*********************************
There is now a CONTENT FREEZE for Mercury while we switch to a new platform. It began on Friday, March 10 at 6pm and will end on Wednesday, March 15 at noon. No new content can be created during this time, but all material in the system as of the beginning of the freeze will be migrated to the new platform, including users and groups. Functionally the new site is identical to the old one. webteam@gatech.edu
*********************************
Atlanta, GA | Posted: April 8, 2011
Nick Feamster, assistant professor at Georgia Tech's College of Computing and researcher at the Georgia Tech Information Security Center offers his expertise on the Epsilon data breach and what users and custodians can do to protect their data.
The Epsilon data leak incident was serious, as it exposed a large number of people to an attack called "spear phishing,” whereby an attacker targets specific users or organizations with attempts to steal personal information. However, it is also important to realize that this incident could have been much worse. Many third-party organizations, ranging from identity management companies and large cloud service providers, like Google, have aggregated large amounts of our personal information in one place, making us increasingly vulnerable to the type of attack we saw with Epsilon, whereby a single breach can result in the compromise of a large amount of user data.
There are two big lessons we should take away from this incident. First, we must raise our own awareness about where our data is stored and become more cognizant of how we might be making ourselves vulnerable to these types of incidents by allowing data about us to be aggregated in just a few places. Second, we need better security tools: software will remain vulnerable, and compromise is inevitable.
Although this may be one of the largest data leaks we have seen in U.S. history, this is not the first instance of a very serious data leak. In the past, we have seen data leaks involving the breach of more sensitive information, including credit card numbers and even Social Security numbers. Facing the stark reality that these compromises are likely to continue and worsen, we must develop better tools for prevention (i.e., making it difficult for attackers to access data once they have compromised a system) and auditing (i.e., figuring out exactly what data has been breached, when, and by whom).
Here are some quick tips on what users can do to minimize the damage that a data breach can have on them.
In addition to things that users can do, there is also a serious need for more extensive protection against data leaks in the enterprise space. Software will continue to be vulnerable, and there will be users who will inevitably not take these recommendations. We do need better mechanisms to provide safeguards against these types of breaches in the event that a compromise does occur.
This is an active area of research in my group here at the Georgia Tech Information Security Center where we are developing various technologies to combat data leak threats.
