DIGITAL - "Cloudbleed" Leak Puts Internet Users' Information at Risk

Tavis Ormandy from Google’s Project Zero discovered a security problem with Cloudflare’s servers - a leak which has been dubbed Cloudbleed.

Cloudflare provides essential internet infrastructure and security to millions of websites.

This bug puts users information such as private messages, authentication tokens, passwords and other sensitive data at risk.

The greatest concern is that search engines were caching that leaked information and data has been vulnerable since.

As soon as Cloudflare was notified on February 17th, they disabled the features that were causing the problem and started to delete all the caches of data that may have possibly exposed personal information.

The removal has not yet been completed.

While some are comparing this leak to the devastating Heartbleed bug in 2014, the breach is not the same scale. At least not yet.

Heartbleed affected half a million websites, where as this bug has hit approximately 3,400.

It remains to be seen if more websites will be impacted but Cloudflare’s response to the breach was quick.

According to a blog post by the company:

“The industry standard time allowed to deploy a fix for a bug like this is usually three months; we were completely finished globally in under 7 hours with an initial mitigation in 47 minutes.

The bug was serious because the leaked memory could contain private information and because it had been cached by search engines. We have also not discovered any evidence of malicious exploits of the bug or other reports of its existence.” 

Officials from companies whose websites have been exposed, such as OkCupid and Uber, have reported minimal impact from the bug.

What should you do?

Keep in mind that nothing you do now will change what has already happened, but you can see if your information is at risk - check to see if sites you use are impacted.

Take this internet security scare as a reminder to change all your passwords whether you use impacted websites or not, and do this on a regular basis.

Ensure you use strong passwords and different ones for different sites.

If websites or services offer two-step verification, use it.

Cybersecurity is of vital importance, especially as digital use and mobile commerce continues to grow.

Not only are corporations responsible for taking steps to protect the personal information of their clients, users also have to remain vigilant.

BUSINESS - Mind the IT Gap

There is a gap between what businesses expect from their IT departments and CIOs, and what these departments and executives can provide.

And a wise business owner or investor will pay attention to that gap, or risk falling into it.

Deloitte recently released a global CIO survey highlighting major areas of disconnect between expectations and capabilities.

They found that CIOs can have significant positive influence on the long-term success of the company when they develop capabilities in their IT departments.

This positive influence was true regardless of the personality of the individual CIO, as long as that executive could adapt and respond to the specific needs of their team and organization.

This fits with what The Bayard Partnership has noted as the most common stumbling block for CIOs – the inability to influence either upper management or their own teams.

Deloitte’s research suggests that CIOs tend to be less relationship-oriented than other CxOs, and paired with Bayard’s finding, this indicates that CIOs need to focus on building their relationships with both management and their own teams.

However, a key recurrent finding in Deloitte’s research was that the core expectations of the businesses did not match investment and resource allocation within the business, and that’s an issue that no amount of relationship-building can solve.

For example, cybersecurity is a core expectation according to 61% of CIOs, but only 10% said that it was a top priority of the business.

This is a major issue, because without adequate cybersecurity systems, businesses and organizations are at significant risk.

Similar disconnects between expectation and capabilities exist for categories such as improving business practices, reducing costs, increasing efficiency, maintaining systems, and driving business innovation.

When the capabilities are not currently in place, the infrastructure is not being built, and the talent is not being pursued or properly cultivated, can businesses reasonably expect IT departments and CIOs to deliver? Clearly not.

Talent, like cybersecurity, is a significant issue.

For agile tech talent, demand is four times the supply, and big-data talent is similarly in high demand.

Many businesses are failing to entice or maintain their tech talent.

In some cases, such as Uber’s issues keeping industry-leading women engineers on their teams, talent is actually being driven away.

These gaps are not new.

After all, investment in long-game improvements to core business capabilities always hurt the bottom line before they help it, and a fast-moving marketplace doesn’t feel hospitable to those “short-term pain for long-term gain” choices.

And yet, as Computer Weekly states in their series on CIO development and digital innovation, “If companies are unwilling to use technology to disrupt their business, someone else will do it for them. Businesses must be truly up to date with the changes being driven by technology, and be wary of the opportunities and threats.”

Disruption is already here, and CIOs (and their organizations!) are going to have to take the plunge and make the investments that allow capabilities to catch up to expectations.

Without closing the gap in critical IT areas businesses will not be able to deploy an effective digital strategy, and without that strategy, they risk falling in.

About Tiffany Sostar

Tiffany is a published academic, an editor with the Editors Association of Canada, an independent scholar and researcher, and a self-care and narrative coach. She is particularly interested in the intersection of technology and identity - how our tools shape our selves and change our stories, and in how the nature of work is changing as we incorporate more technology into our daily lives.