card transactions. There was enough spare capacity on the DMV's server to handle the Liquor Commission's overflow and to pick up the small number of donations to the Veterans Home. Why buy two extra servers?
It must have seemed like a good, frugal idea at the time. It was only data, after all. On the server, why shouldn't drinking and driving mix?
And the consolidation worked fine -- as long as nothing went wrong. But with nothing separating the three sets of transactions, a single security breach turned into a three-fer.
It's hard to fault the state IT people for their response. They knew they were stretched too thin on security, which is why they were testing an automated intrusion-detection tool. That's how the Cain & Abel program, which can capture credit card numbers, was discovered.
And once it was found, they acted. Potential victims were notified. The FBI was called in. The infected server was carted away for forensic analysis. One IT employee was put on paid leave, though the state won't yet say why.
What they couldn't do was turn back the clock and do their consolidation differently so that, even if the server was breached, they'd be contacting victims from only one agency -- not three.
- PCI 3.0 Compliance In this white paper, learn how PCI-DSS 3.0 effects how you deploy and maintain PCI compliant networks using CradlePoint devices.
- Mitigating Security Risks at the Networks Edge This white paper provides strategies and best practices for distributed enterprises to protect their networks against vulnerabilities, threats, and malicious attacks.
- 5 Strategies for Modern Data Protection Read the five strategies for modern data protection that will not only help solve your current data management challenges but also ensure that...
- 5 Ways Dropbox for Business Keeps Your Data Protected Protecting your data isn't a feature on a checklist, something to be tacked on as an afterthought. Download here to find out how...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!