medicare fraud

$60 Billion A Year Medicare Fraud and How Two Factor Authentication Can Increase Medicare Security

Medicare fraud is a huge problem in the United States. It is estimated that it costs taxpayers more than $60 billion each year. Some experts believe the number is higher Read More »

safer internet day

Safer Internet Day and how Two Factor Authentication Can Make It Safer

Today, February 7th, 2012 is officially Safer Internet Day (SID). Safer Internet Day is a global campaign that promotes a safer and healthier internet for everyone to use. It is Read More »

password failure

Are Password Failures at the Forefront of Data Privacy and Protection?

As the battle between “good and evil” wages forth bills like SOPA and PIPA along with government regulations seem to be big news. Also on the frontier of data privacy Read More »

ufc hacked security breach

UFC.com’s Security Breach, Hackers Release Personal Information of UFC’s President Dana White

On Sunday, January 22nd, UFC.com was hacked.  UFC.com was rerouted to the site UGnazi.com several times.  Dana White, the UFC’s president, called the site’s organizers terrorists at the “UFC on Read More »

hacked-online-trading

Hackers Make Unauthorized Trades in Online Brokering Accounts

In recent news, some clients of online stockbrokers in Australia have had their accounts compromised and they have been advised to change their user passwords.  Investigations are currently being conducted Read More »

zappos-data-breach

Zappos.com Hacked: How Data Breaches Affect Us

The latest big ecommerce site to be victim of a cyber attack was Zappos.com by a hacker who accessed a part of the company’s internet network through one of its Read More »

amazon-multi-factor-authentication

Amazon Protects Against Fraud with Multi-Factor Authentication

Amazon.com has not only become the largest online bookstore, but is also a multinational ecommerce company. The company has been spreading its reach like branches of a river while supplying Read More »

healthcare-data-breach-security

Increasing Healthcare Data Breaches Due to Lack of Smartphone and Tablet Mobile Security

In health care, the efficiency of a physician’s workflow can be a matter of life or death. Under certain circumstances, this statement could be quite true for the most part. Read More »

remote-patient-monitoring

Strong Authentication Helps Doctors Monitor Patients through Remote Access

Doctors will be performing more house calls by computer or by phone as technology advances and as the demand for available doctors grow. This is good news if you are Read More »

two-factor-authentication-security

What is the Future of Security with Two-Factor Authentication?

What is the future of security and how are we protected from the advancing technologies of hackers and man in the middle attacks? There are believers that think two factor Read More »

Top 5 Tips Protect You This Tax Season

“In this world nothing can be said to be certain, except death and taxes,” wrote Benjamin Franklin. Unfortunately, he left out the inevitability of scammers using tax season to make a profit. Now that electronic filing is a legitimate way to file your taxes, and tax software allows preparation to be done online, cybercriminals are coming up with new ways to steal your personal information — and even your tax return. Follow these tips to stay safe this tax season.

1) Be suspicious of any electronic communication from the “IRS”

During this time of year, scammers will use a variety of old and new schemes to try to get their hands on your sensitive data. For example, they may try the classic phishing scheme of impersonating the IRS via an official-looking email or try the new “likejacking” scheme to spam your Facebook account. Some will pretend to offer a refund or request you “verify” personal information, such as social security number or account numbers. These are all deceptive means to steal your information.

Stay safe: Know that the IRS will never contact you via email or text, or request personally identifying information electronically. If you receive one of these messages, do not click on any embedded links and forward it to phishing@irs.gov. You can also call 1-800-829-1040 to verify any supposed communication.

2) Only use legitimate tax preparation software

As tax preparation programs become more popular, they are also becoming a popular way for hackers to deploy malware and siphon data. They may advertise this fraudulent software through “discounted” or free downloads. These programs are often phony and are actually a ruse to deploy malware that infects your computer.

Stay safe: To avoid falling victim to this malicious software, only purchase well-reviewed, legitimate versions of tax preparation software directly from the manufacturer. Also beware of any phishing scams claiming to be communications from these tax preparation software companies.

3) Only get forms from the IRS

During tax season, many filers will search for the forms they need online. Knowing this, hackers create phony websites and manipulate search rankings so that these sites show up first. When you click on these sites, they may exploit vulnerabilities in your browser to steal data. They may also encourage you to download the “forms” you’re looking for, but what you’re actually downloading is malware.

Stay safe: Only download forms from the www.irs.gov. Also make sure you’re typing the URL directly into your web browser.

4) Prep your computer before you file

If you are collecting, sorting, or storing important financial information on your computer in preparation for your taxes, your personal information could be at risk if your machine is infected with malware.

Stay safe: Make sure that your computer security suite is up-to-date. Run a scan before you start work on your taxes (including logging into bank accounts) to ensure that no malware is capturing your info as you work.

5) File securely

E-filing is a convenient way to file your taxes quickly and efficiently. But with such sensitive information being sent across the web, including your social security number and financial info, hackers are eager to intercept it.

Stay safe: Make sure your firewall and anti-virus security programs are activated and updated, and only file on a secured private network.

Stay smart, now and year-round, when conducting online searches and transactions. For more tips on staying safe this tax season, check out the IRS website.

How CISOs Boost the Bottom Line

According to a new white paper from the EC-Council, companies that employ a Chief Information Security Officer (CISO) have higher profit margins, generate more revenue and have increased productivity. This claim has been further supported by research done by SC Magazine.

“An effective CISO and well-run information security program can save a company almost 10% of total revenue… This saving in gross revenue is accredited to a decreased risk of data loss and theft.”

Top 10 Ways to Lead a High-Performing Information Security Program” outlines how CISOs can help lead their companies to a more productive and profitable future by developing and implementing a high-performing information security (IS) program.

“Simply put, CISOs contribute to better business results by ensuring security measures are fully implemented, standardizing and automating procedures, and by taking a strategic role with the organization to make information security a part of a business process.” Affirms Jim Hurley, managing director of Symantec’s IT Policy Compliance Group.

The list was developed on the basis of a panel discussion at the EC-Council CISO Executive Summit held in December 2011. The list outlines ways to lead an effective program and how to avoid getting caught up with corporate issues that distract teams from carrying out their strategic functions.

Download the white paper here.

Businesses Poorly Protecting Data

According to the results of the Trustwave 2012 Global Security Report, nearly 89% of breaches they investigated involved attempts at obtaining personally identifiable information (PII) such as credit card information or other customer data.

The report, based on 300 data breach investigations and 2,000 penetration tests performed worldwide last year by its own SpiderLabs, shows that cybercrime is changing and that some industries and data types are more at risk than others.

According to their data, the food & beverage industry accounted for the largest number of data breach investigations (44% of the 300 investigations) and that industries with franchise models were particularly at risk.

The report draws particular attention to the issue of passwords and how poor password practices are leading to unnecessary data breaches. According to their analysis of more than 2 million business passwords, the most common password used globally by businesses is “Password1″, which satisfies basic precautions of having a capital letter and a number within the password. Many companies are also failing to revoke temporary administrative accounts, leaving a way ‘in’ to the network using ‘valid’ credentials.

“An abundance of networks and systems were still found vulnerable to legacy attack vectors; many of these vectors date back 10 years or more,” Trustwave said. “Organizations are implementing new technology without decommissioning older, flawed infrastructure.”

In terms of detecting data breaches, only 16% of victimized organizations detected the breach on their own; in other cases, the breach was brought forward by a regulatory agency, law enforcement or the public. The average time after a breach but before detection was 173.5 days – a long time for data to be unsecured.

Verizon Reports Data Breach Count Rises While Records Breached Falls

2011 verizon data breach protection

With the number of data breaches on the rise why are the amount of records stolen dropping?
Verizon recently released a report called the 2011 Data Breach Investigations Report (DBIR) in which it combines caseload information with the United States Secret Service. Although the number of records breached has dropped from a record high of 361 million in 2008 to 144 million in 2009 and even lower to only 4 million in 2010 the fact is that the total number of breaches occurring is rising. This could mean that smaller businesses are being targeted through different vulnerabilities than recent years.

Criminals Behind Bars Cause Others to Hide
Some would say that because many criminals were recently placed behind bars, including 1200 suspects arrested in ’10, we are much safer. While others, mainly those involved in security, are thinking the reduction in records stolen is a combination of higher security but mainly a greater desire to remain out of jail. Many large scale cyber criminals have recently been placed behind bars, including Albert Gonzalez and Maksym Yastremskiy who were responsible for the 2010 payment card data breaches. With these spectacles of the law being known by hackers everywhere it may be that criminals are laying low.

Rather than targeting the higher risk companies who have more security and investigative power, cyber criminals seem to be targeting low hanging fruit. The statistics from Verizon’s report show organizations with 11 to 100 employees have been breached more in 2010 than other company sizes. Approximately 436 breaches took place in this size bracket compared to the 323 breaches that took place in all other employee size brackets combined. This is most likely due to the fact that the level of security utilized by these institutions is much less extensive than that of larger corporations.

External Threats and Remote Access Security
It is great to know that employees and competitors are not the direct cause for data breaches. However with 98% of breaches originating from organized criminal groups and unaffiliated persons it is plain to see that remote access security is a dilemma. The top 4 types of attacks resulted from hacking and malware. Although mobile devices have been seen as the source of evil lately in essence it is the server that has been the target. This is not to say that mobile devices will not haunt our future security woes as they may soon become the target of cyber thieves.

In order to secure our privacy the problem lies in authenticating remote users. Anyone accessing the server should be an authorized user to prevent further deployment of malware. Furthermore with hackers creating programs for less skilled script kiddies to easily maneuver through security the need for remote access security will rise. These attacks that we have recently seen may just be groundwork that is being made for later attacks. By utilizing information from data breaches a hacker could create easy to use programs in which they can control many unskilled attackers from many locations to pull off a much larger breach of records.

By utilizing a two-factor authentication method to identify user’s many hacking attempts would be thwarted. However in order to completely secure remote access the need for out-of-band authentication from a one-time password is rising greatly. With over 50% of breaches resulting from malware an out-of-band solution allows for authentication to take place without chance of being breached malicious software.

With new reports by Verizon and other companies being released constantly we can view the change and evolution of attacks. More importantly we can see trends which may lead to future attacks and prevent data breaches through preventative security measures.

PC Software Piracy and Security Concerns

With the recent Internet-wide protests of PIPA and SOPA legislation making headlines, the issue of online piracy has sparked a controversial debate. In addition to the morality issue of pirating software, consumers should be aware of the many risks — including security risks — involved in this practice.

Software piracy is a widespread problem. In the U.S. in 2010, 20 percent of software was pirated, according to the Business Software Alliance, an organization aimed at stopping copyright infringement of software. What types of programs are consumers pirating? The Software & Information Industry Association says the software most likely to be pirated includes programs like Adobe Acrobat, Adobe PhotoShop, Intuit Turbo-Tax, and Adobe DreamWeaver, among others. The 2010 value of this illegal software was nearly $59 billion, costing the software industry plenty of money. But not so advertised is the potential cost to those who illegally download.

Though pirating may seem like a cheap and easy alternative to purchasing licensed software, there are more risks from pirating than many realize. In addition to the legal and financial ramifications (the BSA says those found guilty of using or creating pirated software can be fined up to $250,000 or face a maximum prison sentence of seven years), consumers also risk their computer security.

Pirated software is unsafe. Unlicensed software that harbors particularly dangerous viruses and malware is often distributed by cybercriminals hoping to gain access to your information. For example, an illegal copy of a word-processing program might contain spyware that can send your credit-card information to a hacker. Or you could pirate a copy of a spreadsheet program and unknowingly activate your computer as a botnet drone. In addition, the keygens (key generators) that often come with illegal software or can be downloaded separately to activate the program are also commonly infected with malware.

Pirated programs also often cause computer-wide problems, corrupting files and disrupting function. Even worse, many of the pirated security software programs are actually decoys that cause the very problems they claim to protect against.

Using legally licensed software is the only way to properly protect your programs and computer. Developers frequently update their software, often releasing patches that protect their programs from the latest malware and keep the latest versions running smoothly. If you are using pirated software, your program and computer will remain vulnerable. Remember, too, that you might find yourself struggling to master your new software without the help of customer service that is only provided for legitimate versions.

Pirating software poses major legal, financial, and security risks to any user, and therefore should be avoided. But you should also consider the larger economic impacts. Though it may seems like a way for you to personally save money in the short-term, according to the SBA, if law enforcement agencies could reduce the amount of pirated software by 10 percent during the next four years, it would create 32,000 new jobs and generate $41 billion in economic growth — much needed in our current climate.

$60 Billion A Year Medicare Fraud and How Two Factor Authentication Can Increase Medicare Security

medicare fraud

Medicare fraud is a huge problem in the United States. It is estimated that it costs taxpayers more than $60 billion each year. Some experts believe the number is higher than that figure. These rising costs are driving up federal budget deficits that endanger our future. There is enough money in Medicare fraud that if we were to take that amount, it would be enough to pay for a healthcare reform. Medicare is a huge problem for the United States and is costing taxpayers billions each year. One way we can protect against Medicare fraud is to mandate that Medicare records be electronically stored in a central data base and then protecting that data by securing the access with technology such as two factor authentication. Two factor authentication is a secure and effective way to protect sensitive data and is also an effective way to combat Medicare fraud.

Medicare fraud has become one of the most profitable crimes in America and will continue to rise as long as criminals find ways to exploit the weaknesses in the Medicare system. Medicare fraud has become much more sophisticated and these criminals recruit patients, get patient lists, find doctors, and look for new ways to commit Medicare scams.

In locations like Florida, Medicare fraud has become bigger than the drug trade. Rather than stealing or making $100,000 to $200,000 off of drug sales, they can steal millions off of Medicare fraud. In cities like Los Angeles, the City of Angels Medical Center recruited homeless people off the street to fill their beds, offering them food and money, meanwhile billing Medicare millions of dollars for their stay.

There are even companies that provide “lists” of Medicare patients that include their name, social security numbers, addresses, and dates of birth. With those four pieces of information, a criminal can bill the government for a patient. Copies of patient information can sell for $10 per patient on the black market and it is common for fraudsters to purchase thousands of these patient lists and then bill Medicare. Many of these lists are stolen from doctor’s offices and hospitals. Many of these charges go unnoticed because Medicare auditors can only check a fraction of these charges to see if they’re legitimate claims.

The Medicare system is based on trust and when the Medicare program was introduced in the 1960’s, it was assumed that no one would try to defraud the system that was designed to take care of the elderly people’s health needs. The government is required to reimburse Medicare vendors in less than 30 days, and in most cases Medicare “auto adjudicates” which means that as long as the computers decide that the right codes are being sent and the right forms are filled out, checks are sent to the vendors. This is a huge flaw in the Medicare system and the right security measures need to be put in place to prevent this kind of fraud. The Medicare system needs to be reformed and security measures need to be put in place to prevent access to sensitive data and to prevent unauthorized users from accessing it.

Security methods such as two factor authentication are an effective way to combat unauthorized access of users trying to fraud the system. By using two factor authentication, health care workers have to present two factors of identifying themselves to access the healthcare records of patients to ensure that they are authorized to access the data and to ensure their identity. Two factor authentication methods are also fairly cheap to implement and can be a very cost efficient way of combating Medicare fraud. One of the most effective ways to implement two factor authentication and the cost effective ways is to implement two factor authentication is to use a login/password combination in conjunction with a one-time password sent through a mobile device such as a smart phone or a tablet. Using this method, a user is identified with their username/login credentials and also through their mobile device that receives a one-time password through an out of band network that ensures that they are who they say they are. This is an effective and cost efficient way to identify someone because most users already have a mobile device such as a mobile phone and adding this additional layer of security can thwart fraudulent access because even if an unauthorized user has a user’s login credentials, they would not be able to access the one time password that is being sent through the mobile device.

Two factor authentication can be easily incorporated, can be low cost and requires minimal training. If we took a fraction of the $60 billion that it costs taxpayers like you and me each year and used it to incorporate two factor authentication into Medicare security systems, we would be saving a significant amount on Medicare and preventing a lot of fraudulent activity. The Medicare system needs to be reformed and it needs to be reformed in a hurry with an importance on strengthening the security system.

Safer Internet Day and how Two Factor Authentication Can Make It Safer

safer internet day

Today, February 7th, 2012 is officially Safer Internet Day (SID). Safer Internet Day is a global campaign that promotes a safer and healthier internet for everyone to use. It is organized by Insafe and was co-founded by the European Union and encourages responsible use of the internet, online technologies and online services. Safer Internet Day spreads across Europe, Asia, Latina America, Australia, and the United States. As more and more people gain access to the internet and more generations of people are connecting online, internet security concerns are on the rise. More elderly people than ever are accessing the internet, joining social media sites, and engaging in online communities. Studies show that almost half of all under 12 year old kids are using facebook.com and other social media sites. With this broad user base and growing number of online users, online security measures need to be strengthened to keep users and their personal information safe. Most internet sites and internet logins for social media sites use strong passwords which are a combination of a login and static password. These static logins and passwords have long been considered safe, but as technology and hackers advance, online security needs to change and advance as well. Two factor authentication is a great way to increase online security and protect users.

Two factor authentication can be incorporated in any online login session and can be relatively cheap to implement. Two factor authentication is a way to authenticate based on two or more of the three types of factors to identify someone. The first factor would be something the user knows, the second factor would be something the user has, and the third factor being something the user is. Combining someone’s login, or something they know, and combining something that someone has, such as a mobile phone with a onetime password sent to it, is a very effective form and one of the most cost efficient forms of two factor authentication available today. By incorporating a device such as a mobile phone, which most users already have, there is no need for additional hardware to deploy and extra hardware for users to carry around. Two factor authentication can help users protect their personal information by helping to thwart unauthorized users from accessing their accounts.

Using two factor authentication with a login and one time password sent to a mobile device is effective because there are 2 layers of security present. The first layer would be the login and password and the second layer would be the one time password sent to the mobile device to authenticate the user. Even if an unauthorized user were to access someone’s login and password, they wouldn’t be able to retrieve the password that is sent to the mobile device.

Microsoft and AARP conducted a study that found that 83 percent of teens, young adults, parents and older adults are going online to help with family communication. With these generations of users using the internet to connect and communicate with each other, higher security needs to be adapted and used so that these users are protected. Companies such as Microsoft and Google are launching security centers online to provide assistance and guidance for users to navigate the internet more safely, but there needs to be layered security such as two factor authentication to really ensure the safety of users online. Security guides and tips are useful, but what is really protecting users from unauthorized users from trying to access their accounts? Hacking, malware, And phishing tactics have all evolved as the internet landscape has changed, but security has remained stagnant with more users going online and needing online security more than ever.

The focus on Safer Internet Day shouldn’t just be on giving guidance and tips on how to navigate the online world more safely, but should be on how organizations can incorporate online security such as two factor authentication to protect their users and how users can use two factor authentication to protect themselves from intruders trying to access their accounts. More emphasis needs to be on training and guiding users to using better security measures online to really make it a safer internet day and many days ahead for all users.

Are Password Failures at the Forefront of Data Privacy and Protection?

password failure

As the battle between “good and evil” wages forth bills like SOPA and PIPA along with government regulations seem to be big news. Also on the frontier of data privacy and protection we are seeing hacktivism through malicious attacks exposing confidential information. At the forefront of this mess it is not hard to see that password failures along with an overall lack of security knowledge are what got us here.

Government Regulatory Compliance and Bills

With data breaches becoming more common, information technology security is starting to be seen as a necessity. Government regulatory compliance such as HIPAA, FFIEC and PCI DSS is already focusing on protection of confidential financial and healthcare data which is being transmitted or accessed through a network. In these cases strong authentication is required to identify a user requesting access to confidential networks.

Recently legislation has been trying to move more to data protection matters as well. SOPA and PIPA, 2 government bills which would allow the federal government to police the internet, were shot down by the public recently. The bills would make it possible for the FBI to shut down websites which may be dealing in pirated data. However there is a gray area that exists between what is and what is not “personal data or information”.  That is why many websites, including Google and Wikipedia, protested the bill in order to protect freedom of speech. Hactivist groups also took a stand against the new legistlation with a series of DDOS attacks and possibly data breaches for later attacks.

Hacktivist Groups

Leading the data breach headlines are groups like Anonymous who participate in hacktivism to take a stand. In recent news Anonymous has claimed responsibility for shutting down the FBI and Department of Justice websites in protest to SOPA and PIPA. In the past year Anonymous and other hactivist groups like Lulz Security have been responsible for shutting down websites through DDOS attacks but more importantly for data breaches which have a longer lasting effect.

Data breaches like the Stratfor hack lead by Anonymous have leaked confidential intelligence and personal data. Coordinated with Lulz Sec, Anonymous also breached private data of over 77 million Sony Playstation Network accounts. Many of these attacks spawn from the lack of strong passwords and network security.

Passwords and Authentication

It is clear to see that data is where the power lies in the future, government wages war against hackers who are not only fighting for privacy but are the same ones leaking it confidential data. It would seem that everyone believes creating stronger passwords will prevent future data breaches however the problem lies in accountability as well.

Passwords are too easy to forget, lose, crack, hack and just do not work. That is why password failure is at the forefront of data privacy and protection. All of this along with the fact that our personal passwords are being leaked through data breaches leads to the reality that passwords, no matter how strong, are old news and not considered secure anymore. Through strong authentication however, everyone can forget their passwords, relying on the added layer of protection along with notifications to fight accountability.

Two-Factor Authentication is Strong Authentication

In order to protect against password failure we have to get rid of passwords all together. How can we do that though? Two-factor authentication through an out-of-band one-time password allows users to use almost any password because the authentication process relies on “something you have” to identify a user. An OTP is sent to a separate network than the original point of access, usually through SMS text message since the network is out-of-band, cost effective and efficient. By utilizing a mobile phone you also gain notification whenever someone requests access to the account.

The new frontier of data privacy and protection relies on authenticated access for remote users. Not only does this prevent from data breach but it allows users to leave passwords behind. Placing accountability back into the hands of security.

PSA: Keep your software up to date (an ode to Apple Security Update 2012-001)

Apple released its first big OS X update of 2012 this week, and it’s pretty big. It’s easier than ever to keep your computer up-to-date these days, but it never hurts to review good habits, especially when it comes to keeping your computer and data secure.By far, the largest number of compromises of home computer systems is through vulnerabilities that the victims could have avoided if they only kept their systems up to date. If you want to see the numbers, take a look at Microsoft Security Intelligence Report volume 11 (PDF). While that report is specific to Microsoft Windows, the lesson applies across operating systems.This is why I am reminding all Mac users of Lion (OS X 10.7) and Snow Leopard (OS X 10.6) to update their systems by using Software Update. For Lion, the security updates come as part of the update from 10.7.2 to 10.7.3. On Snow Leopard, it is a separate security update that does not change the version number. If you are still using OS X 10.5 (Leopard), please understand that Apple is no longer providing any updates, including security updates for it.There are a large number of security fixes in the latest (February 1, 2012) updates, Security Update 2012-001. None of the fixed security issues directly affect 1Password or Knox, but as always, it is better to keep your system secure through regular software updates.

Automatic Operating System updates

On both the Mac and Windows you can set your system to check for updates automatically. On the Mac, just go to Apple Menu > System Preferences > Software Update and use the “Scheduled Check” tab.

On Windows 7, just go to Start > Control Panel > System and Security > Windows Update and then “Change settings” in the sidebar at the left. Note that the layout is slightly different depending on the version of Windows.

Keeping 1Password up to date

Naturally, you should also be keeping 1Password and its components up to date. If you are using the Mac App Store version of 1Password, then the App Store application will keep track of this for you. Just keep an eye out for a red badge on the App Store icon in your Dock or open the store every now and then and check the Updates tab.If you got 1Password from our website, just go to 1Password > Preferences > Updates and make sure that you have things set to automatically check for updates.

Keeping the 1Password extension up to date

Back in the old days (before June 2011), the 1Password browser extensions came directly with the 1Password application. If we needed to make a change to, say, the Firefox extension we needed to release a new version of 1Password. Now, for all supported browsers on the Mac and for Safari and Chrome on Windows, we have a new spiffy browser extension. This extension is automatically updated through the each browsers’ extension management system so you don’t have to lift a finger!This allows us to update the extension much more rapidly than we update the main application. It is also why the Safari upgrade to 5.1.3 that comes with yesterday’s Lion update and the release of Firefox 10 a few days ago do not require new versions of 1Password to be released.Each browser does things a bit differently, so I won’t review their individual update processes here. Instead, take a look at our dedicated guide with step by step instructions for installing and updating the 1Password browser extension.

Make the computer do the work

Keeping software up to date used to be a chore, but more developers and more systems are working diligently to make it easier. Things like the Mac App Store along with automatic checking for updates within operating systems and individual apps lets you pass most of the work to your computer. After all, computers should be the ones performing the tedious chores. You do still need to supervise the computer in this task to make sure it gets done, though.It’s hardly anything new or insightful to say that keeping your system up to date is one of the best things you can do for your security, but that doesn’t make it any less true.

UFC.com’s Security Breach, Hackers Release Personal Information of UFC’s President Dana White

ufc hacked security breach

On Sunday, January 22nd, UFC.com was hacked.  UFC.com was rerouted to the site UGnazi.com several times.  Dana White, the UFC’s president, called the site’s organizers terrorists at the “UFC on Fox 2” press conference.  The hacking of UFC.com is said to be the result of Dana White and the company’s support of SOPA and PIPA.  The SOPA and PIPA bills are aimed at stopping online piracy.

The attack was also reported to be because of retaliation for the shutdown of the file sharing website Megaupload.com.

Dana White did not tweet about the incident as he usually does about any incident related to UFC.com.  Dana White taunted the hackers to attack the site again saying reportedly, “Keep hacking our site, do it again. Do it tonight.”  The hacker that took credit for the hacking didn’t hack the site again, but posted Dana White’s personal information, including social security number, residential addresses, a vehicle identification number and personal phone number in reaction to the taunt.

The hacker is now reportedly targeting Dana White.  Dana White responded by saying that he’s not afraid of the internet and that it’s where the cowards live.

The hacking attacks might have been prevented if the UFC’s servers were protected by layered security such as two factor authentication.  If the servers were protected with two factor authentication, the network administrator could have been alerted that the site was being hacked and the hacker would have a much harder time gaining access to the site and redirecting it to another site.

Big organizations such as the UFC.com aren’t immune to attacks and they should take precautionary measures to protect themselves against these types of attacks.  Two factor authentication is relatively cheap to implement compared to other security solutions, easy to use, and is a very effective way to thwart hacking attacks.  If the UFC can incorporate layered security into their servers and access controls, they have a better chance at protecting against future attacks and securing their servers.  If the UFC were as aggressive on implementing security methods on their site as they are with their marketing, they would be a much more secure company with a much more secure website.

The hacking of UFC.com should have been addressed more seriously because a hacking incident like this should not be taken lightly.  Dana White and the UFC should acknowledge the hacking incident and also ensure fans of the website and organization that the site is easy to use since there are users that login to the site for updates and news.  Tickets are also purchased through UFC.com for events and users need to feel safe that their payment information and personal information will not be hacked and that the UFC.com is a secure site.  We will find out if the UFC will address the issue more seriously and if they will be hacked again.  Mixed Martial Arts is a popular sport and the UFC has a strong hold on the sport so fans will probably continue to log onto the site, but the UFC needs to be doing a better job at securing their website and servers so that hacking incidents don’t occur again and so that sensitive data of their users will be safe.