The breach that didn't happen
Posted by Prat Moghe on Sun, Jun 29, 2008
Often enterprises think of monitoring tools as a way of providing visibility into breaches that might be happening under their noses.This use is like a “whistle-blower or early warning system that alerts you to risks. There is however another value proposition around monitoring tools which is as critical but often gets overlooked. It is what I call the use of monitoring for breach-validation or breach-verification or correctly for verification of lack of breach. Monitoring tools can actually quantify or substantiate a data breach in terms of how many data records or systems were compromised. This can help separate minor incidents from major devastating incidents.
Here is a recent case in point. The Best Western hotel chain incident is in the news. Apparently the The Sunday Herald reported that August 21 , "a previously unknown Indian hacker successfully breached the IT defenses of the Best Western Hotel group's online booking system and sold details of how to access it through an underground network operated by the Russian mafia.
The report claims that records of every customer to have booked a room at one of the Best Western's 1,312 continental hotels since 2007 -- 8 million -- were taken. The Best Western hotel chain has responded by accusing the paper of being sensationalistic. It counts a mere 13 records that may have been exposed as a result of "suspicious activity." In a public statement, Best Western questioned the Sunday Herald's story, saying that it "is grossly unsubstantiated" and that the paper's claims about its customer records "are not accurate."
"We have found no evidence to support the sensational claims ultimately made by the reporter and newspaper," the statement says. "Most importantly, whereas the reporter asserted the recent compromise of data for past guests from as far back as 2007, Best Western purges all online reservations promptly upon guest departure."
In an e-mail, a Best Western spokesperson said,"There was one instance of suspicious activity at a single hotel with respect to 13 guests, who are being notified. We are working with the FBI and international authorities to investigate the source of the other claims, which were never presented to us for investigation prior to publication of the Herald story. We have found no suspicious activity to support them."
A data activity monitoring (DAM) system or a DLP system with audit logs could very well have validated this breach (or its absence).