The eight most common IT vulnerabilities that have resulted in data breaches have been revealed by the Information Commissioner’s Office.
The flaws were identified during investigations by the ICO, which is responsible for upholding the information rights of UK citizens, into organisations that had failed to keep people’s information secure due to poor IT security practices – in many cases leading to serious security breaches that resulted in the regulator issuing monetary penalties totalling almost £1m.
These included a £200,000 penalty issued to the British Pregnancy Advice Service after details of service users were compromised due to insecure collection and storage of information on their website and a £250,000 fine for Sony Computer Entertainment Europe after details of millions of customers were compromised during a targeted attack due to a failure to keep software up to date.
According to the regulator the breaches could have been avoided if standard industry practices highlighted in a new ICO report were adopted.
“In just the past couple of months we have already seen widespread concern over the expiry of support for Microsoft XP and the uncovering of the security flaw known as Heartbleed,” said Simon Rice, group manager for Technology.
“While these security issues may seem complex, it is important that organisations of all sizes have a basic understanding of these types of threats and know what action they need to take to make sure their computer systems are keeping customers’ information secure.
“Our experiences investigating data breaches on a daily basis shows that whilst some organisations are taking IT security seriously, too many are failing at the basics. If you’re responsible for the security of your organisation’s information and you think salt is just something you put on your chips, rather than a method for protecting your passwords, then our report is for you.
“The report provides an introduction into these established industry practices that could save you the financial and reputational costs associated with a serious data breach.”
The top eight computer security vulnerabilities covered in the ICO’s report are:
- a failure to keep software security up to date
- a lack of protection from SQL injection
- the use of unnecessary services
- poor decommissioning of old software and services
- the insecure storage of passwords
- failure to encrypt online communications
- poorly designed networks processing data in inappropriate areas
- the continued use of default credentials including passwords
The full ICO report ‘Protecting personal data in online services: learning from the mistakes of others’ is available here.