S.C. governor's post-breach data encryption claims are off-base, analysts say
"The governor's comments reflect unawareness of data security practices and are not at all reassuring," Litan added.
Pointing to weak data security practices at banks as a defense for the state's ineptness isn't a good strategy, said Richard Stiennon, a principal at IT-Harvest.
"Critical data, especially personally identifiable information, must be protected and Social Security numbers linked to names, ranks at the top" of the list of items that need to be protected, he said. "Encryption technology is readily available for data stores. It is not cumbersome to encrypt data. To the contrary, it is easy to do and most retailers and payment processors do it regularly."
Some security vendors also took the governor to task for her claims about encryption technology being cumbersome to implement. "Anyone remotely familiar with security best practices knows that all sensitive data should be encrypted," said Torsten George, vice president of worldwide marketing and products for risk management vendor Agiliance.
Typically, the decision not to encrypt sensitive information is driven by budget limitations rather than by industry standards or best practices, George said.
Haley's comments are based on outdated assumptions, said Todd Thiemann, senior director of product marketing at data encryption vendor Vormetric. While encryption technologies used to be somewhat difficult to deploy, these days the technology is not all that complicated, he said.
"Most state data breach laws, including California, Massachusetts and Nevada, call out Social Security numbers as a category of information requiring protection," Thiemann said.
Under most state data breach laws -- including South Carolina's -- encryption provides businesses with safe harbor from notification in the event of a data breach, he noted.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- Gartner Magic Quadrant for Client Management Tools The client management tool market is maturing and evolving to adapt to consumerization, desktop virtualization, and an ongoing need to improve efficiency.
- Audit Ready and Asset Optimized: The Solid Promise of an Intelligent Software Asset Management Solution In this paper Frost & Sullivan examines the benefits of enterprise-grade Software Asset Management solutions, and how these solutions serve as the convergence...
- Pragmatic Endpoint Management: Empowering an SMB Workforce in the Age of Mobility Lacking the time for proper training and education, SMB administrators often resort to taking shortcuts to keep their environment running.This paper discusses the...
- Gartner Magic Quadrant for Application Security The market for application security testing is changing rapidly. Technology trends, such as mobile applications, advanced Web applications and dynamic languages, are forcing...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Cybercrime and Hacking White Papers | Webcasts