Information security is all about protecting data, because at the end of the day, stolen data is what makes the cyber criminals rich. Criminals started with the basics. Monetizing stolen credit card (CC) information was easy. You just needed the basic CC information and a few personal details to make a purchase with a stolen card. We saw this in 2014—the year of the retail breach—as cyber criminals stole millions of CC records through point-of-sale systems.
Prediction video link: https://youtu.be/eATe_am6A6E
However, as fraud systems got better, making false CC purchases became harder and today stolen CC information is barely worth the effort to steal it. Meanwhile, the personally identifying information (PII) required to steal a full identity has become much more valuable. PII value in the underground directly increases in relation to how many individual pieces of data you have in a corresponding set. As you can imagine: a name, email, address, CC, date of birth, and social security number (SSN) is much more valuable than just a name and email address. That’s why CCs may only fetch 50 cents to a dollar on the underground, while a full set PII (which the underground calls a fullz) can bring in 10 to 20 dollars, especially since it includes a SSN. That’s also why healthcare records are so valuable—they’re rich in PII data and include SSNs. In 2015, we saw many attacks targeting healthcare data.
So what’s even better than a healthcare record? Apparently, student records! We are learning that the amount of data collected about our kids over their lifetime as a student is staggering. It even includes some of their health records to boot, which is already one of the richest PII datasets. This, combined with the more open network environment found in educational facilities is why we expect cyber criminals to target student data systems in 2016.
If you run IT for an educational facility, look out for hackers next year.
Visit our WatchGuard security predictions site
— Corey Nachreiner, CISSP (@SecAdept)
Leave a Reply