While helping others, IBM confronts its own data theft
116323
Blog: Past and current employees are affected by a third-party tape loss.
265634
The same employees and IT workers who handle and protect sensitive business information may be being trained and recruited by organized criminals to steal it.
164007
(InfoWorld) - Experts gathered for the ongoing InfoWorld Enterprise Data Protection Forum in New York today said that companies need to get a better handle on all the factors that make their sensitive information susceptible to attack and become more proactive with their overall defensive strategies if they are to improve on their current security status. In a panel presentation featuring leading security executives and consultants, experts highlighted a need for businesses to study all the elements that contribute to classifying their most valuable information as truly sensitive. Protecting records whose value is immediately apparent -- such as social security and credit card numbers -- isn't enough as companies must also shroud any related data that can be used to create an individual profile that could be used to carry out identity theft or other forms of fraud, the speakers said. By defending all the contextual data that can be used to create such a picture, enterprises can greatly reduce their risk and move beyond more obvious strategizing, said C. Warren Axelrod, chief privacy officer at financial services giant U.S. Trust. "What's interesting in financial services is that it is the combination of data that becomes valuable information when it comes together to create an identity," Axelrod said. "If you are just going to file away social security numbers with no way to tie them to identity, they're actually pretty innocuous; but even if you just have a way to associate that information to a phone number or other data, someone can put things together." Axelrod said for the record that "data protection is a contradiction in terms," and that the process will never be perfected, based on the nature of IT systems and the need for businesses to easy retain access to important information.Â  The only way to effectively improve data security is to create a governance hierarchy that allows IT workers to better classify all types of information and to elevate protection of anything that can be used to create an individual portrait, he said. IT consultants agreed, saying that they are advising their customers to use contextual data to help carry out their regulatory compliance projects with greater efficacy. "It's the context that data is used in that qualifies it for regulatory oversight," said Peter Robinson, senior manager for financial services information security at BearingPoint. "You have to protect both the data and all this other information." Perhaps the biggest challenge facing enterprises today in improving their overall data security strategy is becoming more proactive about trying to expect attempted misuse or theft of information, and putting more intelligent tools in place to defend themselves before those situations arise, said Pamela Fusco, chief security strategist at consultancy FishNet. Fusco, who chaired the panel, is also a former chief security officer at financial services bellwether Citigroup. "We don't write a law unless something happens first, as with seat belt laws. We write regulations because something happens, but those are reactive," Fusco said. "Most consultants feel as if we're in reactive versus proactive mode for data protection and integrity." Regulations like the Sarbanes-Oxley Act have proven less effective than legislators might have initially hoped they would be at improving overall data security because businesses have focused on meeting the terms of the guidelines versus boosting their overarching protection schemes, Fusco and other panelists agreed. However, some industry-driven security requirements, such as the PCI (payment card industry) standard forwarded by credit card issuers, have had the desired effect, experts said. Well-written guidelines can help make the difficult task of convincing senior executives to increase their IT security budgets easier, alleviating one of the most significant challenges of the entire data protection process, according to Steve Peltzman, chief information officer at the Museum of Modern Art in New York. "We had to spend a lot of time and money on [PCI], but now I'm thankful for it because I don't have to go through the same routine of convincing everyone that this effort is important," Peltzman said. "The credit card companies got together and made it more expensive for us not to deal with [data protection], which is a good example of industry coming together to create a standard that's actually good." In a seemingly-rare occurrence, the security experts agreed that the creation of an additional, worldwide data protection standard -- as proposed to the assembled group by FishNet's Fusco -- could prove useful in furthering their efforts to secure attention and funding for their data protection strategies. For global companies in particular, establishing such a global guideline could be effective, they said. "The international difference in data protection priorities is an issue. If it could be resolved to where we could get universal classification and more people building innovative solutions, that could be a big benefit," said Erich Mueller, security analyst for Allstate Insurance. BearingPoint's Robinson agreed that such a standard could provide much needed support for security pros. "Anything that can advance the understanding and foster the culture of security in the executive suite is a positive. We've all been trying to do things like this for ourselves for years," Robinson said. "A standard that can help shorten the education cycle and get us where we need to be is something that I would support."
380529
Things just aren&#39;t going well for Timothy Scott Short. Just days after a pair of tech support calls he made to printer manufacturer Digimarc&#160;resulted in his arrest, he now finds himself on the receiving end of a data breach with his Social Security number and birthdate accidentally made public via the federal court&#39;s Electronic Case Files (ECF) system.It&#39;s an ironic development, because Short, 33, was arrested in connection with the Oct. 5 theft of a Missouri Department of Revenue printer and a PC containing data on as many as 500 state residents.Short&#39;s personal information was discovered by the IDG News Service, listed on a court document called a Criminal Case Cover Sheet, which was publicly available to users of the ECF system. Normally, this document should only be accessible to those involved in the case, but it appears to have been inadvertently made public, according to a clerk with the U.S. District Court for the Eastern District of Missouri, who asked not to be identified because she was not authorized to speak with the press. &quot;It&#39;s something on our side,&quot; she said, adding that technical staff is now looking into the problem.The U.S. Judicial Conference, which sets policy for U.S. courts, has said that this kind of information should be removed from publicly available electronic court records, but actually removing all the sensitive information has proved difficult.&quot;If you went online to various court systems, you could find social security numbers of many individuals,&quot; said Paul Stephens, director of policy and advocacy with the Privacy Rights Clearinghouse. &quot;It&#39;s a really, really difficult question to answer, just because you&#39;re dealing with so many jurisdictions.&quot;Social Security numbers are the building blocks of identity theft crime because they can be used to secure credit cards. &quot;Any time you are placing Social Security numbers online, your are subjecting that person to identity theft,&quot; Stephens said.With the push to make public documents available online, other government databases have had similar problems. Earlier this year, the states of California and Colorado were forced to take their Uniform Commercial Code (UCC) databases offline after privacy advocates pointed out that the Social Security numbers and other data they contained could be misused by identity thieves.Short, however, may have bigger problems to worry about. He&#39;s facing $250,000 in fines and 10 years in prison on charges of possession of &quot;document-making implements&quot; in connection with the theft. He was arrested after U.S. Secret Service Special Agent John Bush recognized his voice in calls placed to a tech support line of the company that makes the stolen printer.&#160;
728780
IBM is aggressively expanding its security portfolio in hopes of becoming the de facto source of advice and technology for businesses looking to adopt high-level IT governance and risk management strategies -- a transformation among customers that officials at Big Blue cite as both ongoing and inevitable.As the waves of security threats and data management regulations have washed ashore and left organizations struggling to balance perimeter and internal security concerns with mounting obligations to protect highly-valuable data, companies are being forced to take more of a top-down approach that addresses broad sets of IT-oriented risks, versus individual problems, IBM officials maintain.And while a host of players ranging from security software makers to massive IT consultants have begun marketing themselves as those best suited to help customers embrace a governance and risk management approach, IBM executives claim that their firm's mix of technology, services and partnerships place it at the top of any list of providers capable of helping organizations prepare their security operations for the future."We feel that we're ahead of the curve and driving forward our ability to meet these needs, some of which that might not yet have emerged from a broad perspective," said Kris Lovejoy, IBM's director of corporate security strategy."We feel that we are creating security risk management capabilities and have an opportunity to commoditize them in a way that can be leveraged at large," she said. "From an overall strategic perspective, that doesn't mean that customers are ready to stand up en masse right now and require everything we've built, but we're actively trying to extend the portfolio in advance of that trend."Industry specialists, including Symantec and McAfee, the world's two largest security software makers, have also adopted high-level product and marketing efforts meant to help customers move away from battling individual threats and compliance regulations in favor of a more generic risk management strategy, but IBM claims that it is better positioned to help customers move in that direction today.While the traditional security vendors have long been focused on shipping products that address various elements of end-to-end security and have only moved into risk management in the last two years, Big Blue has its own products and services as well as partnerships with those very vendors and many others that give it an upper hand, IBM executives said."In a sense, today, security is like a car without a steering wheel, and we think we're the only vendor who has the right abilities across all the involved domains that can drive change across business processes," said Eric McNeil, manager of corporate security strategy at IBM. "These other companies touch on a lot of domains, but we're the only ones who have all the pieces that span identity, applications security, physical security, and asset lifecycle management."With its broad array of product and services skills, the executives said that IBM is best qualified to pull together key components that will allow more organizations to manage security using analytical reporting, policy creation and enforcement, and through the use of risk analysis dashboards.The executives cite two areas, IT service management and master data management, as tremendously important to its ability to aid customers in addressing risk. To be able to build controls to oversee change and configuration issues on the services side and help companies get their heads around the intricacies of master data management, customers will need more than the traditional security vendors can offer, said Lovejoy."The security companies of the future are not the companies that offer capabilities for the newest bells and whistles, it's about those things and more, including all the plumbing needed to make these strategies work," said Lovejoy. "While traditional security players that off threat management have great benefits in securing a perimeter, they're not adept at installation of basic plumbing, which actually helps in managing the majority of the risk."Partners fret about potential downgrades Throughout its Global Technology Services unit and IBM software group, including its Tivoli product lines, Big Blue officials contend that the company is far better suited to handle configuration and change management around complex issues like employee identity.Top executives at Symantec and McAfee concede that IBM enjoys a unique position in the security sector based on the breadth of its products and partnerships and its huge services delivery capabilities.And while the CEOs of both companies first point out that they consider IBM as one of their closest and most important partners, respectively, they maintain that they too have strengths in IT governance and risk management that will continue to distinguish them from the technology giant.They also said that IBM will have to resist the urge to promote its own security technologies at the expense of providing customers with best-of-breed technology."They're a different beast than us because they play such a big services integration game up and down the IT stack, but it does seem sometimes that everything does look 'blue' to them," said David DeWalt, chief executive at McAfee. "We're not looking to compete with them, and there's not a lot of overlap, so the idea will be to continue to partner where we can."While recognizing that his company partners with IBM around the globe and that he considers it extremely valuable to continue to do so, John Thompson, chief executive at Symantec, said that there are concerns about IBM giving preference to its in-house technologies.Prior to joining Symantec nine years ago, Thompson served in the role of general manager of IBM Americas and a member of the company's Worldwide Management Council."The issue in terms of our relationship with IBM is if they will continue to be open to technologies that come from outside their own software group, or will they have a strategy as has been articulated as 'blue on blue,' or IBM services packaged around IBM software," Thompson said. "To the extent that they bias their engagements that way, they might limit their ability to compete, and it is clear that they have an institutional bias if you look at some of the things that we have observed on the marketplace."Responding to those comments, IBM's Lovejoy said that while IBM has continued to make investments in expanding its security product portfolio -- most notably via the acquisition of Internet Security Systems for $1.3 billion in August 2006 -- that it will continue to foster a best-of-breed approach using its partners to ensure it meets its customers' needs.She also noted that IBM's services business would never have grown to become over half of the company's annual revenue without a "vendor agnostic" approach.Industry experts said that IBM and its security partners are likely to compete more frequently as the company acquires additional products and its rivals build out their services and risk management capabilities.However, said Paul Stamp, analyst with Forrester Research, all the involved parties likely have too much riding on their existing partnerships for any competitive ill will to affect their relationships."There will be competition, but I think that IBM sees this risk management issue as going far beyond what we consider traditional security, they are looking more at setting policies and security within a larger IT management framework that includes performance management, data governance and overall business services issues," said Stamp."If anything I think Symantec will compete with them more in some areas, and there will be areas where [Symantec] has some individual strengths, but these companies all need to partner," he said. "You also have to remember that customers IT shops aren't monolithic, and each company will continue to sell into different constituencies; in the end there should be room for everyone."
107131
Soon on sale: hardware and software from a start-up whose software with a new approach for protecting data by dispersing it across several servers--and maybe even continents.
99945
Attackers could use hole in small-business software to trick personal information out of people.
714344
A volunteer effort led by some of those involved in Amero's spyware case want to help others who may be in a similar position.
226295
Market for data loss prevention is increasingly becoming consolidated, but industry leader Vontu could become the odd man out.
519167
Two years ago, IBM was ordered to produce the source code for its products, which Compuware identified as containing its pirated intellectual property. The code was missing. But lo and behold -- last week, they called and said they had it,&quot; ...
587562
AMERICAN FORK, Utah - With videos, pictures and reams of other data piling up on computers everywhere, consumers who want some insurance against losing it all have a growing number of online backup options.
301699
The IBM scientist who developed a method of sharing corporate data without revealing what that data contains describes the process and why it's geared toward protecting business resources, not consumer privacy.
186700
Although Monster.com isn't saying when its database was breached, security researchers are pointing to evidence that sensitive data may have been stolen weeks or months ago.
337989
A customer filed a $54 million lawsuit against Best Buy for losing an $1100 laptop she took in for service. The reason, exposure to identity theft.  It's about time vendors were forced to recognize the value of customers' data. I recall how the chief genius at the Apple store in Emeryville complained that they would have to eat the cost of the drive in a deal they made with the manufacturer. Someday they'll have a clue that the data on most drives is worth far more than the hardware, and that their potential liability, if the data ends up in the hands of an identity thief, is also much greater.
376475
(InfoWorld) - The companies that are having the most success in advancing their data security efforts today are those that are finding a way to protect sensitive information without getting in the way of business users, industry experts maintain. In crafting their data-handling policies and selecting from the multitude of security technologies at their fingertips, those businesses that can foster both ready access to information, along with strong defenses for end-users and IT systems, are making progress the fastest, claim leading vendors and service providers. After years of "throwing technologies" at the data security problem while juggling complex business demands along with external threats and regulatory compliance audits, some businesses are finally discovering that they can simplify the entire process by taking a more comprehensive approach to tailoring their programs to the manner in which their users access, handle, and share information. Even within IT giants like IBM, the struggle to balance security issues with emerging business demands to work with information in new ways hasn't always been approached in this manner, said Julie Donahue, vice president of the security and privacy service in the company's Global Technology Services group. Only through experience and ongoing efforts to constantly rationalize security policies with business demands has the massive firm been able to get a grip on its own data-handling needs, she said. "Customers need to step back and see what their own culture wants. If we locked down everything within IBM, it would be so difficult to manage that we would have a serious management problem, so you have to ask questions around culture before you begin thinking of enforcement," said Donahue. "You have to assess the risk environment and think of this as a holistic problem in terms of how you place bets and need to manage pools of risk, even though that for most CIOs it often feels like you have to spend your time going day-to-day dealing with the crisis of the moment," she said. "You really need to look at where to make the right investments, where to do enforcement, and where to monitor to have a truly strategic view." Donahue said that when IBM was building its security practice roughly 16 months ago, it found that customers were spending as much as 10 percent of their IT budgets dealing with the maintenance and complexity of their data security systems. The only way to reduce the data security management headache is to design an internal framework for managing infrastructure to ensure that investments are being made wisely, she said. In many cases, those companies that are succeeding in that regard are treating their data assets just as they would treat cold, hard cash, the expert maintains. "Companies need to protect their vast ecosystem of data like it is a monetary system, they really have to think about it that way," said Donahue. "It can't be the data center's problem or the network administrator's responsibility alone to protect its security; it has to be everyone's responsibility throughout the entire company." IBM learns about security leaks the hard way As evidence of the types of things that can happen to undermine even a comprehensive security game plan, Donahue pointed to IBM's loss of two backup tapes that contained sensitive information about former employees earlier this year. While the incident was actually related to IBM's provider of backup storage services, the company was forced to pay out roughly $22 million in remediation costs related to informing those people who had been affected and providing credit monitoring services and the like for those individuals, she said. In that sense, companies must also require the highest security standards from their business partners, said the expert. IBM has since written stronger backup-tape handling policies into its contract with its partner as a result of the incident, and Donahue encouraged others to do the same. Phillip Dunkelberger, chief executive at encryption software specialists PGP, said that companies are spending too much time trying to react to data incidents and the individual mandates of compliance regulations while overlooking opportunities to improve data security through smarter process control. Many companies are still too concerned with protecting various endpoint devices and network assets when a more data-driven approach would save them both time and money, he said. "It has to be about the data. Data is very much the currency that people are transacting with, and employees need to be able to get their jobs done, even if that means taking information outside the network," said Dunkelberger. "As complexity grows, things happen -- executives buy iPhones that are essentially 60GB storage devices that run on Open BSD and allow third-party applications," he said. "Defending the device is going to be a losing war, and even if you try to do that, people will inevitably add to the device or change its configuration." While it unsurprising that Dunkelberger advocates the use of encryption as an intelligent way to overcome the complexity of changing IT infrastructure and business demands of defending data, he said that problems are most often related to faulty policies, not the types of technologies used for information protection. The heightened information security atmosphere of today isn't as much a result of the rapid growth of mobile computing or shared infrastructure between companies, but rather an issue of poor data architecture from the top down, he said. "Unless we start having a comprehensive discussion about the defense of data, the problem will only continue to persist, and not just in relation to hackers or compliance," Dunkelberger said. "Everyone has policies, but it is interesting how much intellectual property is being targeted and stolen despite that; more of these attacks are coming, and that will only increase costs and complexity if handled improperly because these are the crown jewels of the organizations that are being targeted," he said.
637468
Big businesses in the UK are selling PCs without having destroyed the data on their hard drives, opening up private information to those in third world countries who might use the information for identity theft scams.
726987
The loss or theft of personal data such as credit card and Social Security numbers is soaring to unprecedented levels, and the trend isn't expected to turn around anytime soon as hackers stay a step ahead of security and laptops disappear with sensitive information.