Navigate to next or previous posts:

« "Rendition" or Openness? | Emergent Chaos Main page | New Security Blog »

What's Wrong With Lexis-Nexis?

(Posted by adam)

It seems that Lexis Nexis's breach was because of bad passwords:

The incidents arose from the misappropriation by third parties of IDs and passwords from legitimate customers.
I don't mean to be snide. No, that's a lie. I do. It's 2005. You're making all this data available via a password? Are your auditors telling you that's ok? E-Trade is giving RSA tokens to customers. AOL is making them available. AOL. AOL which charges $24 a month. And then an extra $9.95 one time fee for the token, and $1.95 a month for support.

That's $1.95. As the ad says, "Less than the price of a cup of Starbucks coffee."

Now, I don't know what Lexis/Nexis charges for access to their services, but sentences like "RiskWise services are priced per transaction and is determined by transaction volume, data sources, integration and custom development" tend to cause me to think it may be a little more than $24 a month. I hate using words like negligence or culpability, or maintaining an attractive nuisance, but only because my lawyer friends tell me I keep messing up their meanings, and I know how annoyed I get when they mess up things like "mixing function" or "TCP encapsulation."

Posted by adam on March 10, 2005 at 4:29 PM in information security . You can: comment, view comments (1), see trackbacks (1) or search Technorati.

Bookmark this post:

TrackBacks

Trackbacks are links generated by other blogs which have commented on this entry.

Listed below are links to weblogs that reference What's Wrong With Lexis-Nexis?:

» Lexis Nexis Breach from Thinking WiKID Thoughts
As Adam had pointed out the Lexis Nexis breach was due to " misappropriation by third parties of IDs and passwords from legitimate customers". With Bruce Schneier blogging that ChoicePoint is saying "Please Regulate My Industry", will their be a requwe... [Read More]

Tracked on March 10, 2005 4:58 PM

Comments

Note that a bad guy stealing a good guy's ID and PW and using it can be indistinguishable from a bad guy obtaining an ID and PW and giving it to another bad guy who then uses it.

In short, how does Lexis/Nexis know that they don't have evildoers among their customers, who simply sold or gave away their credentials? I have no reason not to believe them, but given recent history I'd like to hear more about the evidence they have which tells them these credentials were stolen.


Posted by: Chris Walsh | March 10, 2005 5:45 PM