Tag Archives: Privacy Rights Clearinghouse

About 1996 days ago Data Security

Safeguard Your Biggest Asset — Your Data

our beautiful site

Do you know where your data is? If your company maintains databases, runs e-mail marketing campaigns, sells something online, or gives salespeople laptops, the answer could be “everywhere.” The more places a company’s data resides, the greater the possibility it could fall into the wrong hands, accidentally or by theft or hacker assault. With so much at stake, it behooves businesses to establish controls to ensure data is private, secure and stays that way. One method for doing that is a privacy audit, in which a company reviews its information handling practices to track where data is stored and moved, if it’s vulnerable to leaks or theft, and whether employees adhere to stated privacy and security practices or industry regulations. Data breaches and lost laptops Small business owners who don’t think they need to check privacy practices are fooling themselves, advises Mike Spinney, spokesman for The Ponemon Institute, a privacy think tank in Traverse City, Mich. Consider: Since January 2005, 216 million data records of U.S. residents have been exposed due to security breaches, according to the Privacy Rights Clearinghouse (PRC), a non-profit consumer privacy advocate in San Diego, Calif. According to the PRC’s online listing of data breaches, many of those occurred at small businesses. The most common causes of security breaches are lost or stolen laptops or other portable devices like USB drives, according to a November 2007 benchmark study of data breaches at 35 U.S. companies by The Ponemon Institute. A separate survey published by The Ponemon Institute in November 2007, found that of 893 U.S. IT professionals, 51 percent copied confidential company information to a USB memory stick even though the majority of them (87 percent) believed their company’s policy forbade it. That even IT professionals should exhibit such cavalier attitudes toward data privacy “is kind of shocking,” says Spinney, the Ponemon Institute spokesman. Setting up a privacy audit Routine privacy audits could uncover and prevent such behaviors, privacy industry experts say. To perform an audit: Decide what data to analyze: all employee and customer records, or a subset of sensitive information, like Social Security numbers. Use spreadsheets, employee interviews, technical monitoring, and blind shopping or testing to create a chart showing where data is collected, processed, transferred, or deleted and what applications or vendors are used for each step. Use the data flow chart to measure the company’s day-to-day information handling practices against its stated policies and any industry rules or regulations. If the two don’t match, take the appropriate steps to change them. At most small businesses, an IT manager, CFO, or CEO could spearhead an audit. Small businesses could also hire a privacy consultant, or use their outside legal counsel or accounting firm, if those firms provide such services, says Jeff Nicol, of PrivacyReady.com, a privacy industry consultancy in Hood River, Ore. Audits aren’t cheap. A small business can expect to pay around $20,000, Nicol says. That’s pretty pricey, so companies could consider scheduling a full audit once every three years or do partial audits each year, Nicol says. Between audits, companies can use security assessment software to keep systems running smoothly, Nicol says. Software like Watchfire from IBM, Web Vulnerability Scanner, from Acunetix, Hailstorm from Cenzic, or WebInspect from SPI Dynamics can check that a company’s use of Web applications complies with stated privacy directives. Online sellers can test their privacy practices by going through the assessment process necessary to get an online privacy seal from TRUSTe, the non-profit privacy trust organization. SIDEBAR: Securing laptops and educating employees About those laptops: security experts recommend putting passwords on everything, and using encryption software such as Credant Mobile Guardian Shield or KeyPoint Alchemy from RedCannon Security. Another suggestion: enroll employees in online courses like the Privacy Directions series from MediaPro. “Technology (is) a big part of having decent security, but the weakest link is workers,” Nicol says. “Proper policies, training, and monitoring all are critical to see that folks know and follow good information security practices.”

About 3518 days ago Computer Security

TechnoFile: Identity Crisis

By now, you’ve heard that identity theft is among America’s fastest-growing crimes, with nearly 10 million cases last year alone, and you’re probably already taking measures to prevent yourself from becoming a victim. For instance, you use a paper shredder to convert old bills, receipts, and bank documents into confetti. You review your credit-card statements monthly, looking for mystery charges; you obtain your overall reports from the three major credit-reporting agencies annually, looking for accounts you never authorized. You don’t leave personal mail — incoming or outgoing, opened or sealed — sitting in the open where someone could walk off with it. Your best friend couldn’t guess your PIN. You guard your Social Security number like a jealous lover. Congratulations. You’ve taken some big steps toward shielding your own identity. Now how about doing the same for everyone whose personal information is sitting in your company’s computers? After all, an ID hijacker needs only a Social Security number, a birth date, and a few other details to open bank and credit-card accounts in somebody else’s name. Chances are you’ve collected all kinds of confidential data about your employees, contractors, and customers. If you’ve stored it on your systems, it’s vulnerable to theft. Obviously, standard security measures, such as firewalls, provide some protection against cyberthieves. So do commonsense practices. “You can do a lot by just not storing that information” in the first place, says Phebe Waterfield, security analyst for the Yankee Group, a Boston-based technology research and consulting firm. She recommends using something other than Social Security numbers for identifying employee records or customer accounts. And, of course, you should never store confidential data on laptop computers, floppy disks, or CD-ROMs — all easily lost or stolen. But given how quickly ID theft is growing (80% in one year, according to a Gartner Inc. survey, those precautions aren’t enough to safeguard sensitive information. Besides, you may not want to wall off your systems; you probably need to share some information with employees, contractors, clients, partners, and others. Instead, consider developing a comprehensive identity- and access-management campaign. Translated, that means that you provide information access on a “need-to-know” basis. You monitor who’s looking at what. And you verify that all users are who they say they are. Among the technologies used in identity and access management are: Authentication. These tools verify that the user logged on as Webster J. Parker is, in fact, Webster J. Parker. The most common version, the lowly personal password used again and again, won’t deter serious thieves, who can quickly crack the code. More sophisticated options include handheld “keys,” such as smart cards, and “two-factor” solutions, which require both a password and a physical device, such as a token, for access. Single sign-on (SSO). Generally, these solutions let companies provide each authorized user with one secure identity — often a user name paired with a smart card or token — for accessing all company systems. That prevents the out-of-control proliferation of log-in names and passwords that can compromise security. Biometrics. These devices identify users based on unique physical characteristics, such as handprints, retinas, facial features, or voices. Fingerprint and thumbprint readers that can be attached to individual computers are already on the market for less than $100 apiece. However, keep in mind that even legitimate users may object to providing prints or consider a retina scan invasive. And voice and facial-recognition technology are far from foolproof; currently, variables such as laryngitis or eyeglasses can distort the results. Account administration. This practice, often called “provisioning,” refers to managing users’ system-access accounts. That’s far more important than it sounds. Dormant accounts — for instance, those previously assigned to former contractors or ex-employees — can provide loopholes for thieves seeking access to private information. While small businesses can manually add and delete accounts, fast-growing companies may need technology that automates the process. Digital signatures. These e-signatures verify who’s sent a message or signed a document. Because they’re encrypted and include a time stamp, they’re difficult to fake. At this point, it’s impossible to guarantee that any technology can shield people’s identities. Recently, consumer activists and reporters demonstrated just how easily anyone in the know can buy supposedly private information — they effortlessly purchased public officials’ Social Security numbers and personal credit reports from online vendors. Even so, businesses are increasingly being expected to safeguard their customers’ private information — and being held accountable if they don’t. California recently passed a tough new law that, among other things, requires companies to seek customer permission before sharing their financial information and to print only the final few digits of credit-card numbers on purchase receipts. Congress is considering related requirements in its proposed amendments to the 33-year-old Fair Credit Reporting Act. Ultimately, then, taking action to protect your customers may be the best way to protect yourself. America’s Fastest-Growing Crime In September 2003, the Federal Trade Commission released a survey showing that 27.3 million Americans have been victims of identity theft in the last five years, including 9.9 million in the previous year alone. ID theft cost financial institutions, businesses, and consumers nearly $53 billion last year alone, according to the survey. Average loss to businesses was $4,800; the average loss to consumers, $500 — and untold hours trying to recoup their reputations. The Three Major Credit Reporting Agencies Following are the three major U.S. credit-reporting agencies. All sell consumers copies of their personal credit reports. You may be entitled to receive reports at no charge if you’ve been denied credit, if you suspect fraud, or if you live in states that require the agencies to provide you one free copy annually. All three agencies’ Web sites contain extensive information on preventing and responding to personal ID theft. Equifax Inc. Experian Trans Union LLC Gartner Inc. Survey A July 2003 survey by Gartner Inc., the Stamford, Conn.-based research and consulting firm, found that identity theft rose nearly 80 percent between June 2002 and June 2003. RESOURCES Discussion Join the Fresh Inc. discussion on identity theft. Information on preventing, detecting, and responding to personal identity theft: Articles, Publications “What’s Next: They’ve Got Your Number,” column by Robert X. Cringley (Inc., August 2003). CSO magazine: Executive-level articles, white papers, research summaries, and other information. Information Security magazine: Articles, buyers’ guides, e-mail newsletters. Agencies Federal Trade Commission: National Resource for Identity Theft site. Also see the FTC’s ID Theft Data Clearinghouse. Internet Fraud Complaint Center: FBI and White Collar Crime Center’s site providing information for spotting scams and filing compliants. National Infrastructure Protection Center: Computer-related wing of the U.S. Department of Homeland Security. U.S. Department of Justice: Identity Theft and Fraud site: Offers advice on preventing and responding to ID theft. Organizations 101-identitytheft.com: Resources, advice, and links for more information and assistance. American Privacy Consultants PrivacyToday.com offers headlines and information. Computer Security Institute: Conferences, courses, materials, and information on corporate ID theft and other information-security topics. Electronic Privacy Information Center: News, information, and links on privacy-related issues. Fightidentitytheft.com: Resources, advice, and links. Human Firewall Council: Security and ID-management related resources for managers. Identity Theft Resource Center: Resources, comprehensive information, and links, including advice on recognizing scams. Identity Theft University-Business Partnership: Michigan State University School of Criminal Justice project to help businesses secure competitive and personal information. Internet ScamBusters: Tracks and reports on online crime and fraud, include ID-theft schemes. Privacy Rights Clearinghouse Vendors of identity access and management solutions include: ActivCard Corp. BMC Software Inc. Courion Corp. IBM Corp. Microsoft Corp. Netegrity Inc. RSA Security Inc. SystemTools Software Inc. (Hyena Total System Administration) Vasco Data Security International Inc.