Summary
I did a brief analysis of the enforcement notices that have been handed out by the UK Information Commissioner (ICO) to organisations found to be in breach of the Data Protection Act. The idea was to see how many incidents were a result of a website hack (SQL Injection, XSS etc.) About 100 enforcements are listed on the ICO website covering the period from January 2008 to August 2010.I found that none of the breaches were the result of a website hack. No SQL injection, XSS, CSRF attacks etc. The vast majority were related to unencrypted USB sticks, CDs, laptops etc. which have been lost or stolen.
Details
The Information Commissioner's Office (ICO) is responsible for the enforcement of the Data Protection acts (as well as other legislation) in the UK.The ICO Enforcements page contains a list of enforcement notices that they have undertaken against organisations found to have been in breach of Data Protection legislation. The notices generally contain a short description of the breach as well as the remedial action which the implicated organisation undertakes to implement.
What is of interest from a web application security perspective is an analysis of the security incidents to see how many were caused by a website vulnerability - basically whether a website had been hacked.
I did a brief (not-very-scientific) analysis of the enforcements which have been published on the ICO website and focussed on the description of the breach.There were slightly fewer than 100 enforcements between 16 January 2008 and 26 August 2010.
I categorised the incidents as follows:
Unencrypted Media is where an incident occurred following the loss or theft of a device which contained personal information and was not encrypted. This could be a laptop, CD, USB memory stick, old hard drive etc. It also includes a number of cased where users sent out unencrypted emails to the wrong recipient. For example the Royal Wolverhampton Hospitals NHS Trust enforcement has the following description :
The report concerned an unencrypted CD, with no password protection, which contained scans of patient charts from the Intensive Care Unit of the data controller's Heart and Lung Unit, and was allegedly found at a bus stop near the data controller's premises and passed to the newspaper anonymously."
Loss of Paper Records covers incidents where paper records were involved. This could be where patient records were found in a waste skip etc.. An example is the NCL (Bahamas) Ltd which suffered a theft where:
the printout contained names, addresses, dates of birth, National Insurance numbers, salary details and full bank account details for around 80 employees."
Website Hack includes situations where a website was hacked. We would expect to see OWASP Top 10 type vulnerabilities being exploited which resulted in a breach of personal data.
Others is a catch-all for other types of incidents described in the enforcements. This could be where the organisation processes personal data in an unfair manner. For example they collect too much data.
Results
Here are the results of the analysis of the approximately 100 enforcements:Category | Approximate Number Incidents |
| Unencrypted Media | 70 |
| Loss of Paper Records | 20 |
| Others | 4 |
| Website Hacks | 0 |
A number of points to note. None of the incidents resulted from a website hack. No SQL Injection. No XSS. No CSRF. The vast majority resulted from the loss of an unencrypted device - or similar.
Can we conclude that OWASP (in the UK at least) can pull down the shutters - a job well done? Probably not.
But if I were an information security manager trying to prioritise the following projects:
- Do something about web application security
- Do something about USB/laptop encryption
Notes:
The numbers are approximate because in some cases the incident will have two causes. In other cases, a single enforcement notice covers multiple incidents.There is not yet a requirement to notify the authorities of a data breach. So the figures probably do not tell the whole story.
Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot
Nice write-up.
ReplyDeleteUnfortunately the numbers won't do much for the perception that security teams don't always focus on greatest business risk compared, reducing ROI.
Always good to have some hard(ish) figures to backup a requirement and/or protection though. Thanks for sharing.
--Andrew
Andrew, Thanks for that. I agree the numbers are a bit surprising! Alexis
ReplyDeleteSecurity testing is must. Everybody wants security at every level of his working. as explained above failures are happened but if we test time to time then it will improve. So it depend on us how much we are serious about this.
ReplyDeleteIntelligent Big Data Summarization for Rare Anomaly Detection Project For CSE
LBOA Location Based Secure Out sourced Aggregation in IoT Project For CSE
Modelling Cyber Attacks on Electricity Market Using Mathematical Programming With Equilibrium Constraints Project For CSE
Performance Evaluation and Analysis of IEC 62351 6 Probabilistic Signature Scheme for Securing GOOSE Messages Project For CSE
Poisson Reconstruction Based Fusion of Infrared and Visible Images via Saliency Detection Project For CSE
Secure Internet of Things (IoT) Based Smart World Critical Infrastructures Survey, Case Study and Research Opportunities Project For CSE