Attacks/Breaches
1/22/2014
01:10 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Online Trust Alliance Finds Data Breaches Spiked To Record Level In 2013

Yet 89 percent of all breach incidents were avoidable had basic security controls and best practices been enforced

SEATTLE, Jan. 22, 2014 /PRNewswire/ -- The Online Trust Alliance (OTA), the non-profit with the mission to enhance online trust, user empowerment and innovation, today recommended a series of best practices to help prevent online data breaches and other exploits, in collaboration with high-profile brands including American Greetings Interactive, AVG, Microsoft, Publishers Clearing House, Symantec and TRUSTe. These recommendations, released today in OTA's 2014 Data Protection & Breach Readiness Guide, were accompanied by several eye-opening statistics.

Leveraging preliminary year-end data from the Open Security Foundation and the Privacy Rights Clearinghouse, the OTA estimated in its guide that over 740 million records were exposed in 2013, making it the worst year in terms of data breaches recorded to date. And yet, after analyzing approximately 500 breaches over the past year, the OTA determined that 89% of all breach incidents were avoidable had basic security controls and best practices been enforced.

"Businesses and organizations have a responsibility to protect consumer privacy and prevent data breaches from aggressive cyberthieves," said Washington State Attorney General Bob Ferguson. "Consumers deserve to know who they can trust.

The Online Trust Alliance arms organizations with critical information to reduce cyber risk and protect consumers."

The annual guide is being published in advance of Data Privacy Day, Jan. 28, which the OTA commemorates by holding town hall forums and workshops led by cybersecurity and privacy luminaries in New York, San Francisco and Seattle.

These events come on the heels of several high-profile data breaches victimizing Target Corporation, Neiman Marcus and Adobe--a disturbing trend that undermines online trust and underscores the need to implement best practices.

"Data breaches are nothing new and have been around for quite some time; however, what we are seeing is a significant increase in incidents that not only harm consumers, but businesses as well, leading to a breakdown in consumer trust," said Tim Rohrbaugh, VP of Information Security for Intersections Inc.

and OTA Board Member. "Having a rigid, black and white approach to security controls and monitoring and being unprepared for an incident will cost businesses more in the end. These town halls are a great venue for business leaders in all sectors to come together and share best practices in improving security controls, customer data management, and data breach incident reporting."

According to the guide, best practices can only be achieved when companies are no longer complacent with meeting minimum compliance standards for data protection. Rather, they must meet the far loftier data privacy expectations of their own customers, by adopting a comprehensive data stewardship strategy that safeguards data across its entire lifecycle, from collection to deletion. Such efforts go hand in hand with developing an effective Data Incident Plan (DIP), a playbook that can be deployed on a moment's notice, delineating what steps must be taken when a breach happens. Businesses must be able to quickly assess the nature and scope of an incident, contain it, mitigate the damage and notify all interested parties, including law enforcement and affected customers.

"Consumers and businesses are both victims of rapidly escalating hacking attacks, and as stewards of consumer data it's incumbent on businesses to adopt best practices to help protect consumers from harm," said Craig Spiezle, executive director and president of the Online Trust Alliance. "Those companies that fail to do so need to be held accountable, by consumers, regulators and stockholders.

Indeed, the ramifications of a data breach can be far-reaching and long-term, creating a sort of "business shock," explains the guide. Consequences include a damaged brand, decreased sales, loss of third-party partnerships and contractual penalties imposed by customers, partners or service providers.

Ultimately, the guide urges all businesses to accept two fundamental premises:

One, the consumer data they are collecting invariably contains some form of personally identifiable information. And two, at some point they will inevitably experience data loss. When that happens, it's best to be prepared.

OTA's 2014 Data Protection & Breach Readiness Guide is available at:

https://Otalliance.org/Breach.html. A public webinar recapping the guide is being hosted on Feb. 12 from 9 a.m. to 10 a.m. PST. To register, visit http://bit.ly/1eFddns. Additional quotes from OTA supporters regarding Data Privacy Day and the guide are available at http://bit.ly/1mB3HaA.

Privacy Day Workshops

OTA's 2014 Data Privacy Day workshops in New York (Jan. 28), San Francisco (Jan.

30) and Seattle (Feb. 4) are designed to provide businesses with prescriptive advice about how to navigate complex security and data privacy issues, while enhancing brand trust and product innovation. Speakers include privacy experts from the FBI, Federal Trade Commission, Secret Service and the Attorney General's Offices of New York, California and Washington State. The events are in collaboration with the Better Business Bureau, Identity Theft Council and the local chapters of InfraGard, and are supported by underwriting from leading organizations including comScore, Intersections, PwC, Sailthru and TRUSTe. To attend a workshop, visit https://otalliance.org/dpd.html.

About The Online Trust Alliance (OTA)

The Online Trust Alliance (OTA) is a non-profit with the mission to enhance online trust and user empowerment, while promoting innovation and the vitality of the Internet. OTA's goal is to help educate businesses, policy makers and stakeholders while developing and advancing best practices and tools to enhance the protection of users' security, privacy and identity. OTA supports collaborative public-private partnerships, benchmark reporting, meaningful self-regulation and data stewardship. Its members include federal law enforcement agencies, and the world's leading e-commerce, online banking, online security and social media companies. For more information, visit:

https://otalliance.org.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

CVE-2014-8090
Published: 2014-11-21
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nes...

CVE-2014-8469
Published: 2014-11-21
Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?