S.C. governor's post-breach data encryption claims are off-base, analysts say
"The governor's comments reflect unawareness of data security practices and are not at all reassuring," Litan added.
Pointing to weak data security practices at banks as a defense for the state's ineptness isn't a good strategy, said Richard Stiennon, a principal at IT-Harvest.
"Critical data, especially personally identifiable information, must be protected and Social Security numbers linked to names, ranks at the top" of the list of items that need to be protected, he said. "Encryption technology is readily available for data stores. It is not cumbersome to encrypt data. To the contrary, it is easy to do and most retailers and payment processors do it regularly."
Some security vendors also took the governor to task for her claims about encryption technology being cumbersome to implement. "Anyone remotely familiar with security best practices knows that all sensitive data should be encrypted," said Torsten George, vice president of worldwide marketing and products for risk management vendor Agiliance.
Typically, the decision not to encrypt sensitive information is driven by budget limitations rather than by industry standards or best practices, George said.
Haley's comments are based on outdated assumptions, said Todd Thiemann, senior director of product marketing at data encryption vendor Vormetric. While encryption technologies used to be somewhat difficult to deploy, these days the technology is not all that complicated, he said.
"Most state data breach laws, including California, Massachusetts and Nevada, call out Social Security numbers as a category of information requiring protection," Thiemann said.
Under most state data breach laws -- including South Carolina's -- encryption provides businesses with safe harbor from notification in the event of a data breach, he noted.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org.
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- Step Out of the Bull's-Eye Learn about the evolution of targeted attacks, the latest in security intelligence, and strategic steps to keep your business safe.
- Using Cyber Insurance and Cybercrime Data to Limit Your Business Risk This paper examines the challenges of understanding cyber risks, the importance of having the right cyber risk intelligence, and how to use this...
- 5 Tips to Secure Small Business Backdoors in the Enterprise Supply Chain This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- What Does it Take to Deliver a Superior Customer Experience? The Two Top-Rated Online Retailers, B&H Photo and Crutchfield Electronics, Share Their Secrets Discuss practical CX tools and service methods such as contact center agents and the use of realtime speech analytics to help contact center... All Cybercrime and Hacking White Papers | Webcasts