Are marketers responsible for Shellshock customer privacy breaches? [@SmartInsights alert]

New security vulnerability potentially “bigger than Heartbleed” - are you prepared?

Importance: [rating=3]

Recommended link: Register summary of security vulnerability

We wouldn’t typically report security vulnerabilities to our readers since they are more relevant for an IT audience to act on, but after the Heartbleed security bug from April 2014, many mainstream news outlets are reporting this, so you may well be asked about what you’re doing about it to protect customer data!

Remember that Heartbleed was linked to personal data breaches at Community Health Systems, a US hospital group that manages more than 200 hospitals, Canada’s tax agency, UK parenting website Mumsnet and the developers of Call of Duty...

What is Shellshock?

Shellshock is a vulnerability to systems within the ‘bash’ shell processor which runs on different versions of UNIX/Linux. Since Apple OS X uses a derivative of this it could cause developers using this to allow access via a hijack attempt to a server containing customer records.

What is the risk?

The risk is such that some are saying that the risk is higher than Heartbleed. However, the vulnerability is only recently discovered, so no known exploits have occurred and Apple and the other Unix providers like Red Hat have already readied patches.

The Register reports that the UK Information Commissioners Office, as the public custodian of personal data, has acted quickly and is advising users to apply any available updates to defend against Shellshock as soon as practically possible.

An ICO spokesperson said:

“This flaw could be allowing criminals to access personal data held on computers or other devices. For businesses, that should be ringing real alarm bells, because they have legal obligations to keep personal information secure.

The worst thing would be to think this issue sounds too complicated – businesses need to be aware of this flaw and need to be monitoring what they can do to address it. Ignoring the problem could leave them open to a serious data breach and ultimately, enforcement action."

However, availability of patches doesn’t mean that they are applied and the implications of the ICO advise is that “ignorance isn’t an excuse”. Businesses should be asking their developers and agencies that they are covered.