When you hear the word outsourcing, you might think of threats to American jobs. To cyber experts, there's another threat: to our data.
This week, thousands of the industry's leading minds from around the world are discussing the Internet and security at their annual powwow in San Francisco, the RSA Conference. These topics matter more and more to us non-experts, especially as people become the victims of cybercrime.
Many of the people at this conference are talking about the underlying causes of that crime and one word keeps coming up: outsourcing.
"You get what you pay for," says Andy Ellis, chief security officer with Akamai Technologies. "If you move it to somewhere that's a lower cost, there's a reason it's lower cost ... . Sometimes it's because you aren't getting as skilled personnel."
Outsourcing isn't just for big manufacturers. Online companies are using outside vendors, too — for their websites, mobile apps and accounting. The downside isn't just a poorly made T-shirt — it's data theft with untold consequences.
While many of the cybersecurity business people at the conference disagree on the merits of outsourcing, they agree it's a big security problem. The decision to cut costs can backfire on the consumer, says Dwayne Melancon, chief technology officer at Tripwire, an IT security firm.
"You provide information to a company and all of a sudden it gets compromised because of a weak link to a third-party contractor," he says. "It's your problem. It's not the company's problems."
In the recent payment card breach at Target, hackers reportedly used stolen credentials from an air-conditioning company that was working for the giant retailer.
We need to pay more attention to this trend, says Chris Coleman, a security analyst with Lookingglass Cyber Solutions. Coleman audited about 20 subcontractors that big banks hire. He found something startling.
"A hundred percent of third parties showed signs of compromise or indicators of threats," Coleman says. Was that a surprising percentage?
"No," Coleman says. "Our global cyber landscape is a scary place."
While weak links are everywhere, Coleman saw one that stood out with the foreign servicers. Many of them used computers infected with an old worm called Conficker. It's curable and not harmful in itself, but it's also a signal for criminals looking for weak entry points.
"It was more predominantly coming out of networks that were in the foreign markets," he says. "The U.K. for sure, India and Southeast Asia."
However, when John Stewart, chief security officer at Cisco, travels to China, people there want to know how he's protecting their information from high-risk Americans.
"It really depends on where you're sitting, what you think the risk is," he says.
There's a lot of data security distrust, especially after the recent revelations about domestic spying by the National Security Agency. But Stewart notes that the U.S. is better at building trust in one key respect: It have laws that require companies to tell police about breaches.
He remembers participating in a panel in another country where someone said that all the data theft is coming from the U.S. Stewart pushed back.
"How do you know we're creating the problems?" Stewart said he asked the man. "We're the only ones transparently telling you that we created the problems."
Stewart says if everyone shared details on data breaches the way they shared the data itself, cyberspace would be a lot less scary.
Copyright 2014 KQED
