For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
|
|
|
|
February 27, 2006 (Computerworld) -- What do people who renew their driver's licenses, buy hard liquor or donate to a home for elderly and disabled veterans have in common? In New Hampshire, people who did any of those things within the past six months may have had their credit card numbers stolen because of computer security issues (see N.H. state server eyed in possible credit card data breach ).
No, there hasn't been a rash of hacker attacks or virus outbreaks. All three groups are potential victims of a single piece of malware found earlier this month on one state-owned server.
How it got there is now under investigation. Why all those different victims ended up on one server is a different problem.
According to the New Hampshire Office of Information Technology , the compromised machine was one of the state government's smaller servers. But it was used by the Division of Motor Vehicles for processing payments by credit or debit card. And by the state Liquor Commission as a backup system for processing sales at state-owned liquor stores. And for collecting donations to support the New Hampshire Veterans Home.
It's not hard to figure out how they got lumped together on the same box. That's what IT consolidation is all about, isn't it? Three separate, unrelated agencies had a similar need: processing credit card transactions. There was enough spare capacity on the DMV's server to handle the Liquor Commission's overflow and to pick up the small number of donations to the Veterans Home. Why buy two extra servers?
It must have seemed like a good, frugal idea at the time. It was only data, after all. On the server, why shouldn't drinking and driving mix?
And the consolidation worked fine -- as long as nothing went wrong. But with nothing separating the three sets of transactions, a single security breach turned into a three-fer.
It's hard to fault the state IT people for their response. They knew they were stretched too thin on security, which is why they were testing an automated intrusion-detection tool. That's how the Cain & Abel program, which can capture credit card numbers, was discovered.
And once it was found, they acted. Potential victims were notified. The FBI was called in. The infected server was carted away for forensic analysis. One IT employee was put on paid leave, though the state won't yet say why.
What they couldn't do was turn back the clock and do their consolidation differently so that, even if the server was breached, they'd be contacting victims from only one agency -- not three.
Look, consolidation isn't just an attractive option; it's inevitable. IT hardware just keeps getting cheaper, and the human cost of administering it keeps going up. It only makes sense to reduce the number of boxes and fill up unused capacity in our data centers.
But it can't be done casually or haphazardly. Maybe consolidation isn't exactly the enemy of security, but it poses real security challenges. Simply shoveling different processes or data sets into unused server capacity means we lose the physical separation that provides an important layer of security.
Yes, that's convenient. It's budget friendly. But it's not safe.
The more we can segregate our processes -- the more locked doors we can put between one running process and another -- the harder it becomes for an intruder to have free access, and the easier it is to keep things secure.
In networks, we can use subnets to separate processes and contain problems. On servers, we can use virtualization. That's more complicated and expensive than just piling things in together. But it's the kind of "defense in depth" that we need today to protect customer and corporate information from saboteurs, intruders and worms.
And in the face of IT consolidation and never-ending security threats, it's the only way to make sure that customers who are driving, drinking or donating have a lot less in common.
Frank Hayes, Computerworld's senior news columnist, has covered IT for more than 20 years. Contact him at frank_hayes@computerworld.com.
See more Frankly Speaking columns.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Microsoft promises four patches next week
- Google gives away home-cooked Web application security scanner
- Storm botnet stages Fourth of July attacks
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
 In SecuritySecurity's important, and risk must be addressed, right? Sure, but watch for four signs your policies go a bit overboard. Click here to read the latest column by Jon Espenschied |
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
