ICO issues data protection guidance for SMEs
71712
It's just run of the mill business Small companies should try to answer data protection queries in the normal course of business rather than treat them as formal requests, according to advice published by the Information Commissioner's Office (ICO).â¦
563884
(InfoWorld) - Thereâs a common nightmare haunting CISOs (computer information security officers) that features a glance at the morning paper, and 72-point banner headlines with the name of their employer and the words âLOSTâ and âCUSTOMER DATA.â Thereâs no question about it: protecting customer and employee data is one of the thorniest problems facing enterprises today. Last week, Oracle took a swing at solving that problem, announcing the Identity Governance Framework, an initiative to develop specifications for sharing identity data across heterogeneous applications. The project has the support of identity and access management (IAM) vendors Ping Identity, Sun Microsystems, and Securent, as well as CA and Novell, according to Amit Jasuja, vice president of product development for Oracleâs security and identity management products. Problems such as lost data on laptops and identity theft point to the need for overarching standards that govern all the sensitive data squirreled away in data repositories across an enterprise, such as human resources, customer relationship management and custom-built internal applications, he said. IGF addresses that problem by establishing a governance model that allows organizations to create âcontractsâ between applications and repositories of identity data. The model would cover how data flows within an enterprise and outside the enterprise to supply chain or business partners, he said. Because the framework came together quickly, the real value of IGG will be determined in the coming weeks and months, as Oracle and its partners work to develop the specifications and transfer them to a standards group such as OASIS or the Liberty Alliance to manage, Bowen said. âItâs a good first step. It will get us closer to the goal line,â said Don Bowen, director of identity integration at Sun. âWill it get us into the end zone? I donât know.â
21824
Software giant hopes to convince governments that its products are secure.
157181
Dear Sir, you personal data has been made public... The European Commission has published proposals for a law change that would force telecoms firms to notify regulators and customers of all breaches of their data security.â¦
198946
AIG this week launched a new insurance policy that offers small and medium businesses protection from the costs involved in complying with data disclosure laws in the event of a breach.
754482
Vendors tout their efforts to improve security in BI tools and spreadsheets as they look to meet growing user demand for tools that limit access to confidential data.
450369
(InfoWorld) - The creation of aÂ pan-European systemÂ to notify small and medium-size businesses of IT security threats came a step closer Tuesday, as security experts from industry and academia refined plans for the European Information Sharing and Alert System (EISAS) at a conference in Berlin. The conference attendees, from 27 European Union countries, are considering how best to distribute information about new threats across the European Union, said Ulf Bergstrom, press officer for the European Network and Information Security Agency (ENISA), the E.U.'s computer security agency. An interim feasibility study published on Tuesday outlines several proposals for the system. One proposal calls for a multilingual portal that collects and publishes security information from member countries. Another idea under consideration would have individual countries collecting security information and publishing it in their own language on Web sites, then feeding that information to other countries. Further specifics on exactly how those scenarios would work are under discussion, Bergstrom said. Bergstrom said the focus is on keeping the information accessible as possible for end users and also in their own native language. Funding issues, including cost of translation, are also being discussed, he said. The delegates' input will be included in a final feasibility study, due for release later this month, Bergstrom said. That study will be forwarded to the European Commission, which will give its opinion before passing the report around September or October to the European Parliament and European Council for consideration, Bergstrom said.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
638915
The Trusted Computing Group has announced a draft specification to protect sensitive data on storage devices.
742881
Company cites breech of policy requiring use of encryption software when sensitive information is downloaded.
164007
(InfoWorld) - Experts gathered for the ongoing InfoWorld Enterprise Data Protection Forum in New York today said that companies need to get a better handle on all the factors that make their sensitive information susceptible to attack and become more proactive with their overall defensive strategies if they are to improve on their current security status. In a panel presentation featuring leading security executives and consultants, experts highlighted a need for businesses to study all the elements that contribute to classifying their most valuable information as truly sensitive. Protecting records whose value is immediately apparent -- such as social security and credit card numbers -- isn't enough as companies must also shroud any related data that can be used to create an individual profile that could be used to carry out identity theft or other forms of fraud, the speakers said. By defending all the contextual data that can be used to create such a picture, enterprises can greatly reduce their risk and move beyond more obvious strategizing, said C. Warren Axelrod, chief privacy officer at financial services giant U.S. Trust. "What's interesting in financial services is that it is the combination of data that becomes valuable information when it comes together to create an identity," Axelrod said. "If you are just going to file away social security numbers with no way to tie them to identity, they're actually pretty innocuous; but even if you just have a way to associate that information to a phone number or other data, someone can put things together." Axelrod said for the record that "data protection is a contradiction in terms," and that the process will never be perfected, based on the nature of IT systems and the need for businesses to easy retain access to important information.Â  The only way to effectively improve data security is to create a governance hierarchy that allows IT workers to better classify all types of information and to elevate protection of anything that can be used to create an individual portrait, he said. IT consultants agreed, saying that they are advising their customers to use contextual data to help carry out their regulatory compliance projects with greater efficacy. "It's the context that data is used in that qualifies it for regulatory oversight," said Peter Robinson, senior manager for financial services information security at BearingPoint. "You have to protect both the data and all this other information." Perhaps the biggest challenge facing enterprises today in improving their overall data security strategy is becoming more proactive about trying to expect attempted misuse or theft of information, and putting more intelligent tools in place to defend themselves before those situations arise, said Pamela Fusco, chief security strategist at consultancy FishNet. Fusco, who chaired the panel, is also a former chief security officer at financial services bellwether Citigroup. "We don't write a law unless something happens first, as with seat belt laws. We write regulations because something happens, but those are reactive," Fusco said. "Most consultants feel as if we're in reactive versus proactive mode for data protection and integrity." Regulations like the Sarbanes-Oxley Act have proven less effective than legislators might have initially hoped they would be at improving overall data security because businesses have focused on meeting the terms of the guidelines versus boosting their overarching protection schemes, Fusco and other panelists agreed. However, some industry-driven security requirements, such as the PCI (payment card industry) standard forwarded by credit card issuers, have had the desired effect, experts said. Well-written guidelines can help make the difficult task of convincing senior executives to increase their IT security budgets easier, alleviating one of the most significant challenges of the entire data protection process, according to Steve Peltzman, chief information officer at the Museum of Modern Art in New York. "We had to spend a lot of time and money on [PCI], but now I'm thankful for it because I don't have to go through the same routine of convincing everyone that this effort is important," Peltzman said. "The credit card companies got together and made it more expensive for us not to deal with [data protection], which is a good example of industry coming together to create a standard that's actually good." In a seemingly-rare occurrence, the security experts agreed that the creation of an additional, worldwide data protection standard -- as proposed to the assembled group by FishNet's Fusco -- could prove useful in furthering their efforts to secure attention and funding for their data protection strategies. For global companies in particular, establishing such a global guideline could be effective, they said. "The international difference in data protection priorities is an issue. If it could be resolved to where we could get universal classification and more people building innovative solutions, that could be a big benefit," said Erich Mueller, security analyst for Allstate Insurance. BearingPoint's Robinson agreed that such a standard could provide much needed support for security pros. "Anything that can advance the understanding and foster the culture of security in the executive suite is a positive. We've all been trying to do things like this for ourselves for years," Robinson said. "A standard that can help shorten the education cycle and get us where we need to be is something that I would support."
98493
Tells gov: think before you act The Information Commissioner has published some advice for government bodies that want to share information but think data protection laws prevent them from doing so.â¦
159360
A proposed law would require companies to keep detailed data about peopleâs Internet and phone use that goes beyond a European Union directive.
603618
Company's upgrades will put a particular focus on protecting personal information from online thieves.
734957
Europe&#39;s top data protection officials are working to clarify a grey area of Internet law: the legal status of an IP address.
165990
BARCELONA--The director of technology for RSA Security said businesses need to move their online customers toward a federated identity policy or security threats could bring people to lose confidence in trading.
387210
(InfoWorld) - Technologies aimed at bolstering enterprise data protection remain tough to manage, but companies can derive significant benefits if they utilize the tools with a pragmatic approach, said security industry experts. A recurring theme among the consultants, technology makers, and customers gathered for the InfoWorld Enterprise Data Protection Forum being held in New York today was that the first step businesses looking to improve their information defenses must take is to locate and evaluate all of their truly vital records. Beyond that assessment process, having the ability to centralize efforts to drive data protection tools and strategies across their entire organizations is a key to their success, the experts said. From encryption technologies to DLP (data leakage prevention) systems, companies are faced with a range of alternatives for addressing their information management and security needs. Finding the right way to apply the various tools is one of the most crucial issues for most companies today in making headway with their data protection projects, industry watchers observed. "Unified management is the key; if you look at how you manage this process, you must have a top-down view into operations," said Phillip Dunkelberger, chief executive at encryption specialists PGP. "Most enterprises are trying to solve these problems with point solutions, but that's like playing whack-a-mole; you must look at this issue universally from protecting laptops to archiving and tape backup as well as in managing your custom applications." As external threats continue to evolve and businesses are presented with new security concerns like smaller, more powerful removable storage drives, IT security teams must try to adopt technologies that will allow them to take a more centralized approach, compared to individual point products, Dunkelberger maintains. The PGP executive unsurprisingly expressed his belief that the careful application of encryption technologies across an enterprise, among other tools, can provide just the type of top-down, metered approach he recommends. Installing and supporting all the various pieces needed to improve data protection remains one of the most challenging tasks for enterprises to handle, he said. "Operations teams have to make these systems work, and work cost effectively -- they need to know who to report to if there is a breach and how to respond to it," said Dunkelberger. "If you think about the future, there is a need to be more transparent to gain customers and at the same time protect their information; there's a need to shift thinking and methodology," said the CEO. "We can't do the same work over and over again. We need to take the opportunity to look at new technologies and sit down with our business partners to advance a plan." Other experts speaking at the conference said that enterprises are finally realizing that they can no longer focus on perimeter defenses alone to protect their sensitive information and that customers are getting a grip on the notion of defending data assets and intellectual capital versus merely attempting to better lock-down their networks. Gerrit Nel, global data security solutions and services development manager at IBM's Global Technology Services group, said that companies should focus on employing endpoint-based technologies that can handle DLP and other security policies. "It's better to return to the approach of addressing things at the endpoint and then building protections back into the network," said Nel. "Companies need to start looking at the value of the entire data chain; there's a need to get rid of the user aspect of data governance and inform people what they can and cannot do. Endpoints can be multi-user and data can be saved on removable devices, and there's a need for solutions to protect and encrypt data there as a result of those factors." While many enterprise customers already complain that they have too many endpoint-based technologies in place that create management complexity issues, companies should reconsider what they have installed and look to apply newer tools that offer the same type of centralized management espoused by PGP's Dunkelberger, Nel said. Another emerging concern for managing data protection is the emergence of SOA strategies within many areas of enterprise IT, said the expert. Having the ability to push governance policies across those systems will be one key to allowing for the benefits of SOA in the future without creating new security hazards, Nel said. "Many of the solutions we see today are based on SOA-type architecture and exploit Web services, so we recommend that when looking at solutions companies ensure that they can integrate those applications with their existing business applications and feed their policies in," he said. "Look for vendors that can really help solve these problems and not just point solutions aimed at addressing one part of the process."
489451
DSCI founded to counter privacy criticism An IT industry trade body is setting up a data privacy watchdog in India. The Data Security Council of India will not have legal powers, but will certify companies' data security.â¦