In October 2013, Adobe was breached. It was bad — really bad. Adobe lost control of an estimated 38 million customer records, including debit and credit cards. Later, the breach was described to include 150 million usernames and passwords. I blogged about the situation and talked about the fact that there was a redeeming aspect of this data breach:

The fallout could have been much worse for Adobe if the PINs for the stolen debit cards weren’t encrypted.

It was only a few months later that Target was attacked and suffered a major data breach that was even bigger and more impactful than Adobe’s. The data breach occurred between Black Friday and Dec. 15, 2013 — the height of holiday shopping — and resulted in the loss of more than 70 million debit and credit card numbers — and CVV codes. At the time, I also commented about the Target data breach in a blog post.

Because of the data breach, Target’s financial loss is estimated to be around $148 million (minus $38 million from an insurance receivable). Target missed its numbers for the second quarter in 2014, and ultimately, its chief executive officer resigned.

More recently, Home Depot, eBay and JPMorgan have been struck by data breaches. Breaches are becoming all too common and for no good reason.

How Does Encryption Help in the Case of a Data Breach?

Although the circumstances were different in each situation, the one thing we all need to observe is that any encrypted data that was stolen as part of a breach is of no value to thieves. Specifically, the debit card PINs were encrypted (as they should be). These PINs are necessary to leverage the associated information to extract funds from an ATM, although I am certain somebody is working on a way to get around that restriction. Because the PINs were encrypted, the ability to extract money was thwarted.

Also, in the case of the Adobe breach, passwords were hashed. Though hashing is different from encryption, from a thief’s perspective, the end result of properly hashing passwords is the same as if they were encrypted. The hashed passwords are not reversible and as a result are of little value to the thief.

Data Is Like Water

Data is like water — it leaks. It wants to go places and does not like being constrained or organized. It is also of no value to anybody unless it is moving and being used. We want — and need — to use our data while simultaneously preventing others from using it. To extend the analogy, the problem is no different than if you were to own a large lake in the middle of the city and you wanted to keep all other people and animals from using it unless you give them authorization. That would be challenging to say the least.

Encryption is a well-known technology that can restrict access, and its use has readily demonstrated its ability to render data useless to those who do not possess the key. This is exemplified by the uselessness of encrypted PINs and hashed passwords to cybercriminals. This is not new science or new technology; the power of cryptography to protect data is well-known and standardized.

So Why Not Encrypt Everything?

Historically, organizations offer the following excuses for why their data is not encrypted:

  • “It is too hard.”
  • “I don’t get it.”
  • “It is not in my department.”
  • “There is a hit to performance.”
  • “There is no budget.”
  • “I am too busy.”
  • “Give me time, and I will think of a reason.”

I make light of these reasons, but frankly, none of them hold water (pardon the pun). When Willie Sutton stole from a bank, he did not take only a couple of bills; he took as much as he could. Data thieves work on no less of a motive. As such, the financial loss due to a data breach will never be small, so we need to stop thinking small.

He Who Controls the Keys Controls the Data

Data is the new gold, and this is data’s golden rule: He who controls the keys controls the data. Naturally, the corollary to this is that if you aren’t encrypting your data or do not control your data encryption keys, then you don’t have control over your data.

Or, in other words, a fool and his data will soon part.

Whenever data is encrypted, it reduces the potential value of the data. When the value is reduced, the likelihood of a thief taking the data is diminished; that is called risk mitigation. I know that encrypting data has potential challenges with implementation, but we must not let those challenges stop us from protecting our gold, data, earnings or careers.

$148 Million Is a Lot of Money

It would seem that $38 million is a reasonable insurance policy, but it was not sufficient to cover the losses incurred by Target after its data breach. Target could have potentially reduced its losses by 90 percent or more by spending 10 percent of the potential loss on mitigation strategies such as improved encryption of data in transition and data at rest with supporting encryption key management.

In the coming weeks and months, we will begin to learn about the losses incurred by JPMorgan as a result of its data breach. I will be curious to learn about how much they spent to migrate its losses as compared to the amount of money it lost.

How much is your data worth? Have you asked yourself how much you are spending to protect your data in comparison to the loss you could experience in the case of a data breach? You should.

Cryptography for business is about using well-known encryption technologies and applying them to real business problems. Staggering financial losses, chief executive officer resignations and repetitive data breaches are not technical anomalies; they are business problems that are the result of lackluster quality in operational and technical controls. Mitigating data breaches through the use of encryption and key management may not address all the issues and details of these breaches, but it is definitely a step in the right direction.

More from Banking & Finance

Virtual credit card fraud: An old scam reinvented

3 min read - In today's rapidly evolving financial landscape, as banks continue to broaden their range of services and embrace innovative technologies, they find themselves at the forefront of a dual-edged sword. While these advancements promise greater convenience and accessibility for customers, they also inadvertently expose the financial industry to an ever-shifting spectrum of emerging fraud trends. This delicate balance between new offerings and security controls is a key part of the modern banking challenges. In this blog, we explore such an example.…

Cost of a data breach 2023: Financial industry impacts

3 min read - According to the IBM Cost of a Data Breach Report 2023, the global average cost of a data breach in 2023 was $4.45 million, 15% more than in 2020. In response, 51% of organizations plan to increase cybersecurity spending this year. For the financial industry, however, global statistics don’t tell the whole story. Finance firms lose approximately $5.9 million per data breach, 28% higher than the global average. In addition, evolving regulatory concerns play a role in how financial companies…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today