Thursday, August 7, 2008

Drawing the Wrong Lessons from a Breach

The other day, I was listening to the radio, and a commentator said that the most significant harm that could come from a major breach like the TJX breach was not identity theft, but was actually people losing faith in doing business over the internet. Frankly, I'm not sure he was right, given that identity theft is a major problem for consumers. However, while it might not be the biggest harm from a breach, losing faith in doing business over the internet would be an inappropriate response to a breach like that at TJX for the simple reason that the internet had nothing to do with that breach. Instead, the hackers found stores which had unsecure wireless connections, used them to install malicious software on the TJX corporate network, then used the software to harvest credit cards from TJX's systems. The internet didn't come into play until after the cards were stolen and the thieves needed to sell them. While avoiding doing business over the internet might avoid some types of risks (particularly phishing scams), it would have no effect whatsoever on a consumer's risk of being affected by a breach such as took place at TJX.

1 comment:

John Taylor said...

Again, tbank you for pointing that out. I encounter a lot of misinformation and of course misunderstanding of what identity theft is. There are so many forms of this crime that I have to catagorize them into 5 major types in order to show the breadth of the set of crimes we call identity theft.
1. Financial
2. SSN
3. Chatacter and criminal
4. Drivers' license
5. Medical
Within each type as you know there are myriad subtypes of methods and schemes. Then there is re-aggregation of data where the stuff is sold piecemeal and resold. Most of the press goes to financial ID theft for a couple of reasons I believe. First, even though financial ID theft only accounts for about 30% of the reported cases it is the single largest category simply because of the immediate payout to the thieves. Secondly, I truly think the proliferation of "solutions" oriented products heavily advertized by private sellers and banks lead to public into a false sense of the crime and how to protect from it. I ran into a guy recently who told me flat out that since he signed up with "Liplock" they can prevent him from ever becoming a victim of ID theft. That is not an uncommon feeling.
Thanks for what you do.