If 2016 taught us anything about technology, it was about the damage software security breaches can cause. And it’s not just a company’s reputation that suffers. We can measure the losses of the worst software security breaches in _billions_ of dollars.
Industries across the board from finance to government came under scrutiny from the press amid claims of fraud, leaked data and compromised private information.
What happened?
Is it that companies were just lax? Could the worst of 2016’s biggest security breaches have been prevented by more rigorous security measures? After all, it only takes one breach to bring down a company’s reputation and cause dollar values to plummet. Luckily, we can live and learn from the mistakes of others.
We can learn a lot from large companies like Sage and FACC (both of which we will cover). We’ll also take a look at Yahoo which fell victim to one of the largest software security breaches. Luckily, there are a few preventative measures that will allow your company to avoid the same pitfalls.
The largest software security breach in history (so far): Yahoo
2016 was a bad year for Yahoo. Two security breaches were made public, including the biggest known data breach in history.
In 2013, account information of 1 billion Yahoo accounts were taken in an assumed cookie-based attack, and in 2014, account information of 500 million users were taken. The attack method of the latter has not been confirmed.
User information taken in both breaches were similar; passwords, usernames, security questions and answers, birth dates and phone numbers. Perhaps more surprisingly, the security breaches were only made public in late 2016, years after they occurred.
It’s inconceivable how Yahoo let this happen. As soon as Yahoo knew of the breaches, they should have let users know immediately. It would have been easy to mitigate further risk by advising users to update their security information immediately.
This meant Yahoo users were susceptible to the following:
Financial impact on Yahoo
We can’t accurately measure the personal impact the 1.5 billion instances of compromised data had, or the damage to Yahoo’s reputation.
We can however measure the financial impact on Yahoo. They recorded a 6.5% share price fall after the second breach was publicized. Verizon had been slated to acquire Yahoo for US$4.8 billion. After news of the breach became public, Verizon was seeking a US$1 billion discount, adding more salt to the wound.
How you can avoid compromised data
Here are a few action points and preventative measures.
The fake president incident: FACC
‘Fake president’ scams are where an identity is imitated to convince an employee to transfer funds to a third party.
Of 2016’s most well-known ‘fake president’ frauds, a heavily publicized incident happened to Austrian company FACC, a supplier to Boeing and Airbus.
Almost a year ago, FACC became the victim of a fraudulent email that looked as if it was sent from the FACC CEO. The email instructed an employee to transfer around US$55 million to an account for a non-existent acquisition.
Because this type of scam echoes emails we sometimes receive from our long lost relative wanting to give us an inheritance, it can be easy to scoff at such a seemingly rookie mistake.
Emails used by the fake president scams often contain detailed, company-specific information in their subject line and body. An authoritative tone combined with a sense of urgency can make the email seem even more authentic.
Although this incident doesn’t win the prize for the most money stolen in a security breach (that goes to the US$81 million bank heist at Bangladesh’s central bank) this case is crucial due to the rising cost and frequency of fake president scams.
Financial impact on FACC
The CEO and Chief Financial Officer of FACC were fired shortly after the incident, and FACC’s share price fell by 19%. FACC also recorded a US$25 million loss, whereas FACC would have recorded a US$20 million profit if the company didn’t fall for the scam.
Lastly, we can’t forget the stolen US$55 million.
How to avoid email scams
The FBI issued a warning last year about the rise in business email scams which resulted in losses of more than US$2.3 billion globally over three years. We can have the most advanced security systems, but unfortunately the weakest part of the security equation are most often people. However, there are steps you and your company can take to avoid, or at least minimize, the risk of falling for a social engineering-type attack:
Insider threat: Sage
Sage is an accounting and HR software provider and the only software company on the FTSE 100. Sage released a statement mid-2016 that private customer information may have been stolen via unauthorized access from an internal login.
The data that may have been compromised was said to include employee information – salary and bank account details – from around 280 businesses. This incident is not remarkable in the amount of data stolen, it’s on our list because insider threats are arguably a bigger risk than external breaches. Internal breaches make up a whopping 91% of software security breaches.
The fact is that most insider breaches – about 71% of them – are unintentional. As developers, we can contribute directly to software security breaches through our code.
Writing perfect code is a myth. Think of the times you deployed code to production and found a bug originating from your code. Bugs happen – but they aren’t the worst thing in the world. You can check out a new git branch, write new unit tests, test the branch in another environment, then deploy to production.
If you start to think of every single bug as a potential chink in your company’s armour, you’ll start to look at bugs differently. Using this lens it’s easy to see how every developer is a potential insider threat, no matter how pure our intentions are.
Impact on Sage
Sage’s reputation is largely intact, mostly due to the fact Sage notified their customers straight away. The breach affected only 1% of their customers. Insider threats are notoriously difficult to predict and guard against. Sage’s share price fell momentarily by 4%, but have since recovered.
How to avoid internal breaches
Here are a few action points and preventative measures against internal threats:
Conclusion
The worst software security breaches are preventable. Ensure you have solid business and security procedures in place which are followed rigorously, and make it easy for your employees to report suspicions. If the worst does happen, follow Sage’s lead and let everyone know what steps they need to take to stay protected – even after a security issue!
As mentioned in this article, an error and crash reporting software like Raygun is beneficial as an early warning system. The Raygun platform detects software errors and broken scripts that can be a sign of a security breach in your software. If you’d like to see how Raygun can make your software safer, take a free trial here.
Related articles
How Raygun keeps big data safe
Mobile application development trends from 2016
Maintain visibility through the entire software build process
Rails security: dropping your code into shark infested waters!