Today the FTC announced, "FTC Puts a Permanent Halt to Illegal Spamming Operations" in a press release about some actions, fines and penalties they just made.

A high-level summary of the judgments:

• Violations of the CAN-SPAM Act and the Adult Labeling Rule will cost Cleverlink Trading Limited $398,000 (Actual judgment was $2,635,000.00; the judgment was suspended except for: (1) $303 000 to be paid to the FTC (2) $95,000 to be deposited by Defendant Muir into an escrow account to facilitate tax payments, but the full amount could be reinforced if all conditions of the judgment are not met) plus a freeze on their corporate assets, plus implementing various types of compliance activities and documentation on an ongoing basis for the next 3 and 6 years to confirm their compliance. 
• Violations of CAN-SPAM will cost Zachary Kinion $151,001.64 ("suspended because of his inability to pay," but the full amount could be reinforced if all conditions of the judgment are not met) plus implementing various types of compliance activities and documentation on an ongoing basis for the next 3 and 6 years to confirm their compliance.   
• Violations of CAN-SPAM and the Adult Labeling Rule will cost William Dugger, Angelina Johnson, and John Vitale $8,000 (the defendants were liable for $597,166, but it was reduced to the amount in the defendants bank accounts, but the full amount could be reinforced if all conditions of the judgment are not met) plus implementing measures to obtain permissions.  They also had a freeze on their corporate assets, plus implementing various types of compliance activities and documentation on an ongoing basis for the next 5 and 8 years to confirm their compliance. 
• Violations of CAN-SPAM will cost BM Entertainment and B Pimp $24,193 ("suspended because of his inability to pay," but the full amount could be reinforced if all conditions of the judgment are not met). The owner of the organizations also pleaded guilty to criminal charges related to spam and unauthorized possession of access devices and is awaiting sentencing.  He must also implement various types of compliance activities and documentation on an ongoing basis for the next 3 and 6 years to confirm his compliance.    

At first glance the suspensions of the fines are disappointing.  However, considering the asset freezes and also ongoing monitoring and reporting, with the possibility of having the original fines reinstated, this seems reasonable.

CAN-SPAM actually has had quite a bit of compliance activity since it has been inacted, along with the Adult Labeling Rule.

Technorati Tags
information security
IT compliance
policies and procedures
corporate governance
CAN-SPAM
Adult Labeling Rule
FTC
awareness and training
privacy

Time magazine ran an interesting story in their 9/11 issue, "Snooping Bosses" that discussed multiple privacy issues within the workplace.  They provided a sidebar that truly should be common sense to anyone working in this day and age.  I’ll go over it later…it’s not on their site…

The article started with a great story about security guard who was fired for playing hooky…he called in sick, but his company-provided cell phone had a GPS system that showed him on the road to Reno…ultimately the unemployment ax fell.

Here are a few interesting excerpts with statistics you will find surprising…or perhaps not…

• "Nine out of 10 employers observe your electronic behavior, according to the Center for Business Ethics at Bentley College."
• "A study by the American Management Association and the ePolicy Institute found 76% of employers watch you surf the Web and 36% track content, keystrokes and time spent at the keyboard." & "38% hire staff to sift through your e-mail."
• "A June survey by Forrester Research and Proofpoint found that 32% of employers fired workers over the previous 12 months for violating e-mail policies by sending content that posed legal, financial, regulatory or p.r. risks."

I would think the numbers in the first two bullets are actually higher.  With today’s regulatory requirements, need to demonstrate due diligence, and studies such as those referenced below, it just makes good business sense to monitor certain electronic communications…in reasonable ways.  If personnel violate published and communicated corporate policies they should face sanctions, and sometimes those will need to be dismissal.

• "45% of us admit that surfing is our favorite time waster, according to a joint survey by Salary.com and AOL"

See…no wonder employers are monitoring!!  I’ve read other reports as well that indicate personnel spend anywhere from 8 – 20 hours per week surfing.  If you were paying someone to do work and they were sitting on the clock submitting bids on eBay or spending hours on Match.com, wouldn’t you be a little more than a bit ticked off?

• "A Northeast technology company found that several employees who frequently complained of overwork actually spent all day on MySpace.com"

This is funny and sad simultaneously.  They probably did feel tired from all their MySpace.com chatting and viewing…poor carpel-tunnel fatigued folks.

• "Slightly more than half of employers surveyed monitor how much time their employees spend on the phone, and even track calls–up from 9% in 2001."

Over 50% monitoring calls.  Not that surprising.  Quite interesting how much it has increased since 2001, though.

• "Workers at Google, Delta Airlines and Microsoft have claimed their blogs got them fired."

Do you have policies regarding what your personnel cannot post to blogs with regard to your company?  Not only can information blogged about your company be embarrassing and cause PR problems, it is also very easy for confidential information to be inappropriately posted within blogs.

• "In Thompson v. Johnson County Community College in Oklahoma, the court held that employees had no expectation of privacy in a locker room because the room had pipes that required occasional maintenance. (The need to service the pipes was enough for the court to let the employer use video surveillance.)"

ICK. Where were those CCTVs pointed?  Although there are safety and physical security reasons for CCTVs, putting them in locker rooms still seems at first blush (so to speak) a little too far.  Hopefully they communicated or had signs indicating the areas that were visible to the CCTVs.

• "At Citywatcher, a Cincinnati, Ohio, company that provides video surveillance to police, some workers volunteered to have ID chips embedded in their forearms last June."

I’ve read other articles about this.  This really does take the 2-factor authentication concept of something you have and something you are to a whole new level.  What happens if the folks are fired?  Or, if they decide to quit and not come back to work?  There’s probably some way to disable them, but still…I’m not sure all the potential negative impacts of creating Johnny Mnemonic-like employees in our workplace have really been explored and addressed.

The sidebar lists "precautions" that should not only be common sense by now, but should also have been covered multiple times through a good information security and privacy training and awareness program.  At a high level these 9 precautions include:

1. "Know your company’s policies"  DUH.  However, if the information security and privacy folks are NOT telling personnel what the policies are, then personnel will not know and will likely then do bad or dangerous things with your organization’s information assets.
2. "Surf the web sparingly"  This is not only good for the company’s bottom line (hey, they are paying you to work, folks), but it is good for information security to help keep the electronic nasties from finding their way into your network.
3. "Think twice before you hit "Send""  Most definitely.  I blogged about this recently. 
4. "Proofread profiles"  This warns the personnel to make sure their own profile information on their blogs, in their emails, etc.  will not result in your company manager, or worse HR person, calling them in to have a serious discussion about their profession-limiting activities.
5. "Snail-mail your resume"  This is so earlier edits do not hang around in them, and also so your boss does not see you are sending your resumes to other organizations.
6. "Hold your tongue"  This warns not to leave voice mails you will later regret.  This happens way too many times.  Voice mails have been used extensively as evidence in court.
7. "Forward with care"  Another email oops that I have discussed
8. "Use passwords"  DUH.  Info sec and privacy folks, you should be telling your personnel about all issues related to all types of passwords.
9. "No porn at work"  This is beyond, DUH…c’mon folks!  You’re getting paid to work, not testing to see if you need the little blue pill.

Technorati Tags
information security
IT compliance
policies and procedures
corporate governance
employee privacy
awareness and training
privacy

There was a nice article in the 9/11 issue of Newsweek that points out that, even if there are no items considered as personally identifiable information (PII) being collected or publically disseminated or posted on websites, the collection and interpretation of non-PII could actually reveal the persons involved, thus revealing their private activities, "aspirations and dreams."

However, Google, Yahoo and others who aggregate similar indicate that

"the information extracted from studying the way individuals search has been crucial in raising the quality of search to its present level. "Our searches have improved dramatically because we have that data," says Alan Eustace, Google’s senior vice president of engineering and research. Furthermore, they contend that without the information, they would be severely hobbled in further improving their products. "If you don’t have such data, there would be significant compromise of the user experience in the future," says Prabhakar Raghavan, Yahoo’s head of research." 

And, as the article points out, the government is also interested in the data…likely because it could point to specific individuals and groups as potential criminals and terrorists.

Does your company collect, aggregate, data mine and/or publicly post similar types of de-identified information to primarily improve your products or services?  Or, to enhance your marketing efforts?  If a secondary impact is that certain individuals’ activities, likes and dislikes, and thoughts are revealed, would you be concerned?  Would your business leaders be concerned?  What if, as a result, their own aspirations and dreams were revealed…or those of their living or deceased loved ones?

Before you decide that, just because there is no specific law against doing so, that you are going to aggregate the electronic traces and movements of your customers, employees or consumers in order to improve your products or services, take a good hard look at what the ultimate consequences could be; both to the individuals and to your company if the public decides that you stepped over the line and took it upon yourself to eavesdrop into their lives just for the greater good of your bottom line revenues.

Technorati Tags
information security
IT compliance
policies and procedures
corporate governance
data mining
awareness and training
privacy

There was a nice article in the 9/11 issue of Newsweek that points out that, even if there are no items considered as personally identifiable information (PII) being collected or publically disseminated or posted on websites, the collection and interpretation of non-PII could actually reveal the persons involved, thus revealing their private activities, "aspirations and dreams."

However, Google, Yahoo and others who aggregate similar indicate that

"the information extracted from studying the way individuals search has been crucial in raising the quality of search to its present level. "Our searches have improved dramatically because we have that data," says Alan Eustace, Google’s senior vice president of engineering and research. Furthermore, they contend that without the information, they would be severely hobbled in further improving their products. "If you don’t have such data, there would be significant compromise of the user experience in the future," says Prabhakar Raghavan, Yahoo’s head of research." 

And, as the article points out, the government is also interested in the data…likely because it could point to specific individuals and groups as potential criminals and terrorists.

Does your company collect, aggregate, data mine and/or publicly post similar types of de-identified information to primarily improve your products or services?  Or, to enhance your marketing efforts?  If a secondary impact is that certain individuals’ activities, likes and dislikes, and thoughts are revealed, would you be concerned?  Would your business leaders be concerned?  What if, as a result, their own aspirations and dreams were revealed…or those of their living or deceased loved ones?

Before you decide that, just because there is no specific law against doing so, that you are going to aggregate the electronic traces and movements of your customers, employees or consumers in order to improve your products or services, take a good hard look at what the ultimate consequences could be; both to the individuals and to your company if the public decides that you stepped over the line and took it upon yourself to eavesdrop into their lives just for the greater good of your bottom line revenues.

Technorati Tags
information security
IT compliance
policies and procedures
corporate governance
data mining
awareness and training
privacy

The FTC is much more aggressive in charging fines and penalties for noncompliance regulations than most of the other oversight agencies.  Their dedication for upholding the FTC Act, the Children’s Online Privacy Protection Act (COPPA) and others should grab the attention of business leaders who think they can ignore data protection laws and not worry about any penalties.

This also demonstrates that as time goes on the penalties and fines for noncompliance and violations can increase dramatically.  Consider the history of COPPA penalties and violations; just a few of them over a timeline shows that the FTC is clearly becoming more serious about making an impact with their penalties:

• $10,000:  American Popcorn Company, 2002
• $30,000:  GirlsLife.com, 2003
• $35,000:  Looksmart, 2003
• $35,000:  BigMailbox.com, 2003
• $85,000:  Hershey Foods, Corp., 2003
• $100,000: Mrs. Fields Cookies, 2003
• $75,000:  Bonzi Software, 2004
• $400,000:  UMG Recordings, 2004
• $1,000,000: Xanga.com, August 2006

Xanga.com Inc becomes infamous as getting the largest penaly to date, $1,000,000.

What will be the next COPPA violator get?  Potentially more, and perhaps additional requirements that the FTC has ordered for non-compliance with the FTC Act, such as implementation of a comprehensive information security program and bi-annual independent audits of their programs for the next 20 years?  It’s all possible.

When other oversight agencies start enforcing their regulations in ways that impact businesses more, then all business leaders will have to take notice and respond with compliance efforts or end up finding their business pockets will have the hands of the government taking significant $$ out of them as a result.

For those of you leery of visiting government web sites (yes, some of you have told me you are!) at the bottom of this posting is the FTC press release regarding the Xanga.com penalty.  Notice that the company appeared to have followed a few of the COPPA requirements, but then did not build in the controls within the website application to ensure all the compliance requirements were in place, and also did not create the required procedures for parental permissions.  Another example of the importance of building information security and privacy into the applications and systems development lifecyle, from project birth to burial. 

What is not in the press release, but contained within the consent decree and order, is that Xanga.com must also:

• Post the following notice conspicuously on their website:  "NOTICE: Visit www.ftc.gov/privacy for information from the Federal Trade Commission about protecting children’s privacy online."
• Must conspicuously post the following on websites with blogs:  "Visit www.OnGuardOnline.gov for social networking safety tips for parents and youth [‚Äúparents‚Äù must contain a hyperlink to < www.onguardonline.gov/socialnetworking.html > and ‚Äúyouth‚Äù must contain a hyperlink to < www.onguardonline.gov/socialnetworking_youth.html >"
• Must delete the personal information they have collected about children that was in violation of COPPA (basically all the children’s PII)
• Immediately implement awareness and training to all their personnel and managers about the requirements of COPPA and submit the names of all to the FTC, and continue to do this for at least the next 5 years.
• Submit to the FTC their detailed plans for complying with COPPA, including copies of the messages that will be sent to parents, methods of obtaining approval, etc.
• Maintain copies of all parental approvals for specified periods of time

So this will result in significant additional costs for ongoing years on top of the $1M penalty.  Of course, they should have been doing the requirements for notice, retention and training and awareness to begin with.

Okay…on to the FTC press release:

"Xanga.com to Pay $1 Million for Violating Children’s Online Privacy Protection Rule

Civil Penalty Against Social Networking Site Is Largest Ever for a COPPA Violation

Social networking Web site operators Xanga.com, Inc. and its principals, Marc Ginsburg and John Hiler, will pay a $1 million civil penalty for allegedly violating the Children’s Online Privacy Protection Act (COPPA) and its implementing Rule, under the terms of a settlement with the Federal Trade Commission announced today.

According to the FTC, Xanga.com collected, used, and disclosed personal information from children under the age of 13 without first notifying parents and obtaining their consent. The penalty is the largest ever assessed by the FTC for a COPPA violation, and is more than twice the next largest penalty.

The complaint charges that the defendants had actual knowledge they were collecting and disclosing personal information from children. The Xanga site stated that children under 13 could not join, but then allowed visitors to create Xanga accounts even if they provided a birth date indicating they were under 13. Further, they failed to notify the children’s parents of their information practices or provide the parents with access to and control over their children’s information. The defendants created 1.7 million Xanga accounts over the past five years for users who submitted age information indicating they were under 13.

‚ÄúProtecting kids‚Äô privacy online is a top priority for America’s parents, and for the FTC,‚Äù said FTC Chairman Deborah Platt Majoras. ‚ÄúCOPPA requires all commercial Web sites, including operators of social networking sites like Xanga, to give parents notice and obtain their consent before collecting personal information from kids they know are under 13. A million-dollar penalty should make that obligation crystal clear.‚Äù

Xanga.com – Xanga.com is one of the most popular social networking sites on the Internet. After setting up a personal profile, users can post information about themselves for other users to read and respond to. On Xanga.com, users can create their own pages or Web logs (blogs) that contain profile information, online journals, text, hypertext images, as well as links to audio, video, and other files or sites. Information on the Xanga site is available to the general public through the use of global search engines such as Google and Yahoo.

Incorporated in 1999 and based in New York City, privately held Xanga.com, Inc. was founded by Ginsburg and Hiler. In 2005, Xanga had about 25 million registered accounts.

The Commission’s Complaint – According to the Commission’s complaint, the defendants violated COPPA, the COPPA Rule, and the FTC Act by collecting personal information from children with actual knowledge that they were under the age of 13, failing to post on their site sufficient notice of their information practices regarding children, failing to notify parents directly about their information practices regarding children, and failing to obtain verifiable parental consent before collecting, using, or disclosing children’s personal information. The complaint also alleges the defendants failed to provide parents with reasonable access to and control over their children’s information on the Xanga.com site.

The Consent Order- The consent order is designed to prohibit Xanga, Ginsburg, and Hiler from violating COPPA and the COPPA Rule in the future. Accordingly, it contains strong conduct provisions that will be monitored by the FTC. The order specifically prohibits the defendants from violating any provision of the Rule and requires them to delete all personal information collected and maintained by the site in violation of the Rule. The defendants further must distribute the order and the FTC’s How to Comply with the Children’s Online Privacy Protection Rule to certain company personnel. The order also contains standard compliance, reporting, and record keeping provisions to help ensure the defendants abide by its terms.

To provide resources to parents and their children about the risks associated with social networking sites, the order additionally requires the defendants to provide links on certain of their sites to FTC consumer education materials for the next five years. First, the defendants must include a link to the Children’s Privacy section of the Commission’s ftc.gov site on any site they operate that is subject to COPPA. Second, the defendants must include links to the Commission’s recently published safety tips for social networking on any of their social networking sites.

The order requires the defendants to pay a civil penalty of $1 million for violating the COPPA Rule, as detailed above.

The Commission vote approving the complaint and consent decree and order was 5-0. They were filed by the Department of Justice on the FTC’s behalf on September 7, 2006, in the U.S. District Court for the Southern District of New York.

NOTE: Stipulated final judgments are for settlement purposes only and do not necessarily constitute an admission by the defendants of a law violation. Stipulated judgments have the force of law when signed by the judge.

Copies of the complaint and consent decree and order are available from the FTC’s Web site at http://www.ftc.gov and also from the FTC’s Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices in the marketplace and to provide information to help consumers spot, stop, and avoid them. To file a complaint in English or Spanish (bilingual counselors are available to take complaints), or to get free information on any of 150 consumer topics, call toll-free, 1-877-FTC-HELP (1-877-382-4357), or use the complaint form at http://www.ftc.gov/ftc/complaint.htm. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad."

Technorati Tags
information security
IT compliance
policies and procedures
corporate governance
COPPA
noncompliance penalty
FTC
Xanga
awareness and training
privacy

The number of information security and privacy incidents are not on the decline; quite to the contrary.  As the amount of data and information continues to grow exponentially, as the flavors of information technologies continue to be cooked up and become quickly ladled into the business environment, as computers and data bytes become more mobile, and as the ethereal world gets more intimate as systems continue to become interconnected, more incidents will occur, more data protection laws will emerge, and more ways to compromise data and systems will continue to appear. 

Establishing effective privacy and information security strategies has moved to the top of the list for companies maintaining customer and employee information. However, there are often gaps in communication and coordination between privacy and information security activities, creating risks for incidents, duplication of effort, contradictory privacy and security initiatives, along with contractual and regulatory noncompliance.

Successful efforts require privacy and information security strategies to be complementary and integrated throughout all of the enterprise, within every business process stage and at every level within the organization.  There must be documented processes for addressing information security and privacy throughout the entire applications and systems development lifecycle.  There must be coordinated and mutually supportive information security and privacy awareness and training efforts.  Corporate policies, and website policies, must establish clear requirements for personnel to follow to safeguard information, in addition to complying with applicable laws and regulations.  There must be processes to ensure the security of information entrusted to third parties.  A corporate information security and privacy framework must be built, using the concepts from such already established and globally supported frameworks as COBIT, ITIL, ISO27001 (BS7799), and the OECD privacy principles, to address these, and other, major information security and privacy issues that will turn out to be your company’s security and privacy Achilles’ heel if you don’t.

I had the opportunity to work with Christopher Grillo to create a workshop,"Effectively Partnering InfoSec and Privacy For Business Success" that provides insight into Privacy and Information Security practitioners’ roles and responsibilities within the organization and offers not only guidance and discussion for how to effectively work together, but we have also spent literally hundreds of hours creating tools to help support information security and privacy that we provide to workshop attendees.  Businesses are now successfully using these tools to make their information seccurity and privacy efforts more efficient and effective. 

Within our workshop, through presentation, discussion, and case-studies, attendees will obtain a better understanding of the challenges faced by both information security and privacy, and be able to create a workable framework for integrating efforts. Participants take away tools for building an effective Privacy and Information Security framework, a roadmap for creating synergy between the groups, and many tools and methodologies to start using right away to result in positive business impact. 

If you take our workshop along with the CSI conference in November, you will save $200 on the regular workshop cost.  I was happy to recently learn that CSI is allowing us to give a discount code for our workshop through my blog; if you only want to attend our workshop, then you can save $100 by using the code PR133 when you register. 

If you already have an integrated, highly successful information security and privacy program in place, that is great!!  I know it takes a lot of effort to have a successful program.  You likely have spent a great amount of figurative blood, sweat and tears in making your program effective and successful. 

I also know there are so many new and evolving challenges that even the most dedicated and hard-working information security and privacy professionals can benefit from new ideas, interactions with others, and effective tools and resources.  If you want to improve your information security and privacy programs, or need help establishing them, I hope you’re able to join us.  After all the hard work we put into creating this workshop, I am happy to know that the people who have attended have told Christopher and I that they found it very valuable, and that they were very pleasantly surprised by the large amount of tools and reference material we provided to the workshop attendees.

Technorati Tags
information security
IT compliance
policies and procedures
corporate governance
conference discount
awareness and training
privacy

My business credit card has a great benefit; it gives U.S. Savings Bonds for reaching certain, comparatively low, accumulated charge amounts.  Over the past 7 years I’ve obtained dozens of Bonds that I plan to use for my sons’ college.  Unfortunately the credit card company is discontinuing this at the end of October…guess I’ll have to shop for another card that provides the same type of benefit!

I have always looked forward to getting the Bonds, directly from the U.S. Treasury Department.  The last set of Bonds I received were different, though.  All the previous Bonds had my social security number printed on the bond.  The most recent ones now, instead, have asterisks for the first 5 digits of my SSN, and just show my last 4 digits.  What a nice surprise!  I love to see when government agencies make changes to improve the privacy of our personally identifiable information (PII).  Too many of the agencies are still much too careless with their practices of making PII too easily available, electronically and in printed hard copy documents, for way too many people to see.

Curious to see if they provided any additional privacy enhancements to their practices, I visited their site.  I found their privacy impact assessment (PIA) from last year, required annually of all U.S. government agencies posted.

The table they used on pages 3 – 7 within their PIA is a nice summary format that organizations should consider using as a way to document each type of PII collected.

I would have liked to have seen more analysis of the security practices for the physical copies of PII and also PII that may be located outside their network (perhaps they don’t allow this?); the PIA seemed to focus primarily upon the network computer systems.  I saw nothing about the security of PII on the printed documents, such as Savings Bonds, themselves.

Well, although the change does not appear to be a result of their PIA, it is GOOD to see that now the SSN is no longer printed on the Bond itself. They did provide a webpage discussing the change to SSNs on the Bonds. 

"7/28/2006

Treasury Protects Investor Privacy
To help protect savings bond owners’ privacy and guard against identity theft, the first five digits of the Taxpayer Identification Number (TIN)-the Social Security Number (SSN) or Employer Identification Number (EIN)-will be masked on all paper Treasury savings bonds issued or replaced, starting August 1, 2006. Asterisks will replace the masked digits. For example, an SSN previously shown as 123 45 6789 will be inscribed as *** ** 6789, and an EIN previously shown as 12 3456789 will be inscribed as ** ***6789.

Treasury is taking this action to eliminate the possibility, however remote, that the TIN could be seen by an unauthorized individual and used for identity theft.

This change applies to purchases of Series EE and I paper savings bonds. It also applies to Series E, EE, H, HH and I savings bonds issued in other authorized transactions, such as those involving reissues and replacements for paper bonds not received.

Customers must provide the full TIN with all purchase applications and transactions. Taxpayer Identification Numbers will continue to be used as identifiers in Treasury’s record-keeping system. Bond owners must provide their full TIN when redeeming savings bonds.

Customers receiving paper savings bonds from the Federal Reserve Bank will receive an explanation of this change with their printed bonds."
 

Limiting where SSNs, and other PII, are printed on government documents is a good step toward better privacy practices.

Technorati Tags
information security
IT compliance
policies and procedures
social security numbers
government security
savings bonds
privacy impact analysis
awareness and training
privacy

Yesterday (9/1) the AARP announced a new report they commissioned, "Into the Breach: Security Breaches and Identity Theft."  They provided links to the full report, but unfortunately they do not work!

The press release sounds interesting, though.  A few of the excerpts:

"A new report from the AARP Public Policy Institute (PPI) states that from January of 2005 through May of 2006, 89.8 million Americans were potentially exposed to identity theft as a result of security breaches involving sensitive personal information. As security breaches at high profile institutions have made the public aware of the seriousness of this problem and more concerned about the safety of their personal information, PPI has analyzed the kinds of institutions most often experienced by security breaches and also the most common ways used to gain sensitive personal information.

The report, "Into the Breach: Security Breaches and Identity Theft," closely examined 244 publicly disclosed security breaches that took place from January 1, 2005 through May 26, 2006. It found that educational institutions were more than twice as likely to report a breach as healthcare organizations, financial services companies, corporations, and government agencies.

The report found that 40 percent of the publicly disclosed security breach incidents were caused by hackers or insider access specifically targeting sensitive personal information. Breaches caused by hackers or insider access put the personal information of 50 million individuals (making up 56 percent of all breach victims) at risk of identity theft."

"The report notes that of all the ways used to improperly gain or display personal information, 30% are the result of breaches from the inside."

I wish I could see the full report!  I always like to see what they pick out of the full report to put into the press release.

Something interesting is the finding of the tendency for educational institutions to be more likely to report a breach as opposed to other types of industries.  Considering all the other industry specific data protection laws for such industries as the financial and healthcare, and even more considering that there are at least 33 state level breach notification laws, many of which apply to all types of organizations.  Of course, the study looked back from January 1, 2005, and most of the state level notification laws have gone into effect after that date by several months or even over a year later.

I found one of the statements a little confusing though; 40% of incidents were "caused by hackers or insider access specifically targeting sensitive personal information."  Insiders with authorized access are a very different type of threat than hackers from the outside.  It would have been good to break those two demographics apart.  However, probably the gist of this statement is that the personal information was specifically targetted.  A June 2005 New York Times article reports criminals can get paid $100 for each individual’s personal information.  When you look at how many thousands, and even millions, of individuals’ data are often on stolen computers and within compromised databases that amount of crime profit is quite significant.  Certainly motivation to target such information.

30% of the incidents occurring from the inside is not surprising; actually a little low from what I’d expect.  However, even though the inside threat is nothing new, these types of studies and help to validate the insider threat to business leaders and demonstrate the need for strong information security controls and procedures not only just for preventing access into the network, but also within the network perimeter and for everyone using the network.

The AARP report is timely considering the theme of Global Security Week is identity theft; this is a report you can use and reference within your awareness messages.  In fact, one of the activities going on next week in Texas is a series of presentations to customers at different locations of a grocery store chain by Melissa Guenther .  This particular chain reportedly has a very large percentage of retired folks who are customers, so using this study should resonate with them.

Technorati Tags
information security
IT compliance
policies and procedures
AARP
insider threat
identity theft
Global Security Week
awareness and training
privacy

Periodically I check for research papers posted on university sites about information security, privacy and compliance.  They often contain great ideas, are a wonderful source of research references, stimulate further thinking, and often contain some interesting and forward-thinking proposals that you do not hear about from vendors or practitioners.

Today I ran across a paper posted on the Columbia University site in July of this year, "Privacy as an Operating System Service" by Sotiris Ioannidis, Stelios Sidiroglou, and Angelos D. Keromytis.  There were some intriguing ideas within discussing how to implement pervasive privacy services into the personal computer operating systems typically the majority of non-technical folks use.

I think it is interesting to think of "privacy," what I view as a goal, state or right in some situations, as part of a technical operating system service.  Certainly there are many technical privacy services out there right now, such as with P3P.  Viewing privacy from the strictly technical aspect, then, privacy baked into the operating system is a wonderful goal.  I’ve written often about the need to incorporate privacy and information security into applications and systems, so this is a nice demonstation of a discussion about how to do that within a personal computer OS.  Okay…now to look at a few of the points within the paper and provide a few thoughts…

The concept of removing personally identifiable information (PII) through the OS is quite interesting.  There are a growing number of vendor products out there right now that are attempting this, and most (if not all) have some very big challenges in thoroughly accomplishing this task.

They provide a good list of challenges with implementing privacy within the OS, as follows:

• "Protocol Spanning: The operating system must have knowledge of the data and meta-data representation of applications. It needs to use this information to
  sanitize private information for each application in the system, or at least for those applications that the user has specified. For example, in order to scrub user name information in Microsoft Word and Open Office documents, the scrubbing module will have to be able to parse and according to policy remove user name references in both formats.
• Single Point-of-Failure: Adopting a centralized operating system approach introduces the risk of global failure. If the operating system has a fault in the way it sanitizes private information, all applications will be affected.
• Performance: It is possible that due to the centralized nature of an OS-center solution, that we might cause a performance bottleneck when executing privacy operations."

Yes, protocol spanning would be a huge challenge.  Think about all the possible applications that individual computers users could have, the diversity of all the vendors, and the likelihood that they would all cooporate to allow the type of collaboration and integration that would be necessary.  Most home computer users use a vast variety of software packages that are very unlike business software, and most of them collect and/or use PII in one way or another.  I’m thinking now about all the software packages (educational, interactive, etc.) that my sons use, and I’m not sure how the PII could be scrubbed from those accompanying data storage repositories.  The first thought is, well maybe that is not necessary, since those types of files would not be sent out of the computer anyway.  However, if that computer is also sometimes attached to the Internet, and an incoming probe or spyware makes it way through the personal firewall, then that data would be put at risk.  On the other hand, that is a risk today, so having the privacy in the OS to work with SOME applications would be better than nothing as long as the computer user does not get a false sense of complete privacy by using the OS privacy capabilities.

The paper gives a concise discussion of the challenges of scrubbing PII from meta data, para data and raw data.  However, it doesn’t suggest possible resolutions to these challenges, or even how to go about trying to resolve them.  I would have liked to have seen more about that.

Of course, the primary problem is the definition of what exactly constitutes PII, and then having a common format or look to those PII items.  PII is not universally defined.  Just within the U.S. federal laws, PII is defined in many different ways.  Looking globally you find even more definitions.  Throughout around 90 global laws I’ve found around 50 different specific types of information that are within these legal definitions.  Trying to integrate all would be an insurmountable task, it would seem.  However, if you would pick, let’s just say, the 10 most common or critical types of PII (perhaps those used most commonly for identity theft and fraud) to define globally, that would certainly be a very good start.

Also key is the ease with which the computer user would actually be able to set their own chosen privacy settings.  The goal of having it very easy for a non-technical computer user is certainly a challenge in and of itself even after a usable solution has been found and implemented into the OS.

I would also want such a solution to be customizeable so that you do not have it being TOO aggressive with removing everything it determines as PII from your outbound traffic…there may be instances where you need to send out what at least appears to be valid PII.

Overall this paper was a good high-level look at the concept of implementing privacy within the OS.  While it wandered here and there from the main idea at times, it was thought-provoking (at least it generated all kinds of questions for me as I read it) and is a good discussion centerpiece for this topic.

Technorati Tags
information security
IT compliance
policies and procedures
awareness and training
privacy

The General Services Administration  (GSA) announced on Tuesday (8/29) that they are purchasing blanket credit monitoring services from three different companies at reduced rates to use when data privacy breaches occur.

"Washington DC – The U.S. General Services Administration awarded Blanket Purchase Agreements (BPAs) to assist Federal agencies in protecting the confidentiality of personal credit and payment information, as well as providing a fast and effective solution for Federal agencies needing commercial-off-the-shelf credit monitoring services.

The BPAs were awarded to Equifax, Inc. based in Atlanta, Ga., Experian Consumer Direct of Irvine, Calif., and Bearak Reports, a small, woman-owned firm in Framingham, Mass.

In the wake of recent incidents that threatened the confidentiality of personal information, this action by GSA will allow Federal agencies to take advantage of significantly reduced unit pricing and volume discounting available through these agreements.  They can also select different levels of credit monitoring services depending on the degree of vulnerability, risk, and protection.

The BPAs also eliminate separate contracting and open market costs that result from separate agencies searching for sources, developing technical documents and solicitations, and evaluating offers.  Significantly reduced pricing, strong oversight and reporting, and excellent customer service from these commercially available credit monitoring services are now available on a government-wide basis.   

The BPAs do not obligate funds.  There is no limit on the dollar value of task order purchases made under the BPA.  BPA vendor numbers are as follows:

GS-23F-06-E3-A-0013 Bearak Reports (Woman-Owned, Small)
GS-23F-06-E3-A-0014 Equifax Inc. (Large)
GS-23F-06-E3-A-0015 Experian Consumer Direct (Large)"

This is a good, pro-active move on the part of the government, particularly considering how they’ve mishandled recent and past privacy breaches. 

The Bearak Reports site is interesting.  I think it is a good thing to include a small boutique organization such as this in with two of the other big fish in this industry space.  Bearak Reports offers three different levels of identity theft policies; don’t know which of these the government cut the deal for, but most likely the one with the lowest coverage in consideration they also have the other two companies they can use.

I wonder what the "significantly reduced unit pricing and volume discounting" amounts are?  Seems this would be something the GSA would have to make available to the public.  Perhaps it’s just not posted out there yet…I couldn’t find it on the government sites.  Something to check on next week…

Will the government then fulfill the original promises for credit monitoring they made to the 26.5 million individuals involved with the VA incident that they later reneged upon when the laptop and hard drive were found months later? 

Will they use one one credit monitoring service per incident, or multiple?  Will it depend upon the type and complexity of the incident?

It would be interesting to know the parameters around which they will use these credit monitoring services:

• Have they documented the types of incidents for which credit monitoring should be launched?
• Have they documented how to determine the types and levels of credit monitoring?
• Have they documented the specific types of personal information involved with the breach that would trigger credit monitoring?
• Are they going to establish a certain number of indivudals that must be involved?  It would be too bad if the number of individuals would be a factor; isn’t it important to help prevent bad things from happening to each individual for whose information their incident impacted, and not just a group of a specific size?

Technorati Tags
information security
IT compliance
data breach
credit monitoring
GSA
breach response
security incident
policies and procedures
awareness and training
privacy