What do people who renew their driver’s licences, buy hard liquor or donate to a home for elderly and disabled veterans have in common? In New Hampshire, in the US, people who did any of those things within the past six months may have had their credit card numbers stolen because of computer security issues.
No, there hasn’t been a rash of hacker attacks or virus outbreaks. All three groups are potential victims of a single piece of malware found earlier this month on one state-owned server.
How it got there is now under investigation. Why all those different victims ended up on one server is a different problem.
According to the New Hampshire Office of Information Technology , the compromised machine was one of the state government’s smaller servers. But it was used by the Division of Motor Vehicles for processing payments by credit or debit card. And by the state Liquor Commission as a backup system for processing sales at state-owned liquor stores. And for collecting donations to support the New Hampshire Veterans Home.
It’s not hard to figure out how they got lumped together on the same box. That’s what IT consolidation is all about, isn’t it? Three separate, unrelated agencies had a similar need: processing credit card transactions. There was enough spare capacity on the DMV’s server to handle the Liquor Commission’s overflow and to pick up the small number of donations to the Veterans Home. Why buy two extra servers?
It must have seemed like a good, frugal idea at the time. It was only data, after all. On the server, why shouldn’t drinking and driving mix?
And the consolidation worked fine — as long as nothing went wrong. But with nothing separating the three sets of transactions, a single security breach turned into a three-fer.
It’s hard to fault the state IT people for their response. They knew they were stretched too thin on security, which is why they were testing an automated intrusion-detection tool. That’s how the Cain & Abel program, which can capture credit card numbers, was discovered.
And once it was found, they acted. Potential victims were notified. The FBI was called in. The infected server was carted away for forensic analysis. One IT employee was put on paid leave, although the state won’t yet say why.
What they couldn’t do was turn back the clock and do their consolidation differently so that, even if the server was breached, they’d be contacting victims from only one agency — not three.
Look, consolidation isn’t just an attractive option; it’s inevitable. IT hardware just keeps getting cheaper, and the human cost of administering it keeps going up. It makes sense to reduce the number of boxes and fill up unused capacity in our datacentres.
But it can’t be done casually or haphazardly. Maybe consolidation isn’t exactly the enemy of security, but it poses real security challenges. Simply shovelling different processes or data sets into unused server capacity means we lose the physical separation that provides an important layer of security.
Yes, it’s convenient. It’s also budget friendly. But it’s not safe.
The more we can segregate our processes — the more locked doors we can put between one running process and another — the harder it becomes for an intruder to have free access, and the easier it is to keep things secure.
In networks, we can use sub-nets to separate processes and contain problems. On servers, we can use virtualisation. That’s more complicated and expensive than just piling things in together, but it’s the kind of “defence in depth” that we need to protect customer and corporate information from saboteurs, intruders and worms.
And, in the face of IT consolidation and never-ending security threats, it’s the only way to make sure that customers who are driving, drinking or donating have a lot less in common.