Lessons learned from corporate security breaches
Computerworld - With information security breaches in the U.S. now reported at a rate of one every three days, corporate privacy and security officers need to take stock about what's happening and what they can do about it.
So what's going on? According to the Privacy Rights Clearinghouse (PRC), 61 U.S. organizations have reported exposures of personal information in the past 180 days. PRC keeps the best list of breaches reported since February's watershed incident at ChoicePoint, where criminals obtained 145,000 customer accounts and sparked a series of congressional hearings on the subject of data security.
What's at the root of these breaches? The PRC reports that the leading cause is external hackers, accounting for half of the incidents. A quarter resulted from stolen laptops and computers. Dishonest insiders, lost backup tapes and negligent employees and business processes accounted for the remaining quarter (see table 1).
And I think we've seen only the beginning of this phenomenon. Why's that? Two reasons. Nineteen states have now joined California in requiring organizations to notify individuals if their Social Security numbers, driver's license numbers, financial account numbers or other sensitive information is exposed to unauthorized people (see table 2). Companies effectively must now notify all U.S. residents of breaches affecting their sensitive information, so this notification phenomenon is here to stay.
The second reason is that companies are still learning how to detect and report these breaches. A 2005 Ponemon Institute survey of corporate privacy practices found that only a third of companies use a formal process to monitor and report security breaches. As companies improve these procedures, they'll be reporting more incidents (see Opinion: After a privacy breach, how should you break the news?).
What'll be the impact of a continuing stream of publicized security breaches? It won't do anything good for customer confidence. A Conference Board survey released in June reported that 41% of customers are purchasing less online than a year ago because of security fears (see Survey: Consumers growing wary of buying online). Trends like this affect all companies, even those with solid security.
But the impact will be greatest on those companies experiencing major publicized breaches. For its part, ChoicePoint has registered $11.4 million in charges related to its security breach (see ChoicePoint says data theft cost it $6M) and endured a sustained, $6 drop in its share price. CardSystems International, which suffered an external hack that exposed 40 million customer accounts, is facing financial ruin following the loss of its Visa and American Express clients (see Visa, Amex cut ties with processing firm hit by security breach).
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
Red Hat Enterprise Linux - The Original Cloud Operating System
Linux adoption is growing against a number of measures, such as the
number of supercomputers that run Linux and the size of the contributing...
- OpenStack Hype vs. Reality: CIO Quick Pulse Open-source architecture can enable IT departments to build infrastructure-as-a-service (IaaS) clouds running on standard hardware.
- Building a Bridge to the Next Generation Data Center Selecting a widely adopted operating system is a foundational component of a standardization strategy.
- OpenStack and Red Hat: IDC White paper Most OpenStack deployments are by public cloud providers that are early adopters of technology and use OpenStack in a do-it-yourself deployment and support...
- Data Protection and Disaster Recovery with iSCSI and VMware Get this on demand webcast now
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have. All Privacy White Papers | Webcasts