DNC Hack Serves As Cautionary Tale For IT Pros - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

CIO Insights & Innovation
Security & Risk Strategy
Team Building & Staffing
IT Strategy
Digital Business
Project Management
Programming Languages
Dr. Dobb's
Enterprise Applications
Operating Systems
Productivity/Collaboration Apps
Network Security
Careers & People
Threat Intelligence
IoT
Attacks & Breaches
Application Security
Cloud Security
Endpoint Security
Mobile Security
Perimeter Security
Risk Management
Operations Security
Analytics
Vulnerabilities & Threats
Security & Risk Strategy
Infrastructure as a Service
Platform as a Service
Software as a Service
Cloud Storage
Data Centers
Mobile Applications
Mobile Devices
Mobile Business
Enterprise Mobility Management
AI/Machine Learning
Big Data Analytics
Hardware/Architectures
Software Platforms
IoT
Networking
Wireless Infrastructure
Data Centers
Cloud Infrastructure
Careers and Certifications
Network Security
Government
Healthcare
Wall Street & Technology
Bank Systems & Technology
Insurance & Technology
Industries
Government
Healthcare
Wall Street & Technology
Bank Systems & Technology
Insurance & Technology
IT Life
Careers
Mobile
Mobile Applications
Mobile Devices
Mobile Business
Enterprise Mobility Management
Software
Enterprise Applications
Operating Systems
Productivity/Collaboration Apps
Comments
DNC Hack Serves As Cautionary Tale For IT Pros
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
TerryB
100%
0%
TerryB,
 User Rank: Ninja
8/1/2016 | 12:33:00 PM
Re: Who Hacked the DNC?
@Faye, do you know for sure if it was Exchange? Like you, I'm always perturbed about how little info you ever see on a hack. 

Unless they phished an admin level password, and then were able to breach firewall to gain server access, not sure how they gained access to all emails. We use Lotus Notes, that's what it would take to do that here. Knowing my email password would only get you my emails. And Notes has no web browser admin, you need a Notes client with access to server. If you had Notes admin account with access to all mail files, then this hack would be possible. But I have little experience wih Exchange, curious how that would differ?
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Author
8/1/2016 | 7:23:03 AM
Re: Hack 'n sack knack
@Faye: You're very welcome!

Personally, I usually prefer new comments first, but sometimes I prefer to go into threaded view to follow particular conversations.
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Author
8/1/2016 | 7:21:53 AM
Re: email matters
@Michelle: Additionally, even without that actively anti-IT but still laissez-faire culture, if someone does cross the IT line and then something bad happens (e.g., keeping proprietary business information on a personal device -- which then becomes lost, stolen, or otherwise compromised), the employee in many organizations is placed between a rock and a hard place: the employee could report the incident and risk getting in trouble, or the employee could say nothing -- putting the business at risk.

The answer, again, though, comes down to culture -- as I observed here: enterprisenetworkingplanet.com/netsysm/minimize-shadow-it-damage-by-encouraging-self-reporting.html
Faye___Kane
50%
50%
Faye___Kane,
 User Rank: Strategist
8/1/2016 | 12:58:23 AM
Re: Hack 'n sack knack
@joe

thank you!  ♥
Joe Stanganelli
100%
0%
Joe Stanganelli,
 User Rank: Author
7/31/2016 | 9:15:13 PM
Re: Hack 'n sack knack
@Faye: Newest comments first is the default, but you can get threaded view.  At the top of the comments section page, you have the option to click Newest First, Oldest First, or Threaded View.
Michelle
50%
50%
Michelle,
 User Rank: Ninja
7/30/2016 | 5:14:06 PM
Re: email matters
@Joe agreed. I've seen the same thing happen in places I've worked. A culture of IT vs everyone else develops and nobody is happy. 
Faye___Kane
100%
0%
Faye___Kane,
 User Rank: Strategist
7/30/2016 | 5:01:38 PM
Re: Who Hacked the DNC?
@jastroff

> "Who did it? Local? The Russians? "

Microsoft did it, with Exchange.
Faye___Kane
100%
0%
Faye___Kane,
 User Rank: Strategist
7/30/2016 | 4:53:12 PM
Re: Breeches and Delusions of Security
@joe

> "when Sony sued that kid -- a hacker -- for IP infringement just for tinkering with his PlayStation, they absolutely should have expected to get slammed the way they did for months by hacktivists."

Tell that to the smug, arrogant, stupid, finger-pointing suits.

Sony will do the exact same thing next time.
Faye___Kane
100%
0%
Faye___Kane,
 User Rank: Strategist
7/30/2016 | 4:43:05 PM
Hack 'n sack knack
[ How come these comments aren't threaded? This is a reply to a post by @michelle on page 2 ]

> "So often, email is taken for granted and secured with weak or shared passwords"

True, yeah, but they didn't just acquire a user pw with a phish. They obtained cleartext access to the entire email DB.

Sure, that could mean a weak admin pw, in which case, someone should be spanked. But it sounds more like non-updated s/w.

HOWEVER, since this was a state action approved by Putin himself, it's more likely that the russians decompiled Exchange Server long ago and found all the bugs MS gifted to us because they couldn't be bothered to delay the release cycle with rigorous programming and code auditing.

The Washington Post said that the NSA has a big list of bugs that can crack Windows, but they'd rather let other countries find them than tell MS. And it's just as likely MS wouldn't bother fixing them anyway (see the Google bug-report debacle a couple of years ago).

PS:

I still haven't seen a description of how they broke in. Anyone know (or a link)?
Joe Stanganelli
100%
0%
Joe Stanganelli,
 User Rank: Author
7/28/2016 | 10:42:30 AM
Re: Breeches and Delusions of Security
@Technocrati: ...Which leads to an important lesson that many security professionals don't think of: Don't be a target.

And this goes to the whole business -- not just security.  For example: A few years back, when Sony sued that kid -- a hacker -- for IP infringement just for tinkering with his PlayStation, they absolutely should have expected to get slammed the way they did for months by hacktivists.

Anticipating hacking/breach fallout is now a part of regular risk analysis for business decisions.  The CISO needs to have a seat at the table like a "big-boy" C-suiter.
<<   <   Page 2 / 3   >   >>


2020 State of DevOps Report
2020 State of DevOps Report
Download this report today to learn more about the key tools and technologies being utilized, and how organizations deal with the cultural and process changes that DevOps brings. The report also examines the barriers organizations face, as well as the rewards from DevOps including faster application delivery, higher quality products, and quicker recovery from errors in production.
Download Now!
Editors' Choice
Commentary
Gartner Forecast Sees 7.3% Shrinkage in IT Spending for 2020
Joao-Pierre S. Ruth, Senior Writer,  7/15/2020
Slideshows
10 Ways AI Is Transforming Enterprise Software
Cynthia Harvey, Freelance Journalist, InformationWeek,  7/13/2020
Commentary
IT Career Paths You May Not Have Considered
Lisa Morgan, Freelance Writer,  6/30/2020
Register for InformationWeek Newsletters
Video
Current Issue
Special Report: Why Performance Testing is Crucial Today
This special report will help enterprises determine what they should expect from performance testing solutions and how to put them to work most efficiently. Get it today!
Download This Issue!
White Papers
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll