Payroll Services Firm ADP Investigates Online Breach

Outsourcing firm Automatic Data Processing Inc. on Wednesday reported a data breach in its benefits-administration business, the latest of a series of cyberattacks in recent months that have cast a spotlight on the vulnerability of online data.
ADP said it believes the breach affected a single client at Workscape, a provider of payroll, human-resources and benefits services that ADP acquired last year. The system where the breach occurred is part of a platform no longer being sold by ADP’s benefits-administration business, the company said.

ADP, based in Roseland, N.J., didn’t disclose the identity of the client or when the breach was identified. It said the intrusion was being investigated by law enforcement.

ADP didn’t say what sort of data may have been revealed as a result of the intrusion, which was detected during “routine system monitoring.” A spokesman didn’t return requests for comment.

“Protecting ADP clients and their data from malicious activity has been, and always will be, a top priority for ADP,” a company statement said.

When the Workscape acquisition closed last August, ADP said Workscape’s client base included “numerous Fortune 250 companies” and that its services spanned more than 180 countries. Workscape says its services help employers improve how they tie compensation to performance.
ADP’s disclosure makes the 62-year-old company, which says it pays one in every six U.S. employees and moved more than $1.1 trillion in client funds within the U.S. last fiscal year, the latest corporate giant to acknowledge a security breach that may have revealed sensitive data to hackers.

Citigroup Inc. said last week that a security attack affected about 200,000 customers and that it would send replacement credit cards to a majority of those affected. Sony Corp. reported an attack in April that compromised more than 100 million user accounts. And RSA Security, the EMC Corp. unit that makes the SecurID tokens that allow corporate workers to securely log on to their computers, acknowledged last week that intruders had breached its security systems at defense contractor Lockheed Martin Corp.

“It feels like the year of the hack,” said Jay Heiser, a cybersecurity analyst at information technology research firm Gartner.
ADP shares were off 1%, or $1.02, at $51.66 in 4 p.m. Nasdaq Stock Market trading amidst a broad market downturn. The stock has risen 12% since the start of the year, better than the market at large.

In 2007, ADP said it had been the victim of hackers who attacked a third-party information system that ADP used to hold client information. The information was then used to target the company’s clients with fake and harmful emails that appeared to come from an ADP address. The information compromised in the attack included names, addresses and email addresses, but not social security numbers, passwords or bank accounts, ADP said at the time.

By Tim Mullaney, Special for USA TODAY

Distractions caused by social media, e-mail and badly designed office technology may cost a 1,000-worker company more than $10 million a year, a survey says.

The survey of 515 white-collar workers by software company Harmon.ie and polling researchers uSamp depicts a workplace culture trying to balance work, manners and family demands, says William Powers, author of the 2010 book Hamlet’s BlackBerry.

The familiar picture of managers checking e-mails in meetings is only part of a picture where workers report they leave their devices on during church, movies or even sex, he says. “This technology is supposed to bring us together, but it makes us rude,” Powers says. “It’s a wake-up call to be smarter about the devices we’re on.”

The study concluded:

•More than half of U.S. workers waste an hour or more a day on interruptions: 60% come from electronic devices and e-mails, while the other 40% come from traditional sources, such as phone calls or chats with colleagues.

•45% of workers say they can’t go more than 15 minutes, on average, without an interruption. The average worker wastes 2.5 hours a week looking for documents missing in poorly organized electronic files.

•Only 68% of people always turn their phones off at the movies. Almost two-thirds will tune out of meetings to read e-mails, tweet or take mobile phone calls. Half leave devices on at least sometimes when they go to bed.

“The issue isn’t whether you’re working, it’s whether you lose your focus when something pops up on your screen,” says David Lavenda, a vice president at Harmon.ie, based in Milpitas, Calif. Distractions cost businesses $10,790 a year per worker, the study finds.

Those conclusions are similar to other studies, Powers says. None has conclusively said whether businesses lose more from staffers distracted at work than they gain when people use devices to work after normal business hours, he says.

Companies such as Intel have experimented with tactics to persuade workers to use technology less and keep themselves fresh, Powers says. But tricks such as no-e-mail Fridays haven’t helped, he says.

“We really have managers captured 24/7,” says Mike Brezner, uSamp senior vice president. “We’re all tethered — wirelessly tethered.”

Learn More Here

By David E Sanger

Almost most two years after outlining a broad strategy intended to strengthen the security of the nation’s computers and networks, the Obama administration said Thursday that it was sending proposed legislation to Congress that would strengthen penalties for any invasion of private computer systems.

But the White House, in a briefing for reporters, said it had elected not to seek authority for stringent top-down regulations that would require companies to erect specific barriers to computer intrusions — which corporations feared would be enormously costly and soon be outdated.

Instead, the administration is hoping to offer incentives that will persuade private industry to improve computer security voluntarily and have those standards reviewed by the Department of Homeland Security.

“The private sector has a huge incentive to secure its own systems and an incentive to do that work better by sharing that information more broadly,” said Gregory T. Nojeim, senior counsel for the Center for Democracy and Technology, a policy group here.

The administration made no mention of seeking authority for the president to hit a “kill switch” that would essentially shut off access to the Internet in the event of a national emergency or a broad-based computer attack meant to shut down financial markets or power plants.

But administration officials said the Department of Homeland Security would designate certain privately run computer systems as part of a “critical infrastructure” over which the department would have enhanced authority.

While the proposed legislation will address new American defenses against computer crime, it does not appear to deal with a growing cyberoffense capability in the American intelligence agencies and in the military. Billions are being spent on building weapons for attacking computer networks — in part to deter cyberattacks on the United States. While those programs are highly classified, the United States is believed to have played a major role in the software-based attacks on Iran’s nuclear program, and recently Iran announced the creation of a cyberforce of its own.

The international component of the strategy will be addressed on Monday, according to several policy specialists, who have been invited to a White House briefing with John O. Brennan, the deputy national security adviser.

The White House said it would release proposed language for the new legislation on Thursday evening, and the text of different sections of the proposal were placed online by Senator Harry Reid of Nevada, the majority leader, during the day.

By increasing and clarifying the penalties for computer crimes, and giving the homeland security agency a clear mandate for the protection of the government’s own networks, the administration hopes to reverse a growing perception that the penalties for attacks on government, corporate and personal computers have been comparatively trivial.

Just in the past few months, companies including the EMC Corporation and Sony have experienced major breaches of security. In some cases, the digital identity information for millions of customers has been stolen.

In addition to giving the Department of Homeland Security new authority over federal computer systems, the proposed legislation calls for the agency to work with energy companies, water suppliers and financial institutions to rank the most serious threats and find ways to counter them. The new law would require each business to have an independent commercial auditor assess its plans, and, in the case of financial firms, report those plans to the Security and Exchange Commission.

A senior homeland security official, who declined to be identified during a telephone news briefing on Thursday under ground rules set by the administration, said the administration had shied away from a stronger regulatory approach because it believed “it did not have all the answers.”

“Nor do we believe that it’s appropriate for the government to say, ‘Thou shall do X, Y and Z’, ” he said.

Privacy groups said that the administration’s proposals did not appear to put in place strict enough controls to protect personal information against potential government surveillance.

“There should be legal standards, not voluntary guidelines,” said Marc Rotenberg, director of the Electronic Privacy Information Center, a Washington policy group.

Six major bills addressing computer security have been introduced in the past two years and the administration must now work to get Congress to adopt its language. On Thursday, members of Congress welcomed the administration’s draft while saying that it did not cover as much ground as legislation that has already been proposed.

“I commend the president for sending us a package of cyberinitiatives,” said Senator Kirsten E. Gillibrand, Democrat of New York “This is a good step forward, but we must also address the growing international cyberthreat.”

By Mark Cox

Hot off the presses, a new survey conducted during Interop Las Vegas 2011 has found that while nearly 70 percent of respondents have deployed or plan to deploy cloud computing, but nearly as many admit to not having confidence in the strategy for managing the performance of those cloud computing resources.

Of those 70 percent, more than half are looking at private (33 percent) or public (25 percent) clouds while only a few are currently looking at hybrid clouds. The survey, conducted by IT operations and cloud management solutions provider ScienceLogic Inc., polled 150 attendees.

Cloud computing is becoming ubiquitous in the enterprise, as more businesses rely on benefits such as better agility, offloading network traffic, cutting costs and better utilization of resources. That’s confirmed by the survey results that only 14 percent of respondents are not planning to deploy resources in the cloud. Analyst firm Gartner estimates the cloud market to reach $150 billion by 2013. However, as highlighted by the recent April outage of Amazon’s popular cloud service, there are many reasons why enterprises and IT managers are concerned about the cloud, especially if resources are not properly managed.

“Cloud computing is growing fast and has become pervasive, but most businesses have great difficulty managing it along with their virtual and physical on-premises resources,” said David Link, CEO of ScienceLogic, in statement. “It’s in vogue in some circles to downplay the need for IT operations with the advent of public cloud services, but few mid-to-large size organizations are relying exclusively on public clouds. Underestimating the need for IT operations can be a critical mistake. It has never been more important to have centralized, dynamic management of IT service delivery across distributed computing resources no matter where they reside.”

Having an accurate view of business service delivery across data centers and public, private and hybrid clouds can alleviate unnecessary downtime and performance issues. Such insight is made possible by on-premises tools and through metrics offered by the cloud service provider. According to the survey, almost 60 percent of businesses plan to use one or both to measure the performance of cloud services. However, more than one-third of respondents are not sure how they will measure cloud performance and more than 70 percent either have no confidence in their current solutions or have not selected one. Interestingly, the majority of attendee respondents agree that their existing IT operations staff will manage cloud performance rather than adding new staff with cloud skills.

Not having insight into the performance of applications running in the cloud, and who is using cloud computing resources, can negatively impact service delivery and operating costs. Also according to the survey, 68 percent of respondents are concerned about unauthorized use of compute resources by business units or application developers. These concerns are mostly related to security and bandwidth.

Cloud has been at the forefront of every IT discussion in 2011 and will continue to be due to the potential system optimization and cost savings that are associated with it. However, industry-wide motivation and business impact behind cloud implementation remains unclear.

To better understand the top end-user business requirements for cloud computing and determine how companies are measuring ROI, The Open Group surveyed cloud specialists at global organizations ranging in size from fewer than 200 to more than 5,000 employees. The survey was carried out online between February and March, 2011. The Open Group today announced the results of its inaugural Cloud Computing Survey. The study, which surveyed 307 IT professionals with purchasing or decision making influence related to cloud computing, examines the business impact of cloud computing on organizations.

“The ability to transform business is the most exciting feature of the cloud phenomenon,” said Chris Harding, SOA Work Group and Cloud Work Group forum director at The Open Group, in a statement. “The survey shows that users recognize that cloud computing will impact their business processes, but that they are not yet prepared to handle that impact or, in many cases, even to measure it.”

The survey identified the following key findings:

C-level executives control cloud buying decisions - Over half of buying decisions required CEO and CIO level approval; 23 percent and 32 percent, respectively. IT directors accounted for 22 percent, while enterprise architects held just seven percent of buying power.