Yesterday (Wednesday) was the final day of the IAPP Privacy Academy, and it was a great conference for me! I have been preaching about information security and privacy collaboration within a 2-day training seminar over the past 2 years, so it is good to finally start hearing others recognize and promote the need for information security and privacy practitioners to work together.
Scott Charney, vice president of Microsoft’s Trustworthy Computing Group, gave a speech at the conference highlighting this need. He pointed out the damage that can be done through a well-coordinated and successful cyber attack; not only to the business but also to the privacy of personally identifiable information (PII).
Charney communicated the results of a recent Microsoft survey of 3,600 security, privacy and marketing practitioners in the United States, the UK and Germany; 78% of respondents believe their marketing department tells the information security and privacy leaders what PII the company collects, but only 30% of marketers say they actually communicate such information to the information security and privacy areas.
Charney also pointed out that companies that have the privacy and information security areas work together have far fewer data and privacy breaches.
Indeed!
Information security practitioners help the business to keep malicious code, such as viruses, Trojans, keyloggers and other malware from getting onto the network. There are many types of malicious software that allow fraudsters, crooks and down-right bad people to peek into corporate networks and employee PCs and gather copies of sensitive data such as PII that is located there.
Privacy pros must understand how the information security threats also threaten privacy.
When the information security and privacy practitioners do not work together, this lack of coordination creates business vulnerabilities that outside crooks or insiders will exploit.
Tags: awareness and training, IAPP, Information Security, insider threat, IT compliance, Microsoft, policies and procedures, privacy, risk management, Scott Charney