Baich: Data theft problem no easy fix
549845
(InfoWorld) - Rich Baich knows about data theft. Back in 2005, Baich was where he is now: at the RSA Security Conference in San Francisco, a published author and star in the tight-knit community of information security experts. Then the roof fell in as Baich's employer, data broker ChoicePoint, revealed that it had unwittingly allowed identity thieves posing as legitimate customers to make off with the financial records of more than 163,000 consumers. For months afterward, Baich, now a Principal at consulting firm Deloitte, was forced to explain how the security lapse had happened and to defend his performance as the CISO in light of the breach. His company was ultimately forced to pay $15 million in penalties and compensation as a result of the breach in a deal with the FTC. Two years later, ChoicePoint is just one in a string of major data breaches that now includes companies like Massachusetts retailer TJX, and Baich is back at RSA with a new book, a new job, and a new perspective on the problems of companies like ChoicePoint, CardSystems, or TJX, which he sees as symptoms of a broader, societal failure to recognize the value of personal data. Chatting with InfoWorld in a hotel across from San Francisco's Moscone Center, where the RSA Conference is in full swing, Baich said that the U.S. needs a grassroots campaign to educate ordinary citizens about the need to protect their personal information. Baich, who was accompanied by an attentive press officer from Deloitte, was circumspect when asked to comment on the recent breach at TJX but said that companies need to do a better job of understanding the "lifecycle" of information within their organizations and need to develop strategies to combat data loss that are based on risk, not merely on compliance demands or technology. Asked to comment on TJX's decision to wait more than a month after disclosing the theft of credit card data from its network, Baich said that companies are often under orders from law enforcement to keep news of a breach secret while an investigation is ongoing. However, companies need to do a better job about protecting their interests -- asking law enforcement to put their request to suppress information about a breach in writing, then being honest in saying that the company held off on notifying the public at the request of law enforcement, for example. Baich, who faced stern criticism from many former supporters for suggesting that the failure of ChoicePoint to vet its customers wasn't the purview of the CISO, said he now has a more holistic view of enterprise security after working on behalf of companies for Price Waterhouse Coopers and now Deloitte. "It's allowed me to experience things differently. You can't talk about security or privacy and compliance without talking about people, policies, and processes," he said. Among other things, companies need to plan in advance for incidents like the TJX or ChoicePoint breach and create cross-disciplinary teams, including human resources, legal, information security, physical security, and law enforcement personnel, to respond to them when they occur, Baich said. "More than ever, companies are evaluated on their response by the press and by their shareholders," he said. "There's an opportunity to consolidate those into an effective, functioning team that takes a mature, holistic approach, but it requires organizational change." However, even the best-intentioned companies will continue to wrestle with breaches if the public's awareness of the threat of identity theft and data loss isn't improved. As an example, Baich cites a promotion currently going on in San Francisco by radio station KFRC 99.7 where users are asked to fax the station something with the numbers 997 in it -- including possible social security or driver's license numbers -- in order to win a prize. Baich shakes his head. "As an employer, what can you really do to prevent your employees from doing something like that?" he asks. "As a society, we have to mature from an ethical standpoint in the way we protect information," he said. But companies and public sector organizations are equally in need of schooling. As a counterpoint to the KFRC story, Baich recalls a recent hotel stay in New York City where he was asked to provide a driver's license so the hotel could make a photocopy for its records and noted a recent column in the San Francisco Chronicle about thousands of Visa applications from the Indian Consulate in San Francisco, which were sent whole to a recycling center and sat, in the open, for months before Consulate officials were notified of the problems. The documents contained detailed personal information that would be useful to identity thieves and included applications submitted by Byron Pollitt, CFO of San Francisco's The Gap, and Anne Gust, wife of California Attorney General Jerry Brown. "These are more cultural issues than technology issues," he said. "We need a grassroots campaign to raise awareness about this," he said.
298773
Researcher finds two flaws that under unusual circumstances could let a malicious program read private data or render a phone unusable.
754059
Data breaches contribute less to ID theft and fraud that most people think, according to a recent survey by Javelin Strategy & Research. Losing your checkbook or wallet is more likely to put you at risk.
27598
CIOs and security executives are desperately playing catch-up with unauthorized users of IM and P2P clients, who are sharing music files and videos on company time, and with company resources.
769408
In 1980, I signed a deal with a company to market a product I was developing. The contract required me to turn over the source code, which I did. One day I went to a meeting at the office of the company, and there on the product manager's desk, right next to a door that opened to the outside, was a floppy labeled "Dave Winer's source code" in big letters.  If you own a Mac you may soon find out what that felt like. It's amazing to me that the tech blogosphere doesn't treat Apple's policy re broken hard disks as the huge gaping security hole that it is.  Think about it. We worry about bad people getting their hands on little pieces of data that, when added together, give them the power to be you in banking and credit transactions.  Think about what you would do if your laptop was stolen. Well, if you own a Mac and its hard disk goes bad, and you make the mistake of bringing it to Apple for service, you will turn over all that data to Apple. Not "may" or "might" but "will." What Apple in turn does with that data is none of your affair. They don't sign anything or offer any guarantees that they won't sell the disk to a data miner. Think it can't happen or that it's unlikely? I don't gain much comfort from your feeling of security. I've been writing about this issue since December 22. Usually when I write something critical of Apple, the results are mixed. Some people are supportive, but far more people attack. This time the ratio is very different. Almost everyone who has commented gets that there's a huge problem here. Can we solve this problem? Of course we can.  Some say that other vendors do this too. That gives me less comfort, not more. That means there's no escaping this crazy way of treating user's confidentiality. Ultimately it hurts the vendors because people can't use their computers for things the manufacturers say we can.  Further, it's got to be an issue for the banks, brokerage firms, credit agencies. If you are a newspaper and you employ reporters and they use a computer, how exactly are you guarding the confidentiality of your sources? If you're a confidential source, don't you have an interest when the reporter gives their computer manufacturer all their data to do with as they please? Imagine what you would do if it turned out there was a bug in a Netgear or Linksys router that allowed, under special circumstances, a mailicous person to gain access to the full content of your hard disk at any time. Would you have a problem with that? This is worse than Microsoft's neglect of malware that got me to stop using their computers. In that case it was Microsoft being neglegent. This time Apple itself is the cause of the problem. It's as if they planted a virus in their operating system that entitled them, under special circumstances, completely out of the user's control, to gain access to everything on your disk, with as much time as they want, with no way for you to prevent or even detect the intrusion.  See also: My letter to Steve Jobs.
284321
Hacking tools nick nicked data Many of the people behind identity theft scams are themselves having data stolen from them in the process, a security researcher has revealed.â¦
577004
As consumers increasingly rely on digital media to secure their important documents and valuable personal content, they often fear that changes in technology may render their data inaccessible. Western Digital Corp.
729347
The U.S. Department of Veterans Affairs has made progress on data security since last May's laptop theft, but still needs to address a variety of shortcomings, government auditors say.
343718
Reports of data theft often conjure up images of malicious hackers breaking into remote databases to filch Social Security numbers, credit card records and other personal information.
449279
Between three and four FBI laptops are lost or stolen each month and the agency often can't say whether data on the machines is sensitive or classified, according to the DOJ. By the Associated Press.
654076
Time to call the credit bureaus? Almost 1.4 million records containing the personal information of Californians likely stolen.
163052
Robert Vamosi talks with data loss expert Dan Geer about identity theft.
62609
With viruses, worms, spyware, spam and phishing, running a computer this year -- especially one with Windows -- has often been a colossal headache. -Rob Pegoraro
483736
No one in the business world wants to be held responsible for a breach of sensitive corporate information, but gaining the level of support necessary to allow DLP (data leakage prevention) technology to work effectively remains tricky, customers and vendors confirm.Unlike traditional security technologies that have operated largely within the confines of IT departments and network management teams, DLP projects must include participation from almost every corner of the organizational chart to succeed, according to experts who have worked with the tools.From all the different business units that need access to protected information to human resources departments tasked with following up on potential violations to the highest levels of business management, the issue of data leakage is so pervasive that nearly everyone in a company needs to be involved on some level for critical content to stay under wraps.For DLP technology to have its intended effect, every employee needs to be continually educated about company policies that must be policed aggressively and attached to real consequences for violators, customers said. Simply throwing products at the problem won't work, they claim, because DLP is as much about building policies as it is about embedding IT controls."We have HIPPA considerations to uphold, we don't want to be in newspaper, and we don't want to be embarrassed in today's world for having exposed data accidentally or otherwise -- but it's not an overnight process," said Charles Hibnick, chief systems security architect at AvMed, a large HMO in Florida. "Even though we've been working with compliance regulations for years, embracing DLP is still a cultural change that demands involvement from a lot of people to work."As part of its effort to roll out its DLP program around technology provided by Palisade Systems, AvMed was forced to create a corporate steering committee that included everyone from C-level executives to its HR and compliance officials and even its external legal counsel.If a business is attempting to create a system where employees are expected to follow specific data-handling rules and be held accountable to real penalties when they have violations, all of those parties must be involved, Hibnick contends. "We in IT had to hook up with HR and compliance to make sure that our plans specifically included a review of how the DLP product would be used and ensure that they were buying into the process," he said. "Then the HR director had to communicate with our external counsel to make sure that we were within our appropriate boundaries with everything that we wanted to do and then run it all by the board."Once the plan had been established and the technology's use was approved, one of AvMed's most visible business vice presidents authored a letter to all of the company's employees informing them of the new policies and how they might be punished for multiple infractions, such as sending out sensitive data repeatedly in unencrypted e-mails.The letter was received by employees with some level of concern over "big brother" type monitoring of their work, but making its policies and penalties clear has been key to AvMed's success in keeping its data better protected, Hibnick maintains."You'll always get feedback from users, but when you have senior executives including the CIO saying this work needs to get done, you're not going to get a lot of kickback," he said. "I'd say the two most important pieces of doing this right are aligning the right team to drive it from the top down and making sure that everyone reads that letter and understands the role they play in helping us protect the data."DLP's cooperation requirement in the real world Since getting its system up-and-running and ensuring that employees knew what was happening over one year ago, the company has experienced only a dozen or so incidents that forced it to warn individual users or send reports to those workers' department heads, the IT leader said.Even vendor representatives, such as Palisade Chief Executive Kurt Shedenhelm, concede that the challenging politics of a DLP project often outweigh the technical issues that come into play when working out all the complex data-handling rules that his company's systems are employed to enforce.Some companies struggle to achieve the right level of executive buy-in to force business unit leaders to play ball, while others don't go to great enough lengths to ensure that workers have been sufficiently re-trained to understand new policies, he said. "This issue of internal politics, of who is responsible for protecting the data, who is responsible for educating the end-user, and who is ultimately responsible for enforcement, that's actually the hard part," Shedenhelm said. "In a lot of companies, I think you might find that it's hard to get the business units, HR, and IT people that need to be involved on the same page, but you can't really do DLP without that."In some companies, especially large enterprises, multiple DLP projects may only be put under the domain of IT security and compliance teams, making it harder for those groups to keep their efforts in step without overwhelming end-users.From the issues relating to which business units ultimately maintain responsibility for specific sets of data and who is tasked with enforcing policies, things can get too complex very quickly, he said. "In larger enterprises, where you often have multiple projects looking at DLP from perspectives of intellectual property, compliance, and customer data and information spanning multiple business units, that's where you run into problems," said Shedenhelm. "One of the biggest issues we see is with trouble discerning who is ultimately responsible for handling violations; sadly, in some cases, people clearly don't want to know if violations are occurring on the business side, because then they will be forced to respond."Other experts agreed that the size of an organization often plays directly into its ability to make DLP work with issues of enforcement standing as central disputes.A tug-of-war can break out between security teams tasked with enforcing DLP and those business unit that want unfettered access to data to help do their jobs, according to some industry players. "That's one of the big problems with DLP in general -- organizations are often quite hesitant in enforcing policies, especially when it comes to any notion of blocking secure content and getting in the way of the business," said Uzi Yair, CEO of DLP vendor GTB Technologies. "Businesses want people to be able do their work and don't want interference, but on the other hand, they know they need to weigh that against any loss, which could cost an organization a lot of money these days," he said. "I think it's always going to be about this tradeoff, enforcement versus the fear of slowing down business opportunities, but people need to understand that they all play a certain role."
26726
The company fixes a huge security vulnerability that made it possible for attackers to steal users' personal data. By the Associated Press.
489133
Most large data breaches don't appear to lead to identity theft, and proposals that would require companies to notify customers of most breaches may lead to increased costs.
286377
Organisations are risking seeing sensitive information ending up in the wrong hands, because they are failing to ensure that their unwanted PCs are properly datawiped.