Security: The Paranoid Survive

What’s
the price of information?

"Information is money?" Well, actually, money is information. Money
started as IOU notes for gold deposited with safe-keepers, and today’s
currency notes remain pieces of information about their value against gold
reserves. We’ve found electronic ways of handling this information, so a
credit card swiped through a slot can make a transaction happen in a bank a
thousand miles away, instantly.

If you steal the right information, you can steal money. Heard of
"salami slicing" in banking? Someone in Delhi managed to access
thousands of fellow-staff accounts, and "slice off" the paise. Rs
95,456.23 was simply rounded down, the 23 paise moved to another account–too
little for the user to notice or complain about. A few dozen such sweeps got the
perpetrator a tidy sum, and, later, a jail sentence.

Every enterprise has information that is as valuable to it as those account
details or credit card numbers are to a bank…it’s funny that so few
enterprises realize it.

Someone stole a Bombay-based magazine distributor’s subscriber database for
a foreign news weekly. The thief then sent out a single mailer to everyone on
the database: a renewal notice for the magazine, with an invoice for a year’s
subscription. How many noticed that the reply address was different from the
regular one, and that so was the "make cheque to" name, or that their
subscriptions weren’t really over? Enough subscribers sent off cheques to
cause panic and horror at the distributor’s company–when it found out.

For the first six months of VSNL’s Internet access service in 1995-96, the
passwords of senior VSNL officials, from the director (operations) down, were
simply their first names. Users had a field day using the "free"
accounts. But the real damage happened with all the mails that were sent out,
purportedly from the officials themselves. The love-bug virus strains caused
similar damage by sending out a variety of embarrassing messages to the victims’
address-books.

Information is the key: it’s all that the enterprise owns and possesses. It
is the differentiator, the foundation. Information is what you pay for when you
go to a doctor or TV mechanic. Today, enterprises have to keep that information
in networks, to stay competitive. And guard it with everything they’ve got:
from hackers, but more likely from careless or errant employees.

That’s the challenge that few enterprises in India have recognized, or
risen to meet. It’s going to be forced onto most of us in unpleasant ways.

Ask not the price of security: ask instead of the cost of a breach in your
enterprise network.