A DBA at American Express in Phoenix used his access to steal credit card numbers and PINs, encoded the card numbers onto blank cards, and used them to make purchases.
AMEX was hit by a long-standing database security management problem – how do you log the DBA’s activities, when the logs are stored in tables the DBA can modify? The technical term for what is needed in this instance is “non-repudiation,” the simplified, plain English meaning of which is that the logs can not be modified after they have been written by the entity that is being logged.
There are specific technical Database Security and Logging controls that QuietMove can help to put in place which will detect, prevent, and alert to this kind of insider threat. Call QuietMove at 1(866)894-0459 for a free consultation.
Police discovered during their investigation that Curley had not only worked as a computer database analyst for American Express, he was one of the few who “could have possibly downloaded all of their account holders information, including the PIN numbers used to access money from ATM machines at various banks,” according to court records. Curley had recently been released from that job.
Investigators learned the laptop computer Curley had at the airport belonged to American Express. Curley had reported it stolen out of his truck last August.
and
When investigators searched Curley’s home, they turned up laminators, card readers, pin pads and more than 20 computers, according to search warrants. Detectives also said they confiscated crack pipes and what officers believed was methamphetamine.
Michael Thomas, of Phoenix, was also arrested.
Police said he too had more than 100 bogus gift cards and credit cards that had been re-encoded with information from valid American Express customers. Investigators also wrote they have surveillance video of Thomas using the bogus cards at ATMs.
See the original news article at http://www.kpho.com/money/19936013/detail.html
Did you enjoy this article? Please subscribe to our our RSS feed or Security Alerts email list.
Comments on this entry are closed.