They can't steal data that you don't have

By Alan Brill and Jason Paroff, Kroll Ontrack

April 6, 2005 12:00 PM ET

Computerworld - Data theft has become big news in recent weeks. Between data lost or stolen from Bank of America, ChoicePoint and a unit of Reed Elsevier, the public (and more importantly, Congress) is up in arms about the protection of personal and financial data that can be the subject of massive identity thefts.
Data loss is, of course, nothing new. In our work, we are frequently called upon to investigate these incidents and to find out what happened and who was involved.
Any competent information security professional will tell you that there is no such thing as 100% incident prevention. Incidents happen and will continue to happen. But there are things an organization can do to mitigate the risks of certain types of incidents, as well as the damages if an incident should occur. Failure to examine and mitigate these risks will increasingly expose companies to bad publicity, increased regulation and perhaps costly litigation.
When you look at a lot of incidents, as we do, you can start to draw some conclusions that go beyond the specifics of a particular situation -- whether the loss involved theft of a backup tape or unauthorized intrusion into a system or whether the perpetrators had inside help in carrying out their plans.
We have observed that some of the sensitive data that gets stolen fits into one of several categories:

Data that was never needed

Data that was needed but should never have been stored

Data that was originally needed but was kept far beyond its useful life

Data that should never have been stored in an unencrypted form

When we point out these issues to the victims, it seems that they never thought about these problems. We want to take a few minutes to explore them with you.
Data that was never needed
When you look through the data that you record on customers, transactions, employees and processes, when is the last time you checked each and every data field to determine why you needed it?
If you collect information that you don't actually need, not only are you spending money needlessly, but you're also opening yourself up to the risk that the unneeded data might be stolen or misused. You should look for a specific reason for collecting everything you ask for. If you can't define a valid business need or some legal or regulatory requirement for the data, why are you collecting it?
Sometimes we're told that the current system mirrors an earlier system that collected the same information, and no one realized that some

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Additional Resources

Xerox

Win a color printer!

By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!

Microsoft

Upgrade to Internet Explorer 8 today.

Save time and mitigate security risk. Deploy it now.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

Speeding business innovation with HP Data Center Transformation solutions
Data center transformation enables your IT organization to focus more on business priorities and innovation by decreasing spending on maintenance and management by...

Four Principles for Reducing Storage TCO
(Source: Hitachi Data Systems) Difficult economic times require new strategies for reducing costs. Where storage technology and economics meet, there are...

HP Data Center Transformation Solutions
CIOs today are challenged to respond to economic and business pressures, to change from being cost centers to becoming strategic business enablers. There...

Boost your CAE productivity, and break-away from the pack
(Source: Sun) Join Clemson University as they present their groundbreaking engineering simulations research at their Computational Center for Mobility Systems. Dr. James Leylek,...

Using Symark PowerBroker™ to Enrich Your Organization's RBAC Model
The essential notion of Role-Based Access Control (RBAC) for IT security administration is establishing permissions based on the functional roles within the enterprise,...

Deduplication and Other Strategies for Protecting Your Assets with the Veritas NetBackup Platform
(Source: Symantec) Many companies find their backup and storage resources strained by data growth and increased regulatory requirements for data retention. In today's...

Using VMware Site Recovery Manager to Simplify DR
(Source: NetApp) Nothing is scarier than the prospect of having to recover an entire site after a disaster. VMware® Site Recovery Manager (SRM)...

Controlling Email and File Server Growth and Costs with Intelligent Archiving
(Source: Symantec) According to IDC 54% of the storage capacity added by organizations in 2008 will be dedicated to the storage of file-based...

NetApp and VMware Virtual Infrastructure 3 Storage Best Practices
(Source: NetApp) NetApp has been providing advanced storage features to VMware ESX solutions since the product began shipping in 2001. During that time,...

Maximize Storage Assets with Thin Provisioning, Tiered Storage, and Cluster File Systems
(Source: Symantec) Thin Provisioning is an opportunity to immediately optimize your storage systems and make more capacity available to your applications. In order...

All White Papers | All Webcasts