A cyber attack on the website of travel trade organisation Abta may have affected around 43,000 individuals. The organisation said around 1,000 files which may include “personal identity information” of holidaymakers who had made complaints about Abta members could have been involved in the attack, which happened on February 27.
IT security experts from Positive Technologies, OwlDetect, Nexsan, Cylance, Certes Networks, MWR InfoSecurity, Vectra Networks, Netskope, Zscale, Splunk, Micro Focus, Bitglass, Digital Guardian, Avast and SailPoint commented below.
Alex Mathews, Lead Security Evangelist at Positive Technologies:
“If the compromised web application was being hosted on the same outsourced server as the illegally accessed database, this is not best practice, the two should be segregated. This is because any breach of the application would likely provide the attacker with access to administrative levels of the database.”
“The focus will now switch to post breach analysis, investigating the compromised servers to ascertain how long the attacker had access to the system, how the breach happened and what can be done to minimize risk. However, this is obviously no comfort to people who have had their data stolen, who should change passwords across the board, everything from email to social networks.”
Professor Richard Benham, Leading UK Expert on Cybersecurity and Security Advisor for Online Service OwlDetect:
“Firstly, it’s important that you act quickly. Change any passwords which might be affected, especially those which you use elsewhere on the web. New passwords should contain a strong alphanumeric code, including numbers, hashtags and punctuation. It’s also advisable to opt for Two-Factor Authentication whenever possible. This means that, even with your email and password, hackers cannot gain access to a website without first having access to your mobile phone.
“If you’re looking to protect yourself even further, services like OwlDetect can monitor the web and alert you if any of your personal information is leaked.”
Geoff Barrall, COO at Nexsan:
On-premises private cloud solutions have come a long way in the last decade and can offer flexibility along with the security that businesses need to survive. With this level of functionality and security available, there is no need for companies to continue to risk their reputation on third party solutions.”
Dr Anton Grashion, Managing Director, Security Practice at Cylance:
“Until more businesses stop depending on outdated antivirus technology to protect their sensitive data and look to the newer approaches, such as those deploying artificial intelligence to ferret out and prevent the brand-new types of malware from running, more and more ordinary citizens are going to be affected by attacks such as this one.”
Dan Panesar, VP EMEA at Certes Networks:
As the number of companies being hit by hackers rises, it is not acceptable for organisations to treat every single cyber-attack as a ‘learning curve’. With the introduction of the new GDPR in 2018, the lessons need to have been learned and action taken. The approach to cybersecurity needs to change or companies could face failure if they do not comply.”
Dave Hartley, Associate Director at MWR InfoSecurity:
Attackers will always find the weakest link and traverse the path of least resistance, and all organisations need to be aware that any one of their service providers can expose them to the risk of breach. It doesn’t matter if a company’s own house is in order – they need to make sure that all of their partners hold the same standards of protecting them and their data.
Business’s need to put a great deal of due diligence and consideration into assuring the security of any third-party relationship and their supply chain – but especially any partner or service provider directly responsible for customer data such as a web host.
Attempting to shift focus to third parties will mean little to any customers who are affected by a data breach, and firms need to accept that responsibility ultimately falls at their door, regardless of the source of the breach.”
Matt Walmsley, EMEA Director at Vectra Networks:
“Through a lack of in-house knowledge or in an effort to save costs, businesses and organisations often outsource their web server hosting to third-party providers. However, they need to be aware that when they do this they are essentially outsourcing their security capabilities and robustness to that third party, who may not always be well-placed to evaluate security elements. Businesses must be prepared to vet the security capabilities of their partners and take extra precautions when they have a duty of care over personal information. It’s critical that, wherever a service is hosted, organisations retain the ability to rapidly and accurately detect attacks. In doing so they give themselves the best chance to intervene early and minimise or even defeat the breach. Playing the blame game may dampen the resulting reputational damage of a breach, but it’s unlikely to spare any parties involved from the punishments of GDPR.”
“In the coming days, weeks and even months, consumers who are affected by the breach should remain vigilant and ensure that all their personal accounts are secured. Something as simple as changing a password can make a big difference when it comes to keeping their identity safe.”
Andre Stewart, VP EMEA at Netskope:
“While the web server system vulnerability has now been fixed and ABTA was quick to alert potential victims alongside the offer of help for those affected, to some extent, the damage has been done. Just this week fraud prevention organisation Cifas revealed that identity theft cases reached record levels in 2016 – and the theft of personal information such as contact details only increases the likelihood of falling victim to fraudsters. This hack serves to remind businesses of their accountability when it comes to the privacy of their customers. The EU General Data Protection Regulation (GDPR) – set to come into effect in May 2018 – will hold businesses accountable for their data practices and will force companies to take active measures to mitigate any threats to personal privacy. There will be hefty fines for those which fall short of these standards.
“Organisations must be able to protect their customers’ privacy and safeguard their data or, in this digital age, they run the risk of becoming a huge target for those cyber criminals testing organisations’ digital defences. In particular, as more data is stored off-premises and in cloud services, organisations need to ensure the correct security controls are in place within their businesses and their suppliers. Remaining vigilant to unusual user behaviour and taking active measures to secure data – especially in the cloud – will be key to protecting customer data and, above all, their privacy.”
Chris Hodson, EMEA CISO at Zscaler:
“With personally identifiable information being compromised, rather than prioritised when it comes to protection, we have to question where the gaps in corporate security lie and understand how responsibility should be defined so that businesses can start to fill them.
“Irrespective of where data resides, businesses cannot outsource responsibility. So, as more third party cloud services are adopted, this management of the supply chain must be considered. Especially as the EU GDPR age promises excruciating fines for those who cannot comply.
“For consumers concerned in the wake of this incident, it will be critical to reconsider passwords. Having a back-up store of various different and complex passwords will mean that they won’t have to rely on corporate enterprise security in the short-term. In the long-term the onus must be flipped back to businesses who are responsible for stress testing their systems, working with third parties and ensuring that nothing slips through the net.”
Matthias Maier, Security Evangelist at Splunk:
In such a threatening cyber landscape, organisations must have the right response capabilities and processes in place to stifle the impact of malicious and highly destructive assaults. When an organisation finds out that its infrastructure has been breached by criminal activity, its first step should be to understand its scale and scope through the machine data it should have available in its organisation. This is increasingly important due to upcoming requirements put in place by the GDPR regulation regarding breach notification that will come into effect across Europe in 2018.
It looks like ABTA has done its homework and ensured that the third party-provider that hosts its website has been able to remediate the vulnerability and identify what has happened quickly. As a result, ABTA has been able to alert affected customers and the relevant authorities in a timely fashion with a view to mitigating its impact. As we see the number of cyber attacks and breaches grow, having the capability to understand the scale of a breach by analysing all machine generated data from web applications will be key, as will having proper processes and crisis plans in place to respond effectively.”
David Mount, Director of Security Solutions Consulting EMEA at Micro Focus:
“In future, we need a more effective way to securely prove who we are without relying solely on passwords as they are no longer useful as a single factor of authentication. The answer could be biometrics, tokens, smartphones, behavioural indicators, or a blend of these measures – pinpointing the appropriate method always depends on the sensitivity of the information or service being secured. Hackers are always looking for new ways to access these databases, and relying on a user to devise (and remember) a sufficiently secure password for each different online account is fundamentally flawed.”
Eduard Meelhuysen, Head of EMEA at Bitglass:
Thomas Fischer, Threat Researcher and Security Advocate at Digital Guardian:
Pete Turner, Consumer Security Expert at Avast:
While it is good that ABTA has already taken steps to not only notify the Information Commissioner and police, but also set up a helpline for people to call if they are concerned, the fact is that consumers can no longer trust companies to keep their data safe. The regular news stories hitting the headlines of data breaches is example of this. It’s important for people to take control of their data and to understand its value. My tips for staying safe online are:
- Secure any online accounts, such as banking or social media, by ensuring they aren’t sharing the same email and password combination. If you are re-using login details across multiple accounts, change them and use two-step authentication if possible, such as a password and a back-up phone number or other account.
- Be alert to suspicious activity on your accounts such as receiving any potentially fake emails. We are in peak holiday booking time and cyber scammers will be taking full advantage of this. If your data is at risk for having been compromised, you should validate these as genuine by contacting the company that sent them directly or visiting their website before taking any of the action suggested by the email.
- Finally, as you would expect, I always recommend having a good internet security product on your PC or mobile devices. Whether you use a laptop or a tablet to access your online accounts, you should always ensure you are as protected as possible against any hacks, phishing tricks or spam emails because as we have seen, we can’t rely on other people to keep us safe online.”
Kevin Cunningham, President and Founder at SailPoint:
“In today’s world, it’s a matter of when, not if, a data breach will happen. So the most important factors are prevention, education, and rapid response. When a breach does happen, it’s important to quickly find out how and why it occurred, assess the damage and required response, and put IT controls in place to address future attacks. This is where identity and access management solutions can help, because they can address the immediate pain while also identifying – and mitigating – other areas of exposure.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.