Information Commissioner's Office
Top IT data security threats revealed and what organisations must do to stop them
The Information Commissioner’s Office (ICO) has published a new security report highlighting eight of the most common IT security vulnerabilities that have resulted in organisations failing to keep people’s information secure.
The flaws were identified during the ICO’s investigations into data breaches caused by poor IT security practices. Many of these incidents have led to serious security breaches resulting in the ICO issuing monetary penaltiestotalling almost a million pounds. The breaches could have been avoided if the standard industry practices highlighted in today’s report were adopted.
They include the £200,000 penalty issued to the British Pregnancy Advice Service after the details of service users were compromised due to the insecure collection and storage of the information on their website, and the £250,000 fine issued to Sony Computer Entertainment Europe after the company failed to keep its software up to date, leading to the details of millions of customers being compromised during a targeted attack.
Announcing the publication of today’s advice the ICO’s Group Manager for Technology, Simon Rice, said:
“In just the past couple of months we have already seen widespread concern over the expiry of support for Microsoft XP and the uncovering of the security flaw known as Heartbleed. While these security issues may seem complex, it is important that organisations of all sizes have a basic understanding of these types of threats and know what action they need to take to make sure their computer systems are keeping customers’ information secure.
“Our experiences investigating data breaches on a daily basis shows that whilst some organisations are taking IT security seriously, too many are failing at the basics. If you’re responsible for the security of your organisation’s information and you think salt is just something you put on your chips, rather than a method for protecting your passwords, then our report is for you.
“The report provides an introduction into these established industry practices that could save you the financial and reputational costs associated with a serious data breach.”
The top eight computer security vulnerabilities covered in the ICO’s report comprise:
a failure to keep software security up to date;
a lack of protection from SQL injection;
the use of unnecessary services;
poor decommissioning of old software and services;
the insecure storage of passwords;
failure to encrypt online communications;
poorly designed networks processing data in inappropriate areas; and
the continued use of default credentials including passwords.
As well as the comprehensive report, the ICO’s Simon Rice will be publishinga series of blogs this week explaining the key aspects of the ICO’s latest advice in further detail. His first blog published this morning explains the pressing need for today’s report and how it was developed (LINK).
Simon will also be taking part in a question and answer session this Friday to respond to any questions people have about today’s report. Anyone who would like to send in a question can email the details email@example.com or tweet @ICONews by 10.30am on Thursday 15 May.
Notes to Editors
1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
2. The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
4. Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:
- Fairly and lawfully processed
- Processed for limited purposes
- Adequate, relevant and not excessive
- Accurate and up to date
- Not kept for longer than is necessary
- Processed in line with your rights
- Not transferred to other countries without adequate protection
5. If you need more information, please contact the ICO press office on 0303 123 9070.
Latest News from
Information Commissioner's Office
Tribute to His Royal Highness The Duke of Edinburgh12/04/2021 14:10:00
Statement from Elizabeth Denham, Information Commissioner.
Blog: Data Protection law can help create public trust and confidence around COVID-status certification schemes29/03/2021 12:25:00
Blog posted by: Elizabeth Denham, Information Commissioner, 26 March 2021.
Secretary of State for the Department for Digital, Culture Media & Sport and the Information Commissioner sign Memorandum of Understanding on data adequacy22/03/2021 14:33:00
Having left the EU, the Secretary of State for the Department for Digital, Culture, Media and Sport now holds powers to make independent UK data adequacy arrangements with new partners around the world, making it easier for organisations to send data internationally.
Blog: Building on the data sharing code – our plans for updating our anonymisation guidance22/03/2021 11:05:00
Data is the lifeblood of the digital economy, and the sharing of personal data is key to opening up new opportunities. Data shared in healthcare environments can map out trends and provide new insights to improve patient care, while in the financial sector, data sharing can help to protect against money laundering and ensure individuals are protected from fraud.
Secretary of State for the DCMS and the Information Commissioner sign Memorandum of Understanding on Data Adequacy19/03/2021 12:07:00
Oliver Dowden, Secretary of State for the Department for Digital, Culture, Media and Sport, now holds powers to make independent UK data adequacy arrangements.
Digital Regulation Cooperation Forum publishes its first annual plan of work10/03/2021 14:15:00
The Digital Regulation Cooperation Forum (DRCF) today outlined its priorities for the coming year, marking a step-change in coordination of regulation across digital and online services.
Blog: Supporting UK democracy through data protection with new political campaigning guidance09/03/2021 12:25:00
Blog posted by: Elizabeth Denham, Information Commissioner, 09 March 2021.
ICO fines firms for sending more than 2.7 million spam text messages during the pandemic05/03/2021 15:05:00
Two separate companies that sent nuisance text messages during the Covid-19 pandemic have been fined a total of £330,000 by the Information Commissioner’s Office (ICO).