May 2011


Uncategorized25 May 2011 08:08 am

I have been thinking about the Sony security breaches where hackers entered their environment and grabbed customer data.

A good network behavioral anomaly detection system could have detected the information leaving the Sony network for a new location, but, there is a chance they it could have missed the incursion.

But, if Sony had invested in DLP technology, they could have created an exact fingerprint of the sensitive customer information stored in their databases, and then, using DLP Data in Motion monitoring technology, they would have been notified when the sensitive information was detected traversing outbound from their database server to the Internet. 

If you think about it logically, customer name and credit card information should not be moving from any database at Sony out towards the Internet in clear txt format. Credit card numbers leaving for the internet clear txt is a violation of PCI compliance standands and could result in Sony being restricted from accepting credit cards.  Or if there was some type of clear txt credit authorization process for one credit card, create a rule that monitors for the movement of 10 or more customer names and credit card numbers across the DLP network monitoring sensor and alert on that movement.

With Sony now reporting a $3.2 billion dollar loss for the year, clearly the price point of implementing a complete DLP system would pale in comparision to the cost of the disclosure events now facing the company.

If you would like to dialog about implementing DLP at your company, contact me today!

LG @ objectsoft.com – remove the spaces

And visit us online: http://www.objectsoft.com

Uncategorized24 May 2011 12:55 pm

As an IT security professional and somebody who has lived in the IT security space for many years, I am facinated that a large company like Sony did not have the temerity or forward vision to have their web site checked for application security issues.

Visiting black hat and defcon each year, and seeing the triving hacker community at its finest from Security researchers to hackers sitting cross legged on the floor in the middle of the main hall, you have to believe that hacking for profit is alive and well, and a marque company like Sony getting hacked has to be on the radar screen.

While no web site is complete foolproof, and protected, I am confident that Sony could hire an application security penetration testing firm to review their web site, close the gapping holes, which 8 successfull hacks in the last two weeks appears to indiciate, and get Sony off the Hacker wall of shame and back to making money instead of losing 3.2 billion dollars last year according to published reports.

If Sony is really desperate, the can hire us to perform an application security audit and pentest to help them close the most gapping security holes on their web site.

Visit us online:

http://www.objectsoft.com