Lessons From the South Carolina Breach

The governor of South Carolina, after the big breach, is claiming that “nothing could have been done to block the attacks.” She then cites the “holes in the system” and says that the state followed “best practices.”

Not so fast.

Interestingly, Deloitte just released a new survey that may help shed light on why the breach occurred. Several interesting data points all seem to congregate gem on p 23:

The survey “shows that the majority of states continue to conduct internal and external system penetration testing on an ad-hoc basis only. In fact, the number that test on a quarterly basis has fallen slightly since 2010.”

Figure 17 shows that application security vulnerability scans take place on an ad hoc basis 62% of the time.

A pull out explains how North Carolina (!) has implemented a rigorous application vulnerability program.

Couple the above with our SQL injection rant from yesterday and you have a strong idea of how and why this breach took place and that something could have been done to stop it.

Contact us for a free Cloud Web Application Firewall (WAF) Trial

Worried about Web application attacks? Need to meet PCI #6.6 compliance? Request a trial of our cloud-based Web Application Firewall (WAF) service. Imperva Cloud WAF is an easy, affordable way to protect Web applications from dangerous attacks like SQL injection, XSS, botnet attacks, and search engine blacklisting.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of the author. Readers may copy and redistribute blog postings on other blogs, or otherwise for private, non-commercial or journalistic purposes. This content may not be used for any other purposes in any other formats or media. The content on this blog is provided "as-is". The author shall not be liable for any damages whatsoever arising out of the content or use of this blog.
%d bloggers like this: