Today Silicon.com reported some interesting statistics about the increased number of computers being found in  the UK now that those airports do not allow for electronics basically of any kind to be taken onboard.

Heathrow reportedly obtains an average of 120 laptops monthly from travellers who misplaced them, and around 15 go unclaimed, ending up at auction.

The story makes a good point about how it seems travellers just assume that their laptop was stolen, so they don’t even check with the airport’s or airlines’ lost and found to see if their computer is indeed within the custody of the airline management.

From the report, "Research out last week suggested 40 per cent of all electronic devices lost at UK airports go unclaimed, with mobile phones more likely to be left unclaimed than laptops and PDAs."

A good lesson for travellers in and through countries with the onboard electronics restriction:  If your computer, cell phone, PDA, etc. goes missing, check with the airport security or lost and found department.  If you’re lucky it may be there.  If you’re even luckier none of the data on it will have been compromised.

Just one more reason to encrypt sensitive and personally identifiable information (PII) on mobile computing devices, to use boot and login passwords, and to use tracking labels and services, such as StuffBak, 4found, IMFound, STOP, Huzizit, or Yellowtag.

Technorati Tags
information security
IT compliance
policies and procedures
asset tracking
stolen laptop
lost laptop
airport security
awareness and training
privacy

Today Computerworld reported that hackers broke into AT&T’s systems over this past weekend.

"Malicious hackers broke into one of AT&T Inc.’s computer networks and stole credit card data and other personal information from several thousand customers who shopped at the telecommunication giant’s online store. AT&T said it was notifying "fewer than 19,000" customers whose data was accessed during the weekend break-in, which it said was detected within hours.  The company said it immediately shut down the online store, notified credit card companies and was working with law enforcement agencies to track down the hackers.  "We recognize that there is an active market for illegally obtained personal information," Priscilla Hill-Ardoin, AT&T’s chief privacy officer, said in a statement. "We will work closely with law enforcement to bring these data thieves to account," Hill-Ardoin said.  AT&T said it would also pay for credit monitoring services to assist in protecting the customers involved. The data theft involved people who had bought DSL equipment for high-speed Internet access.""

It is refreshing to see that AT&T is not trying to downplay the potential seriousness of the incident. 

Breach response actions they did right:

• Notified the impacted individuals quickly.  They did not wait months to notify as most other companies have done in the past, such as Choicepoint and the Veteran’s Affairs agency.
• Did not sugar-coat the potential impact of what could be done with the data.  They acknowledged that there are many fraudsters and criminals out there who make significantly large amounts of money selling personal information to other criminals.
• Did not say that the information had not been misused.  Too many times companies try to shrug off the potential impact of the incident by saying that they do not believe stolen information had been used, or that there was no malicious intent by the unknown hacker, when in fact there is no way they could possibly know this.
• Is paying for credit monitoring for the 19,000 impacted individuals.  Such credit monitoring, while not 100% effective, certainly will help the impacted individuals know if their data is being used for fraud in a large number of ways.  More…actually all…businesses must accept responsibility for their security incidents and step up and pay for this monitoring for impacted individuals instead of telling the individuals they must pay for it themselves.

I’ll be interested to see follow-up information on this incident, if there is any.

Technorati Tags
information security
IT compliance
data breach
hacker
breach response
security incident
policies and procedures
awareness and training
privacy

The arm of the law *can* be long when it comes to nabbing computer criminals and sending them to jail for their crimes.  A few examples of how computer crime does not pay when you’re caught were reported in the past few days.

Example 1:

The U.S. Department of Justice reported, "Operator of Massive For-Profit Software Piracy Website Sentenced to 6 Yrs; Defendant Made Over $4.1 Million in Illegal Revenue."  The criminal must also

"pay restitution of more than $4.1 million, and perform 50 hours of community service. The ordered forfeiture involves a wide array of assets, including numerous airplanes, a helicopter, boats, and cars, which Ferrer had purchased with the profits from his illegal enterprise. In particular, Ferrer forfeited a Cessna 152; a Cessna 172RG; a Model TS-11 ISKRA aircraft; a RotorWay International helicopter; a 1992 Lamborghini; a 2005 Hummer; a 2002 Chevrolet Corvette; two 2005 Chevrolet Corvettes; a 2005 Lincoln Navigator; an IGATE G500 LE Flight Simulator; a 1984 twenty-eight-foot Marinette hardtop express boat; and an ambulance. Ferrer has also agreed to surrender the proceeds of sales of two fire trucks that were also bought with his illegal proceeds."

It’s amazing how many people make guys like this multi-millionaires. 

"Beginning in late 2002 and continuing until its shutdown by the FBI on Oct. 19, 2005, Ferrer and his co-conspirators operated the www.BUYSUSA.com website, which sold copies of software products that were copyrighted by companies such as Adobe Systems Inc., Autodesk, and Macromedia Inc. at prices substantially below the suggested retail price. The software products purchased on the website were reproduced on CDs and distributed through the mail. The operation included a serial number that allowed the purchaser to activate and use the product. Further investigation established that, during the time of its operation, www.BUYSUSA.com illegally sold more than $4.1 million of copyrighted software. These sales resulted in losses to the owners of the underlying copyrighted products of nearly $20 million.  After receiving complaints from copyright holders about Ferrer’s website, an undercover FBI agent made a number of purchases of business and utility software from the site, which were delivered by mail to addresses in the Eastern District of Virginia. Ferrer pleaded guilty before Judge Ellis on June 15, 2006, to one count of conspiracy and one count of criminal copyright infringement for selling pirated software through the mail."

Back in the early 1990’s I did some software audits at some companies, one of which had only one legitimate software package amongst around 500 different software packages.  Many of the other companies I reviewed were not that much better.  That was at a time when illegal software copying was running rampant among many (perhaps most) businesses who were trying to save money and didn’t really understand the concept of software licensing and copyright compliance.  At that time the Software Publisher’s Association (SPA) was becoming very active in fighting illegal software licensing. 

The Business Software Alliance (BSA) was key to the investigation in this particular case.  I wonder how many businesses were customers of this guy?  I believe most businesses now try to be compliant with software licensing requirements, but I can see how small and medium sized businesses (SMBs) could have purchased from this guy in an effort to try and save money not realizing they were purchasing illegal software.  Wonder how long it will take the BSA to contact all his customers to tell them to destroy their software and purchase legitimate copies?

Example 2:

The New Jersey Attorney General’s office reported, "Michigan Man Gets 30 Months for Conspiracy to Order Destructive Computer Attacks on Business Competitors" on August 25, 2006.  His co-conspirator got sentenced to 5 years in prison. 

"U.S. District Judge Joseph E. Irenas also ordered Jason Salah Arabo, 19, of Southfield, Michigan, to make restitution of $504,495 to his victims ‚Äì the websites he targeted as well as an Internet hosting company.  Arabo pleaded guilty today before Judge Irenas on April 12, to a one-count Information charging him with conspiracy to cause the transmission of a program, information, code, and command, and as a result of such conduct, intentionally cause damage without authorization, to a protected computer. In pleading guilty, Arabo acknowledged that in 2004, he ran two web-based companies, www.customleader.com and www.jerseydomain.com, that sold sports apparel, including reproductions of sports uniforms, popularly known as ‚Äúretro‚Äù or ‚Äúthrowback‚Äù jerseys."

Arabo was 16 when these attacks occurred.  So young…where were the people who should have been modeling good ethical behavior for him?  This really points out a need to incorporate information security and ethical computer use within our school systems as well as within our homes whenever and however possible.  This is not a new issue; in 1994, a National Computer Ethics and Responsibilities Campaign (NCERC) was launched  to create an "electronic repository of information resources, training materials and sample ethics codes" that would be available on the Internet for IS managers and educators.  The National Computer Security Association (NCSA) and the Computer Ethics Institute co-sponsored NCERC. The NCERC Guide to Computer Ethics was developed to support the campaign.  However, it appears now that it is only available via hard copy by postal mail request.  Too bad it is not available online to make it easier to raise awareness and educate everyone about computer use and the ethical impacts.

"According to Assistant U.S. Attorney Eric H. Jaso, who prosecuted the case, Arabo admitted that in online ‚Äúinstant message‚Äù conversations he met a New Jersey resident, Jasmine Singh, who communicated using the online name ‚ÄúPherk.‚Äù Arabo learned that Singh had covertly infected some two thousand personal computers with programs that enabled him to remotely control them. Singh demonstrated to Arabo online that he could command these computers to conduct attacks, known as distributed denial of service, or ‚ÄúDDOS‚Äù attacks, on computer servers and disable websites supported by those servers. Arabo admitted that he asked Singh to take down the websites and online sales operations of certain of his competitors. Arabo promised to compensate Singh for the attacks with merchandise, including designer sneakers.  In August 2005 Singh, who was 16 at the time of the attacks, pleaded guilty as an adult to two counts of computer theft in New Jersey State Superior court. He has since been sentenced to five years in prison and ordered to pay $35,000 in restitution for damage caused by the attacks."

Example 3:

On August 25, 2006 Christopher Maxwell, 21, of Vacaville, California was sentenced to three years in prison "for launching a computer attack that hit tens of thousands of computers, including some belonging to the Department of Defense, a Seattle hospital and a California school district.  Maxwell was also sentenced to three years of supervised release. He pleaded guilty in May to federal charges of conspiracy to intentionally cause damage to a protected computer and conspiracy to commit computer fraud.  U.S. District Judge Marsha J. Pechman said the crime showed "incredible self-centeredness" with little regard for the impact on others. She said the prison time was needed as "deterrence for all those youth out there who are squirreled away in their basements hacking.""

"Maxwell and two juvenile co-conspirators were accused of using "botnet" attacks — programs that let hackers infect and control a computer network — to install unwanted internet advertising software, a job that earned them about $100,000.  Three victims testified at Maxwell’s sentencing: a representative of Seattle’s Northwest Hospital, damaged in February 2005; a representative of the U.S. Defense Department, which reported damage to hundreds of computers worldwide in 2004 and 2005; and a former system administrator for the Colton Unified School District in California, where more than 1,000 computers were damaged over several months in 2005."

The US Dept of Justice site indicates the estimated dollar loss of the businesses victims of Maxwell’s crimes were $252,000.  I imagine based upon the length of time over whih the attacks occurred and the number of computers impacted it was likely much more costly when factoring in human hours of lost time, time to hire someone to clean up the damage, and the cost of legal counsel.

The press release from May when the charges were made indicated "Further investigation revealed MAXWELL’s computer intrusions also did more than $135,000 of damage to military computers in the United States and overseas."

Causing downtime and computer problems at hospitals could also have a very real threat to patient health.

These are just three examples, but good representations of the need for a strong information security program that addresses the risks for, and within, each particular organization.  Security must be applied not only to meet the compliance requirements of laws and regulations, but in ways that address the existing threats, risks and vulnerabilities of each organization’s unique environment.   

Technorati Tags
information security
IT compliance
computer crime
software pirating
regulatory compliance
policies and procedures
awareness and training
privacy

The theme of Global Security Week, coming soon, during the week of September 4, is Identity Theft.  If you have a chance to attend, there looks to be a very interesting and enlightening *free* identity theft seminar in Ireland, sponsored by BH Consulting.

"Seminar
Global Security Week Ireland will host a seminar on the dangers posed by Identity Theft to both consumers and businesses alike.  Identify theft is one of the biggest criminal growth areas and impacts people across all spectrums of life.   Highlighting the dangers posed by Identity Theft and how individuals and companies can best prevent becoming victims of this crime will be speakers from the following organisations;

The Garda Bureau of Fraud Investigation
ENISA (the European Network and Information Security Agency)
The Companies Registration Office

A panel discussion will follow, whereby the speakers will answer questions from the audience.

The agenda for the day is ;

14:00 – 14:15     Introduction                                                                – Mathieu Gorge
14:15 – 15:15     Identity Theft in the Real World                                      – Garda Bureau of Fraud Investigation
                        Protecting your online identity                                        – Garda Computer Crime Unit
15:15 – 15:30     Coffee
15:30 – 16:00     Overview of Awareness Programmes in the EU:
                        The First Line of Defence from Identity Theft                    – ENISA (the European Network and Information Security Agency)
16:00 – 16:30     Protecting your Company’s identity
                        ‚Äì including demonstration of CORE                                   – Companies Registration Office
16:30 – 16:50     Panel Discussion ‚Äì How Best to Combat Identity Theft         – Panel chaired by Brian Honan
16:50 – 17:00     Close                                                                          – Brian Honan

The seminar will be hosted in the Burlington Hotel on Thursday the 7th of September from 2:00 p.m.  Registration is open to anyone concerned with Identity Theft."

If you won’t be in the area, think about attending something similar close to you.  Or, better yet for your organization, consider providing a 1/2- to full day seminar about identity theft at your organization during Global Security Week.  You can invite speakers from your local Infragard, ISACA, ISSA, or other information security professional organization and they can likely find some great speakers for your event. 

Also, if you are in the U.S., check with your state’s Attorney General office and invite him or her to come speak…they are often very willing to speak on the topic; I know the Iowa Attorney General’s office is very good with doing such events.

Technorati Tags
information security
IT compliance
regulatory compliance
identity theft
Global Security Week
policies and procedures
awareness and training
privacy

I just ran across a story from last Friday, August 18.

"ROYAL Bank of Scotland and its NatWest subsidiary were today being investigated for allegedly dumping customers’ financial details in bins. The Information Commissioner’s Office (ICO) is looking into claims that both banks breached data protection rules. It follows a complaint from the consumer group Scamsdirect which apparently found customers’ financial details in bins near two banks in Hampshire. A spokesman for the ICO said: "Clearly, where personal information is not disposed of securely, there is a risk that it will fall into the wrong hands. "We have launched an investigation to establish just what has happened."

Scamsdirect claims it found cut-up credit and debit cards, money deposit details and bank account information in bins near bank branches in Fareham and Southampton.  A spokesman for RBS confirmed the bank had been contacted by the ICO about the complaints. He said: "We take the disposal of customer and bank confidential waste extremely seriously and have procedures in place for the secure storage and disposal of confidential information. "The bags removed by Scamsdirect from our Fareham branches, were general waste bags taken from our dustbins outside the branches."

Identity theft, where fraudsters get hold of personal information and use it to buy goods without the victim’s knowledge, is estimated to cost the UK economy ¬£1.7 billion."

Scamsdirect looks like an interesting organization.  Businesses certainly would like to stay out of their sights.  However, when oversight agencies don’t enforce the laws, it is good to know there are groups such as this exposing privacy risks that should not even exist with proper policies and procedures.

The Royal Bank of Scotland is a large company; but their posted privacy and security policies only apply to their website.

Even though the sensitive information was "cut-up" it is implied from the report that the information itself was still easy to ascertain.

Well, although the Royal Bank of Scotland says they "take the disposal of customer and bank confidential waste extremely seriously and have procedures in place for the secure storage and disposal of confidential information" it appears these procedures have not been well communicated to their personnel. 

FYI:  ¬£1.7 billion is approximately equal to US$3.21 billion.

This is one more example for your awareness files of how incidents happen when improperly disposing sensitive information.  The bad press definitely did not help their business, or create trust with their customers.

Technorati Tags
information security
IT compliance
data disposal
identity theft
regulatory compliance
policies and procedures
awareness and training
privacy

I am so very, very thankful that the terrorist plans for exploding passenger planes were prevented from being carried out.  Thank goodness for having intelligence in the right place in the right time to save thousands of lives. 

But, I am still mad that the terrorists have still disrupted lives and, as a result of new safety precautions, have put information at even more security and privacy risk than it was before the plot was foiled. 

Yesterday Computerworld reported the UK has banned electronic items, including all types of computers, iPods and cell phones, on board airplanes.  As the article points out, this restriction puts these objects not only at high risk of being stolen or lost, but also damaged.  Yes, you’ve seen baggage handlers tossing bags 3 and 4 feet and more through the air, haven’t you?  Not to mention having your laptop stowed in the belly of the aircraft under a few hundred pounds of other luggage, shifting and bumping on and against it throughout the flight.

This electronics restriction currently only applies to flights to, from and through the UK from what I can find.  But, given the current world events, it is not beyond the realm of possibility that such a restriction will also be applied in other parts of the world. 

The article provides four security measures for travelers with eletronics to deal with such restrictions.  At a high level, they are:

• Back up data
• Use Passwords
• Use Encryption
• Have Insurance

All good ideas, but still leaving data at risk of loss, theft, inappropriate access, and they still don’t protect your computer from damage.

So, a few more ideas for you to consider…

• When traveling, use an old laptop loaded only with the software you need to use during your trip.  I have such a laptop, and it works great.  If you can connect through a VPN to access your software and data, then you really don’t need to have a laptop loaded with your complete software suite if you can securely access your applications and data on your corporate network.
• Do *NOT* load any sensitive data on your laptop that you use while traveling.  If you need to take data with you, take ONLY what you really need, and encrypt it on a DVD or CD that you have locked away securely in a separate bag.  If you really must have data on your laptop, have it strongly encrypted.  For goodness sake, do not take entire databases of personal data with you…no one needs to travel with information about thousands of people on their hard drive, DVD or CD.
• If you must travel with your usual computer, invest in a good, hard-side, combination locking laptop case.  The airlines have approved certain combination locks available to use (yes, I know it still doesn’t protect against the dishonest airport worker with the ability to bypass the combination).  There are some decent hard cases out there that appear to be able to possibly even survive a Samonsite gorilla stomp.  eBags has quite a variety of them.
• Sign up for a laptop tracking tag and service.  There are many possibilities listed on the dmoz site.  While this may not prevent laptop theft, it can help to get your laptop, Blackberry, iPod, cell phone, etc. back if it is located, confiscated or found.
• Attach one of those high-decibel eardrum-piercing alarms on your laptop and configure to go off if someone opens or turns on your laptop.  Yeah, yeah…this one could lead to problems with airport security, depending on the airport and if they will actually open the laptops being checked.  However, it would certainly make any potential thief think twice about keeping an attention-grabbing screaming laptop in his or her hot little hands while running through a crowded area.

Technorati Tags
information security
IT compliance
regulatory compliance
airline safety
laptop security
encryption
policies and procedures
awareness and training
privacy

An interesting discussion of the repurcussions of a hack at Ohio University in May was discussed by Adam Dodge yesterday. 

“The computer system contained biographical information for more than 300,000 individuals and organizations, including the Social Security numbers of more than 137,000 individuals” was penetrated by unknown persons. A later report indicated that another breach exposed the Social Security numbers and also health records of “60,000 people including all current students as well as some school faculty.”

There are many studies about how organizations can lose customers following an incident.  Funding for universities typically comes from a wide range of sources, such as alumni donations, grants, etc.  This article is interesting in that it talks about some of the reactions from alumni and students.  What’s also interesting about this is that this incident occurred from a hack into the university’s computer system…a laptop wasn’t lost, backup tapes weren’t stolen, or some other general end-user error.  From what I understand from what has been reported the hack was possible because of inadequate security on the system.  As a result, as the article states, the university has suffered:

• Negative publicity and resulting loss of trust and damaged reputation
• Threats of lawsuits
• Lost donations
• General rants and complaints
• Bills for the time spent to check credit reports

A few other impacts not stated in the article that will likely, or at least could, occur include:

• Large legal fees to address the lawsuits
• Potential regulatory noncompliance findings
• The potential fines, penalties and other judgments
• Costs to hire more personnel to handle the fallout (phone calls, letters, reporter questons, etc.)
• Upgrading systems to make them more secure (which should have been done to begin with) and implementing additional safeguards
• Increased PR efforts to counteract the impacts from the first list
• Lost students and potential students
• Lost faculty and employees
• Lost funding, grants and other revenues educational institutions rely upon as part of their total funding
• Increased insurance premiums for the various types of liability and other risk insurance that universities carry
• Potentially having programs and classes cut because of the overall impact of the revenue loss and other impact costs
• And probably several others…

There are always important lessons to learn from the pain, misfortune and incidents of others.  It’s better, in all ways, to prevent bad things from happening, at least doing everything you can and showing due diligence to prevent bad things, than to wait until after an incident occurs.

Technorati Tags
information security
IT compliance
regulatory compliance
incident impact
hacker
policies and procedures
awareness and training
privacy

I read an interesting brief article today by Dr. Arnat Leemakdej, "Breaking down programming for non-programmers."  It focuses on turning "government officers into an army of programmers" in the easiest and most efficient way possible using fourth-generation languages (4GL).  (Please, you skeptics, no laughing…I’m not going to address the feasibility of that today.)  It provided a very high-level overview.  The goals are:

"Goal #1: The tool has to be easy. A non-programmer can write a business description much like a human language and mix and match activities to create a process. The tool has to be able to grab that language, understand what the writer is trying to do and then do it.

Goal #2: Since the main servers are all over the place with all kinds of security and firewalls in place, the system needs to be able to access disparate servers regardless of their environment. So web service support is mandatory since it uses standard XML asynchronous messaging infrastructure. The web services mechanism will also maintain security via several authentication methods. Reliability can be implemented through MOM or Enterprise Service Bus (ESB). So Service Oriented Architecture (SOA) is an ideal choice."

I’ve been speaking to organizations and writing about the need to integrate security and privacy into the applications and systems development process for several years.  While Goal 2 in the excerpt discusses security, it really only touches upon security as being provided by firewalls and authentication.  Of course there is so much more than that. 

"But once the UI and web services are in place, the business owner can mix and match the process flow however he wants without bothering the tech guys. When the rules change, he just rewrites his business process using available templates."

I’m all for streamlining development and ensuring efficiency.  However, with any application being built, security and privacy must be considered and integrated appropriately.  This is critical not only for compliance requirements, but also to keep security incidents from happening and to maintain privacy appropriately.  I really the article indicates "once the UI and web services are in place" but security and privacy must still be considered at all points along an application lifecycle, even when it is just being mixed and matched. 

The tech guys and the information security and compliance guys should definitely be involved ("be bothered") if the application involves personally identifiable information (PII), or connections outside the enterprise, and sometimes within the enterprise when communicating between different security zones. True, there may be times where, if these applications are small and only used within the department and generating no new data, there may not be a need to "bother" the tech or security folks.  However, how to make that decision should clearly be documented, preferably within a decision tree with accompanying documentation.  Don’t assume the business folks will know what to do or the appropriate times to contact IT and info sec.

The article provided a sample business process.  Such processes should be used to map out the information security and privacy activities throughout development.  A high level example could be similar to the notes I’ve added into the sample within the article (organizations need to add more detail for their own specific situation).

"- Activity 1: customer files request."

Privacy and info security issues to address; you may need to do a privacy impact assessment (PIA) or risk analysis:

• Is the request via the Internet?  A public kiosk?  An electronic request from somewhere outside the enterprise network?
• Is PII collected?  How will it be encrypted?
• Is identity verification and/or authentication necessary?
• What laws, regulations and/or contractual requirements cover this activity?  What controls are need to be built in to meet compliance?

"- Activity 2: operator enters request. "

Privacy and info security issues to address; you may need to do a privacy impact assessment (PIA) or risk analysis:

• Does the information entered need to be encrypted?
• Where does the request go?  To an outside entity?  Does it stay internal to the enterprise network?
• Does PII cross any country borders?

"- Activity 3: system sends all entered data to Organisation A’s web service for posting on central server. "

Privacy and info security issues to address; you may need to do a privacy impact assessment (PIA) or risk analysis:

• Is the web service an outside entity?  If so, do they have security in place to protect the data?
• Are backups made of the data?
• What are the controls for access to the data on the central server?

"- Activity 4: Organisation A sends back acknowledgement that everything is okay. "

Privacy and info security issues to address; you may need to do a privacy impact assessment (PIA) or risk analysis:

• How does the ackowledgement get sent?  Via website? Email?  Some other method?
• Does the acknowledgement contain PII?  If so, how will it be encrypted?
• Is the acknowledgement worded in such a way that complies with applicable laws and regulations?

"- Activity 5: operator informs customer. "

Privacy and info security issues to address; you may need to do a privacy impact assessment (PIA) or risk analysis:

• How is the customer informed?
• Does an audit log of this activity need to be generated?

"- Activity 6: customer can make payment to operator. "

Privacy and info security issues to address; you may need to do a privacy impact assessment (PIA) or risk analysis:

• In what ways can payment be made?
• What need to be done to meet regulatory, PCI, etc. compliance?
• What are the security risks involved with each method?
• What are the legal requirements for each method?

"- Activity 7: operator prints out receipt for customer."

Privacy and info security issues to address; you may need to do a privacy impact assessment (PIA) or risk analysis:

• Where is the receipt printed?
• Is it a hard copy print?  What are the safeguards that need to be in place?
• How is the receipt sent to the customer?  What are the risks involved?

 
This is a very rudimentary exercise, but should give you an idea of the types of considerations that need to be made for integrating security and privacy into applications and systems, even for 4GL and BPAL apps. 

If organizations can consistently integrate security and privacy into the applications and systems development process many incidents and noncompliance issues can be prevented from materializing once the application or system is in production.

Wouldn’t that be nice?  🙂

Technorati Tags
information security
IT compliance
regulatory compliance
SDLC
system development
policies and procedures
awareness and training
privacy

Today I read in the Chicago Sun-Times that CS Stars (not sure this is the same organization’s website, but it appears as though it could be), a contractor for the state of New York, could not locate a personal computer New York State provided to them which contained the names, addresses and Social Security numbers "of as many as 540,000 injured workers."

"CS Stars had been using the computer to move the data from the state to the company’s computerized claim system, according to the letter."

CS Stars is based in Chicago but also has an office in New York.

This story brought many questions to mind…

• Were they sending the data by physically taking it on a computer because they thought this was more secure than sending it electronically?
• The article indicates it was missing from "a secure facility of the company," so it appears it was not lost while in transit.  Wonder what constitutes a "secure facility"?  The front door is locked?  A locked desk drawer?  A facility with guards, two-factor authentication to get in the door, and surveillance cameras?  It is always interesting to read these reports of security incidents and see the terminology used.  A secured facility is very subjective and could mean a very wide spectrum of things.
• If the facility was such that only authorized people had access to the computer, then it is likely the theft (if it was a theft and not just a misplaced computer now stuck under someone’s desk to prop up their feet, perhaps) was done by an insider.  This would make the data more likely to be at risk if the person knew the type of data on it and planned to use it to commit some potentially lucrative cybercrime.

This story coincidentally came out after I had just visited the Identity Theft Resource Center where they reported "In 2005 there were 151 incidents affecting more than 57.7 million people. Approximately half of the breaches were educational institutions. 16% were banking, credit or financial services. We are tracking 2006 currently. As of the end of April there were nearly 80 large breaches."

Information from the FTC and the Secret Service/CERT Insider Threat Studies show how vulnerable information is to being compromised by insiders with authorized access. 

It will be interesting to see if any more is published about this investigation, and if it was an inside job.

Technorati Tags
information security
IT compliance
cybercrime
insider threat
lost computer
personal information breach
privacy breach
policies and procedures
awareness and training
privacy

Very surprisingly today I read in The Guardian Unlimited report from a couple of days ago that "Free credit monitoring for veterans whose personal information was stolen has been withdrawn, the Bush administration said Tuesday, because the laptop containing their data has been recovered." 

Data can be copied from hard drives and other storage media without leaving behind any evidence it was copied.   

Today there was also a story about this on the Washington AP Wire.

"Testifying to a Senate panel, Nicholson acknowledged there were no 100 percent guarantees that names, birthdates and Social Security numbers stored on a VA employee’s stolen laptop and external drive were not accessed or copied. But he said the low risk did not justify a year of personalized monitoring at a taxpayer cost of $160.5 million. "Facts have changed, the situation has changed," Nicholson said, noting that the stolen equipment has been recovered and that the FBI determined with a "high degree of confidence" that the data was not compromised.  Speaking of veterans groups, some of whom are fiercely opposed to the decision, Nicholson added: "Some oppose, but some concur, thinking it would be a waste of $160.5 million.""

So…it’s about the money?  It would be interesting to know what facts have changed…do they know where the stolen equipment was all along? 

"Nicholson said the VA was in the process of hiring a company to provide data breach analysis to detect potential patterns of misuse of data. In addition, the department planned to send letters to veterans informing them of free services already available to all citizens, including free monitoring for 90 days and credit reports three times a year."

The credit monitoring services already have the systems in place to be able to detect these types of potential misuse…but the VA is going to hire a company to do this?  How will the monitoring a hired company does be able to detect "potential patterns of misuse"?

26.5 million individuals…

Technorati Tags
information security
IT compliance
government
data protection
VA privacy breach
credit monitoring
privacy