Sony PlayStation Network compromised

A week after shutting down its PlayStation Network (PSN), Sony has finally come clean and admitted that its 70 million users’ personal information has been compromised – including names and addresses, dates of birth and passwords. The company is also warning that hackers could well have gained access to users’ credit card details.

“One of the most alarming aspects of this latest major breach is the time it has taken Sony to reveal the extent of the damage”, said Ross Brewer, VP and MD, international markets, LogRhythm. “Compromised user accounts were discovered as early as 17 April and PSN was closed down last Wednesday, yet it has taken seven days to warn users that they are now at increased risk of email, telephone, and postal mail scams, as well as credit card fraud.”

The PSN breach joins Epsilon, Play.com and Lush as the latest in a long line of high profile security incidents to affect end user data.
The regularity with which they occur suggests issues in distinguishing malicious from legitimate behavior – an issue highlighted recently by security minister Baroness Neville Jones when she claimed that many organizations miss security threats because they do not know enough about their own systems to understand what normal functioning looks like.

Sony will more than likely claim that the delay was due to attempts to protect customers while investigations continued, however, like many organizations today, the truth is more likely that adequate log management and forensic analysis was not employed.

This kind of protective monitoring is now essential as traditional security products are failing to prevent initial intrusions – organizations require solutions that can analyze 100 percent of logs, provide accurate correlation of events and a real insight into the root cause of incidents across IT networks.

An incident this size is sure to have significant repercussions for Sony. Relations with existing customers have been damaged and its ability to attract new ones reduced. Recent LogRhythm research found that that 66 percent of UK customers try to avoid future interactions with organizations found to have lost confidential data, while 17 percent resolve never to deal with them again.