Banking Law

Twenty plus years ago, I had been recruited by a large law firm as a lateral hire. At my first quarterly firm dinner, I was sitting next to an especially acerbic fellow lateral hire (and, therefore, one of my favorite co-toilers at the firm) when a senior partner waltzed in wearing a navy blue blazer, pink dress shirt, red-and-green plaid pants and a paisley tie. I watched him walk across the room, booming loudly and obnoxiously every step of the way. My mate, reading the "WTF?" look on my face, turned to me and deadpanned, "The Bozo Factor: every firm's got it."

According to Ben Worthen of the Business Technology Blog, many businesses have it and it applies to IT professionals as well as to legal professionals. It's not clown-like dress and behavior that Worthen's discussing, however. it's incompetence, the kind that causes security breaches.

Hackers enjoy a reputation as computer whizzes who can break into the most sophisticated systems. They may be whizzes, but the reason for their success is that businesses rely on defenses filled with holes big enough to drive a truck through.

A new study by Verizon?s Business Risk team, which performs post-breach forensics, looked at the causes of more than 500 data-loss incidents and concluded that sloppy security procedures were partly to blame in almost every one. (The study didn?t take into account incidents where a laptop containing sensitive data was lost or stolen, because the cause of the breach is self-evident and these incidents rarely result in fraud or identity theft.) In fact, stupid mistakes are so common that forensics work is getting boring. "The most difficult thing for me and my team is that we see company after company fall victim because of the same basic flaws," Bryan Sartin, vice president of investigative response at Verizon, tells the Business Technology Blog. These include failing to update or misconfiguring systems.

What about the "professional hacker" that this blog and others have hyped for the last year ? you know, the guy who tricks employees into disclosing sensitive information, which he then uses to make off with reams of data? Turns out he isn?t that big a threat. Verizon concludes that only 17% of the attacks it investigated were committed by a highly-skilled hacker, while 54% required little or no technical skill. And only 15% of attacks committed by outsiders were targeted. More often, a hacker cast a wide net looking for any company with weak defenses.

While hackers accounted for 73% of all data breaches ? an indication of how poor defenses are ? these outsiders didn?t make off with as much data as insiders, who accounted for just 18% of breaches, and business partners ? outsourcers, consultants, call-center workers ? who accounted for 39% of breaches. (The total is more than 100% because some breaches were committed by multiple parties.) In fact, when the number of attacks and amount of data stolen are combined, business partners are the biggest threat of all.

Sartin says that in these cases, too, lax security is an issue ? a contractor saw weak defenses and treated them like an opportunity. In almost every breach he?s investigated the thief "took the path of least resistance."

I was thinking about "The Bozo Factor" recently while assisting a client in formulating vendor management policies and procedures. One of the principles that the client was adamant about building into its procedures, especially with respect to technology vendors who would have access to customer information, was that due diligence on those vendors had to be rigorous. The institution also would require that a legal review of all contracts with vendors was essential to make certain that the institution was adequately protected from the results of the vendor's negligence because, no matter how good the due diligence, "stuff happens." Although we didn't label it "The Bozo Factor," we discussed the fact that even those vendors with great reputations can suffer security breaches. Worthen's observation that "business partners" are the biggest threat when it comes to security breaches only serves to confirm the client's cautious approach.

Unfortunately, no amount of vendor due diligence will protect a bank from a truely "inside job." The fact that insiders make off with more from security breaches than outside "hackers" is no surprise. We've blogged about that "nightmare" previously, where "The Bozo Factor" involved an apparent failure to shut off access to the computer system of the business after the employees' services were terminated. Of course, even  without any apparent incompetence, "rogue employees" can breach security and even the biggest of the big boys are susceptible. Venality and greed can often trump the best security.