In the "wow, that sounds bad" category, the University of Florida announced on November 12 that on October 3, they discovered that 333,000 unencrypted records for patients at the college of dentistry had been potentially accessed by unauthorized individuals. To make matters worse, the breach itself was caused when malware was remotely installed on the University's system. To make matters even worse, the malware was only discovered during a server upgrade (rather than, say, because the University's system detected and prevented installation of the malware). So, to recap, the facts (as set forth in this article from Computer World) are: (1) more than a quarter million records exposed; (2) notification takes more than a month after discovery; (3) records were patient records; (4) that were kept unencrypted; (5) on a system which was vulnerable to remote installation of malware; and (6) no automated security systems detected the remotely installed software.
Now, as it happens, I've presented the facts in such a way as to accentuate the negative, and I've done so to make a point: you aren't as protected as you think. While I don't know all the facts about this breach, simply from the facts I do know, it's not clear that any laws were broken either before or after the breach took place (other than the remote installation of the malware, of course). The HIPAA security standard regarding encryption (45 CFR 164.312(a)(2)(iv)) states that encryption of data is an addressable standard, not a required one. Similarly, Florida's security breach notification act gives a 45 day period for when notice can take place, so the month+ delay in this case could be (and, according to a spokesman, actually is) within Florida's law. Of course, even if there had been flagrant violations of both HIPAA and Florida's notification law, that wouldn't make much difference to the individuals whose information was exposed. Neither HIPAA nor Florida's law provides for a private right of action.
The bottom line? Laws relating to privacy and information security aren't as comprehensive or as effective as consumers may think. If people really want legal protection for their personal information, they should work to get new laws passed, not simply rely on the laws on the books. Otherwise, they could be in for a sad surprise when and if they try to go to court for redress when their own information is exposed.
Showing posts with label data security breach. Show all posts
Showing posts with label data security breach. Show all posts
Sunday, November 16, 2008
Sunday, April 13, 2008
Jail Time for CEOs?
According to this article from Computer World,
To me this seems like a terrible idea. CEOs and corporate board members are not expected to be intimately involved with their company's IT. Indeed, in a well functioning company, a CEO will be aware of the company at a much higher level, and so won't know the facts "on the ground" which lead to a data security incident. Imagine how that would change if CEOs went to prison for data breaches. Instead of being generalists, they'd become micro-managers - and the companies they're responsible for would suffer as a result.
Obviously, my thought is that CEOs should not be sent to prison for information security breaches. Prison, at least in the context of the business world, is an extreme punishment, and it should be reserved for extreme situations such as actual fraud, or wrongdoing leading to loss of life. For the simple negligence (or even bad luck to be the victim of a determined hacker) behind most information security incidents, prison not only has the potential to create perverse incentives to micro-manage, but is also wildly disproportionate to the "wrongdoing" of the CEOs who would be put away.
[a] growing number of security pros believe that the way to stop data breaches from happening is simple as it is stark -- send the CEOs or board members deemed responsible to jail.
To me this seems like a terrible idea. CEOs and corporate board members are not expected to be intimately involved with their company's IT. Indeed, in a well functioning company, a CEO will be aware of the company at a much higher level, and so won't know the facts "on the ground" which lead to a data security incident. Imagine how that would change if CEOs went to prison for data breaches. Instead of being generalists, they'd become micro-managers - and the companies they're responsible for would suffer as a result.
Obviously, my thought is that CEOs should not be sent to prison for information security breaches. Prison, at least in the context of the business world, is an extreme punishment, and it should be reserved for extreme situations such as actual fraud, or wrongdoing leading to loss of life. For the simple negligence (or even bad luck to be the victim of a determined hacker) behind most information security incidents, prison not only has the potential to create perverse incentives to micro-manage, but is also wildly disproportionate to the "wrongdoing" of the CEOs who would be put away.
Sunday, February 3, 2008
My Own Personal Data Exposure
Well, last week I got a message from the Georgetown Information Security Office. Apparently, a hard drive was stolen which contained information from students enrolled between 1998 and 2006, as well as some faculty and staff. The message said that no credit card information or other financial data was exposed, but that personally identifiable information of some students (and faculty and staff) was stored on the hard drive. We were reassured that there was no evidence that any of the information had been misused, but were cautioned to place a fraud alert on our credit reporting accounts just in case.
For me, the advice to place a fraud alert was a bit late, since I've had credit monitoring ever since someone (not me) opened a bank account in my name almost a year ago. Of course, I could do more (like place a freeze on my account), but, frankly, my risks are low enough that I don't see any need to it. Of course, there are still two things I'm curious about:
1) Why was the data stored on a hard drive that could be easily stolen (I'm guessing on a laptop)?
2) Why wasn't it encrypted (of course, the message didn't say it was unencrypted, but if it had been, you can bet that would have been mentioned)?
You'd think that in this day and age, an organization the size of Georgetown wouldn't store sensitive data on easily stealable hard drives, and would keep it encrypted as a matter of course.
For me, the advice to place a fraud alert was a bit late, since I've had credit monitoring ever since someone (not me) opened a bank account in my name almost a year ago. Of course, I could do more (like place a freeze on my account), but, frankly, my risks are low enough that I don't see any need to it. Of course, there are still two things I'm curious about:
1) Why was the data stored on a hard drive that could be easily stolen (I'm guessing on a laptop)?
2) Why wasn't it encrypted (of course, the message didn't say it was unencrypted, but if it had been, you can bet that would have been mentioned)?
You'd think that in this day and age, an organization the size of Georgetown wouldn't store sensitive data on easily stealable hard drives, and would keep it encrypted as a matter of course.
Saturday, December 1, 2007
Study Finds Costs of Data Security Breaches Rising
2007 has not been a good year for consumer data security, if one measures by the size and number of records compromised by data security breaches that have occurred this year. Data security breaches have affected millions of consumers around the globe. Large scale breaches grabbed the headlines, beginning in January, 2007 with the theft of the personal information of 45 million customers of the retailer TJX, and culminating with the loss of personal records of 25 million national insurance and child benefit recipients in the UK by a government agency last month.. In between were reports of breaches at the U.S. Department of Veteran’s Affairs, the U.S. Department of Agriculture, Monster.com, the State of Ohio, and numerous colleges and universities. The Consumers Union reports that the total number of records of total number of records containing sensitive personal information involved in security breaches in the U.S. is currently 216,251,736, although this number is likely larger since in the case of many breaches, the total number of records compromised is unknown.
A recent study by the Ponemon Institute shows that data breach costs continue to rise. Ponemon Press Release In its 2007 Annual Study: Cost of a Data Breach, it found that in 2007, data breach incidents cost companies an average of $197 per compromised customer record, compared to $182 in 2006. Lost business opportunity, including customer turnover and expenditures to acquire new customers, was the most significant component of the cost increase. Other cost factors include legal, investigative and administrative expenses, reputation management, and costs related to customer support, such as credit monitoring fees and consumer hotlines. The study found that one category of expenditure had decreased from 2006, however; the cost of notification of consumers fell 40 percent, decreasing from $25 per customer in 2006 to $15 per customer in 2007. This may indicate that the data breach notification and security freeze laws enacted in more than 30 states, many of these laws became effective in 2006 and 2007, have allowed for a more certain and measured approach to notification to U.S. residents by companies than in the past.
Consumers have noticed the increase in data security breaches, and consumer confidence in the organizations with which they share their data has declined. In a separate study, the 2007 Consumer Survey on Data Security issued by Vontu and the Ponemon Institute, 62% of respondents indicated that their personal data had been stolen, and 84% of those respondents reported increased anxiety and loss of confidence resulting from the data loss events. Such a loss of trust will likely affect the consumers buying behavior. While consumers may toss the annual privacy notices received from their financial institutions, consumers do read the privacy notices on websites, and truly care about these notifications.
Companies will be wise to make note of the results of these studies. The persistent problem will continue to be how companies deal with data security. Preventing compromises in data security is the surest way to avoid the costs and issues discussed above. The study makes clear that erecting another firewall within the company isn’t the solution, since the confidential data to be protected is actually in the possession of third parties. More than a third of data breaches result from data being shared with third parties in connection with outsourcing arrangements. Companies need to look closely at how they are sharing the data with their third party service providers, what security measures they have imposed on their providers, and work with the providers to make certain the necessary data security strategy that has been agreed upon is in fact in place. Too often, the company hires a company, shifts responsibility for security of the data to be processed by the third party service provider to that party, and never gives it another thought. Requiring periodic audits and reports can help detect weaknesses in the security of the data and perhaps avoid the expense and embarrassment of a security breach.
A recent study by the Ponemon Institute shows that data breach costs continue to rise. Ponemon Press Release In its 2007 Annual Study: Cost of a Data Breach, it found that in 2007, data breach incidents cost companies an average of $197 per compromised customer record, compared to $182 in 2006. Lost business opportunity, including customer turnover and expenditures to acquire new customers, was the most significant component of the cost increase. Other cost factors include legal, investigative and administrative expenses, reputation management, and costs related to customer support, such as credit monitoring fees and consumer hotlines. The study found that one category of expenditure had decreased from 2006, however; the cost of notification of consumers fell 40 percent, decreasing from $25 per customer in 2006 to $15 per customer in 2007. This may indicate that the data breach notification and security freeze laws enacted in more than 30 states, many of these laws became effective in 2006 and 2007, have allowed for a more certain and measured approach to notification to U.S. residents by companies than in the past.
Consumers have noticed the increase in data security breaches, and consumer confidence in the organizations with which they share their data has declined. In a separate study, the 2007 Consumer Survey on Data Security issued by Vontu and the Ponemon Institute, 62% of respondents indicated that their personal data had been stolen, and 84% of those respondents reported increased anxiety and loss of confidence resulting from the data loss events. Such a loss of trust will likely affect the consumers buying behavior. While consumers may toss the annual privacy notices received from their financial institutions, consumers do read the privacy notices on websites, and truly care about these notifications.
Companies will be wise to make note of the results of these studies. The persistent problem will continue to be how companies deal with data security. Preventing compromises in data security is the surest way to avoid the costs and issues discussed above. The study makes clear that erecting another firewall within the company isn’t the solution, since the confidential data to be protected is actually in the possession of third parties. More than a third of data breaches result from data being shared with third parties in connection with outsourcing arrangements. Companies need to look closely at how they are sharing the data with their third party service providers, what security measures they have imposed on their providers, and work with the providers to make certain the necessary data security strategy that has been agreed upon is in fact in place. Too often, the company hires a company, shifts responsibility for security of the data to be processed by the third party service provider to that party, and never gives it another thought. Requiring periodic audits and reports can help detect weaknesses in the security of the data and perhaps avoid the expense and embarrassment of a security breach.
Subscribe to:
Posts (Atom)