Security Vendor Breaches: Fallout Justified

Kaspersky Lab and F-Secure were up-front in acknowledging recent hacks against them, but the negative fallout is still justified

Attendees at last week's ShmooCon security conference were transfixed when news broke that a hacker breached part of Kaspersky Lab's US support site by exploiting a flaw in the site's programming.

Looking around the conference hall in Washington DC, I could see large groups of people staring at the news on their mobile phones and expressing a variety of opinions.

The incident was small compared to security breaches suffered by the likes of TJX and Heartland Payment Systems. But it was a big deal to the security practitioners at the conference because Kaspersky is a security vendor, entrusted by its customers to keep this sort of thing from happening to them.

Confidence in security vendors was shaken further when F-Secure admitted days later that its site had been the victim of an SQL injection attack.

Both vendors deserve credit for their candor.

Kaspersky Senior Research Engineer Roel Schouwenberg put it bluntly: "This is not good for any company, and especially a company dealing with security," he said. "This should not have happened, and we are now doing everything within our power to do the forensics on this case and to prevent this from ever happening again."

David Frazer, director of technology services for F-Secure's North American division, admitted it's embarrassing when a security company suffers a breach, no matter the size.

The honesty is appreciated, but they should be embarrassed.

When security is your company's business, even the smallest breach is worthy of scorn. If you can't keep the bad guys out of your own database, how can customers reasonably expect that you'll keep theirs safe?

Of course, no company is 100 percent immune from attack, even the security vendors. The key is for the vendor to be up front about that reality when the customer signs on from the outset.

Kaspersky and F-Secure have solid reputations in the industry and will get through this. The hope is that other security vendors take careful study of what happened and plan accordingly.

That means doing a double take at their own internal security, and being honest with customers that like everyone else, they too are at risk.

Join the newsletter!

Error: Please check your email address.
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

Tags Breach Securitykaspersky labsf-secure

More about F-SecureKasperskyKaspersky

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Bill Brenner

Latest Videos

More videos

Blog Posts