In response to the news that British Airways has launched an “urgent” investigation and notified police after hundreds of thousands of customers’ personal and financial details were stolen, IT security experts commented below.
Jake Moore, Security Specialist at ESET:
If your data is included in this breach, you’ll need to take action to protect yourself. If you find your credit or debit card has been compromised consider the following:
- Call your bank or card issuer, cancel the card and request a new card. No bank will ever mind being contacted for you being cautious.
- You’ll also want to check your card statements for suspicious activity or purchases online – in particular small amounts just in case they are testing your card before a larger transaction is placed online. It also might be worth adding extra fraud alert security on your account.
- And it goes without saying change your compassword. After any breach of such velocity, it is always a good idea to change your passwords along with the same ones used on other websites.”
Bill Evans, Senior Director at One Identity:
it is heartening to note that BA is working with those individuals whose card payment information was breached as well as working with authorities all seemingly aligned to the recently enacted GDPR regulation.
While it’s far too early to tell how this latest breach occurred, usually these types of cybercrimes are the result of poorly managed privileged accounts which are the accounts that have access to most, if not all, IT systems. Protecting these accounts is perhaps the single most important security step any organization can take followed closely by multi-factor authentication and access governance.”
Trevor Reschke, Head of Threat Intelligence at Trusted Knight:
“Anyone who transacted with the company between these dates should keep a close eye out for malicious transactions. They should also consider changing passwords for any other online services which share the same login details as their BA account.”
Rufus Grig, CTO at Maintel:
“Yet, every company is a target when it comes to cyber-attacks, and there only needs to be a single vulnerability to enable a breach. While cybercriminals will always find new ways of gaining access, there are ways to reduce risk and minimise the loss of data.
“Organisations must use robust IT systems with the latest security systems to tackle this. With the increase in IoT appliances coming onto the now ubiquitous borderless networks, the attraction for hackers to attack will continue to grow, and a priority for security teams will be to reduce the time to detect, contain and mitigate breaches. This is a key strategy given malicious actors are now very skilled in delivering multi-layered attacks using diversion techniques. The only way to go about this is applying emerging technologies like predictive analytics with techniques such as machine learning and modelling as another layer of the already complex security stack. As the saying goes, it’s always better to err on the side of caution.”
Leigh Anne Galloway, Cyber Security Resilience Lead at Positive Technologies:
“Once hackers have hold of high value data like card details, the market in criminal networks for reselling is huge, meaning that we may not see the effects of this theft immediately until a buyer acts. The best thing to do for anyone who thinks their details may have been involved, or who has been told so by BA, should keep an eye on their transactions. Consider cancelling the effected bank card and request a replacement for peace of mind.”
Richard Walters, CTO at CensorNet:
“As well as its customers, the hack will have major effects for British Airways. Shares in BA’s owner IAG are down 3.1 percent already, and the company has come under firm criticism from customers, and may be liable for the financial claims. Perhaps most significantly, this is one of the first major breaches since GDPR came into effect in May. It appears that the company notified the Information Commissioner’s Office and customers within the GDPR’s mandatory 72 hours, but the breach will now be investigated and the company could be penalised if it failed to take all the necessary measures to protect customer data.”
Stephen Gailey, Solutions Architect at Exabeam:
“They need to start asking questions. From a security perspective, no organisation will stand up and say it can’t be breached – controls to prevent a breach are inherently flawed. Monitoring has to be the answer. Companies like BA need to detect a breach not weeks or months after it happens, but before a situation like this is allowed to develop. There has been a lot of development in monitoring capabilities recently, but organisations also need to look at their operational security processes to ensure they are fit for purpose. BA clearly has some work to do on this.”
Dr Guy Bunker, SVP at Clearswift:
“The good news is that the breach was picked up relatively quickly and BA has systems in place such that they could narrow down both how it happened and who was effected. Unlike the TalkTalk incident where the numbers impacted changed on a regular basis, the BA team appear to have done their due diligence on the event quickly and efficiently. As with all mobile apps, there will be a long hard look at how the compromise could have occurred, was it the app, or was it the back-end system which lead to the compromise, or a mixture of both, with the attack purporting to be the app but being able to manipulate the requests and therefore the responses.”
Luke Brown, VP EMEA at WinMagic:
Jan van Vliet, VP & GM EMEA at Digital Guardian:
Aatish Pattni, Regional Director for UK & Ireland at Link11:
“Although it’s not yet clear exactly how the data was stolen, it’s likely the theft could have been prevented with the use of web application firewalling, which inspects and filters traffic on websites, and prevents commonly-used attacks such as SQL injection and cross-site scripting. It seems that BA may not have had this protection in place, or it wasn’t configured correctly – but the result is the largest data breach in the UK since GDPR came into effect, which could have further ramifications for BA.”
“BA customers who think they may have been affected should closely monitor their bank accounts, and also be wary of follow-up emails about the breach as scammers often prey on peoples’ concerns to try and harvest more data.”
Rachel Aldighieri, MD at DMA:
Accountability and transparency are two of the core principles of GDPR, which means British Airways has a duty to ensure their customer data is always secure. They need to show that they have done everything possible to ensure such a breach won’t happen again.
The risks go far beyond the fines regulators can issue – all be it that these could be hefty under the new GDPR regime. The long-term effects on customer trust, share price and public perception could have more lasting damage to the brand.”
Randy Abrams, Senior Security Analyst at Webroot:
In the case of Air Canada’s breach, customer’s data potentially including passport numbers and expiry date, passport country of issuance, NEXUS numbers for trusted travelers, gender, dates of birth, nationality and country of residence may have been compromised. In both cases, this is data that now may be available to cybercriminals to aggregate and correlate to build significantly comprehensive profiles.
A commonality of the breaches is that they both affected mobile app users. While no mention was made of iOS or Android, the security of mobile apps financial, especially on Android is questionable at best. Although great efforts are made to secure the mobile apps, credential theft is not uncommon. In this case, mobile access from a “trusted” device from an expected location can defeat certain types of heuristics that otherwise would have raised alarm. The wisdom of conducting financial transactions on an Android device in particular, is of question. Mobile security products can be used to help prevent malicious apps from compromising devices. If a consumer chooses to conduct financial transactions on a mobile device, the additional security is effectively mandatory.
While BA has assured the public that the affected customers will be notified, we often see the estimated number of affected individuals grow over time. It is probably best for all of the customers who booked during this time frame to talk to their banks and set up 2 factor authentication.”
Tim Mackey, Technical Evangelist at Synopsys:
“GDPR has placed us in a world where disclosure of data breaches are likely to occur before the full details of the attack are known. On the positive side, companies are highly incented to improve the level of security monitoring they perform. While to the travelling public, a two week window under which the attack wasn’t properly identified as such is alarming, the reality is that absent regulations like GDPR such incidents could go undisclosed for significantly longer. It is my hope that while we see an increase in disclosures in the near term, as organisations improve their software and system security measures a marked decline in successful attacks will ensue.”
Israel Barak, Chief Information Security Officer at Cybereason:
Ilia Kolochenko, CEO at High-Tech Bridge:
Shadow IT and legacy applications are a plague of today. Large organizations have so many intertwined websites, web services and mobile apps that they often forget about considerable part of them. On the other side, cybercriminals are very proactive, and as soon as a new vulnerability is discovered in a popular CMS they start exploiting it in the wild. Obviously, abandoned systems remain unpatched for years and serve a perfect prey to the attackers.
Web applications are the Achilles’ heel of modern companies and organizations. Lawmakers make their lives even more complicated, as for example with GDPR, many organizations had to temporarily give up their practical cybersecurity and concentrate all their efforts on paper-based compliance. New cybersecurity regulations may do more harm than benefit for the society if improperly imposed or implemented.”
Tim Erlin, Vice President of Product Management and Strategy at Tripwire:
The opinions expressed in this article belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.