GRC Journal - (Page 87) Governance, risk & Compliance Last year, records containing personal information were exposed and compromised at a rate of six million per month. In fact, over the past 25 years or so, there have been almost two billion personal records exposed by organizations in the U.S. And, although it isn’t surprising, given the requirements of new data breach notification laws and the ubiquity of digital information, the number of reported incidents in 2005 and 2006 was greater than the previous 25 years combined. This is an interesting statistic, but what does it mean? To put it in context, let’s look at another statistic. A study by Gartner found that retailers lost $2 billion last year because of consumer fears about the security of their information. This is a big number which tells us that the last five years of headline after headline about lost backup tapes, stolen information, hacking, exposed credit card data, exposed medical records and so on are having an effect on the consumer – not surprising. What is causing all of these data security breaches and economic loss? Is it hackers sitting in their darkened rooms, using their computer genius for evil? Is it widespread, sophisticated attacks across the globe? The short answer is “no.” In fact, a recent study by the University of Washington found that 60 percent of data breach incidents are caused by organizational mismanagement. That’s right, we are our own worst enemy, and whether it is because of a lack of oversight, administrative errors, losing tapes or malicious insiders, we are witnessing a massive, industry-wide plague of problems that can be solved by the tools we have available to us today – but we must act now! These statistics point to an important fact: the landscape and context within which we operate today when it comes to data security has changed. Like it or not, and unrealistically or not, today we face a whole host of new expectations and heightened scrutiny from courts, regulators, boards, shareholders, customers and partners around information protection. Need proof? When is the last time you read a Securities and Exchange Commission (SEC) filing from a retailer that includes a 10-page section discussing, in gory detail, of a two-year saga involving worms, hacking and encryption? Well, if you look at the most recent Form 10-K for TJX, you will find just that: “We do not have enough information to reasonably estimate losses we may incur arising from the computer intrusion.” Here, the retailer is telling its shareholders that it cannot yet estimate the economic consequences of its security problems. This type of admission may be novel today, but I predict we will see more filings like this in the months and years to come. The fact is that the business environment for information security has changed. Today it is higher profile, with higher stakes and greater scrutiny. Need more proof? Nearly 40 states have passed some form of data breach notification law and most of the rest are considering doing the same. There is talk of similar action on the federal front. With senator’s data, veteran’s data, along with the data of millions of consumers, it should be no surprise. But I think even more interesting than the proliferation of laws and regulations is the increasing, routine scrutiny of policies and practices by regulators and in litigation. Today, we are starting to see regulators and those involved in litigation perform a level of analysis on your internal operations that used to be rare. The reality today is that there are hundreds, if not thousands of laws and regulations that have a potential direct or indirect impact on the way organizations have to manage and protect information. Although recent laws and regulations have begun to address some of the novel aspects of digital information, the reality is that organizations have long had the responsibilities to mange all of their assets – of which information is one kind – in particular ways. Below are just a few of the laws and regulations that impact data security. All readers should make sure that they are intimately familiar with those that impact their organization. California SB 1386. “disclose any breach [where] unencrypted personal information was . . . acquired by an unauthorized person.” HIPAA Security Rule. Protect information during “access, storage and transmission” Payment Card Industry Data Security Standard. “Protect encryption keys . . . against both disclosure and misuse.” 16 CFR Part 314 (Data Safeguarding). “Protect against unauthorized access to or use of such information” 16 CFR Part 314 (Data Disposal). “Reasonable measures to protect against unauthorized access to or use” So, how should organizations address the increasing business and legal pressures of security compliance? Here are some practical tips: n Get your policies and technologies working together. Too many organizations have policies that cannot be enforced or implemented by their technology. For example, in our practice, we see many organizations with policies requiring information to be tagged as classified or confidential, and that mandate such information be encrypted, but that have no encryption technology in place. n Manage data throughout the lifecycle. Whether it is data that is freshly created and impacted by federal regulations, in transmission and subject to the Payment Card Industry (PCI) Security standard or the HIPAA security rules, or information at the end of its lifecycle and subject to data disposal regulations, you need to have a plan to protect and manage it. Assemble the right team. The reality today is that IT cannot take all of this on its own; legal can’t either; and neither can the business managers or the records and information managers. Today, success in managing and securing information can only be had through a cooperative effort that involves all these groups and clearly defines and assigns responsibilities. n barclay t. blair kahn consulting, inc. BARCLAY T. BLAIR, Director of the IT Compliance Practice at Kahn Consulting Inc., is a consultant and internationally-acclaimed speaker and author specializing in the compliance, policy and management issues of information technology. He is the coauthor of “Privacy Nation,” and can be contacted at bblair@KahnConsultingInc.com or 403-638-9302. www.BTQuarterly.com Business Trends Quarterly 9 http://www.BTQuarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.