Thank you,
Adam

I agree that it’s possible that the data obtained from Epsilon might have included more than just emails and names. But I’d rather not speculate until we hear more.

With respect to the increase in phishing (I refuse to add ‘spear’ to it on general principle), sure, it is handy for attackers to have more data. But here’s the thing: we know from our numbers and those of other e-mail hygiene providers that 90% of e-mail is already spam. Quite a bit of it is phishing related e-mail. What does this particular incident really add? More phishing? Perhaps. But it’s just a little more noise. And besides, I can mount a rather effective phishing attack today without Epsilon simply by crawling LinkedIn — from that I can determine the names of your colleagues, and who is likely to be in your office.

So, in conclusion, yes, the theft of this information means customers will face risks from phishing. But the marginal risk from this particular incident is so low as to be barely perceptible. It’s a pretty dangerous world already, and this doesn’t make it that much more dangerous than it was yesterday.

Dell has sent alerts to all their customers in Australia about the Epsilon breach. But other multinationals like Target and Visa say there’s no problem here (see http://www.zdnet.com.au/dell-australia-hit-by-epsilon-breach-339312812.htm).

Think about it: How do the companies know if customers in any part of the world have been affected? The information at Epsilon must have been organised or tagged in some way geographically. Therefore the attackers also know something about the location of the users in the databases that have been raided.

So already we know it’s more than name and email address. For each user, the attackers also know (a) sets of companies which do business with that user, and (b) something about the region they live in.

So my question is: what other metadata was taken? In my experience, personally identifiable metadata often escapes privacy scutiny. But it’s dynamite.

You’ll excuse me I hope for this brief comment rather than a full blog post dealing with the issue, it is Friday and all

I think that if you look at projects like Comcast’s ConstantGuard – http://security.comcast.net/constantguard/, Australia’s AISI, and even prototype work in Luxembourg and Germany, there is actually substantial effort going on globally to determine exactly what the ISPs role is in internet safety, and it is greater than zero.

I’m all for building higher walls, more secure operating systems will help us with that. But without walled gardens (and even with them) we’re still going to have things like RogueAV and their ilk – malicious software that attacks users that they themselves have willingly installed.

Prevention, Detection, Response. All of them matter, right?

Detection in these cases can take multiple forms, ISP involvement, AV software, individual websites alerting users to suspicious behavior.

Whether health certificates as described are useful I’ll have to leave for another time, but I think that we’re already seeing progress on the ISP front more than is really being widely advertised.