Risk
2/22/2007
02:51 PM
50%
50%

Making Up For A Data Breach

Do companies really care about the security of their customers' data? Quite frankly, not as much as they should, based on what's in the news.

Do companies really care about the security of their customers' data? Quite frankly, not as much as they should, based on what's in the news.Lately, it seems, we've been hearing about all types of data breaches: retailer TJX, the state of Connecticut, Stop & Shop, and the Department of Veterans Affairs. It's an epidemic, but don't turn to Johns Hopkins; an outside contractor to that health facility lost nine backup tapes that held sensitive personal information on 52,000 workers and 83,000 patients. The data is "thought" to have been destroyed. That's not really very comforting if you are one of those 135,000 people. And that's a pretty big number.

One big problem is that executives give data protection a lot of lip service these days. But if you think about it, what choice do companies have? Shareholders aren't going to be really happy with "Part of our cost-cutting measures includes neglecting our customer data." In fact, these companies probably invested quite a bit in some type of business intelligence product. Data mining is all the rage, and for good reason. There are plenty of lucrative marketing opportunities out there, if you can make sense out of all that data collected. Identifying repeat customers, buying trends, and other information that can better your business justifies collecting some types of data in the first place.

But some of what's collected seems odd: For example, TJX stored the license numbers of people who returned items without a receipt. Now, what is done with that information? How often does a retailer track someone down using the driver's license number? Seems to me companies could simply refuse to take a return without a receipt (like Toys "R" Us has recently done). The point is, how much information is necessary, and how much is overkill? Companies are opening themselves to more exposure by collecting too much information. It's all the more to worry about if there's a breach.

So, here are my Common Sense Rules.

  • First, companies ought to only hang on to information that is absolutely necessary. That way, if it's stolen (TJX), lost (Johns Hopkins), or otherwise compromised (Stop & Shop), there's less to worry about, plain and simple.

  • Second, companies should have possession of that data for only a specified period of time -- something that is currently mandated for credit card information but apparently was ignored by some of the parties involved.
  • Finally, there should be a Customer's Bill of Rights regarding what happens if your data goes astray. The JetBlue debacle of last week in which airline passengers were stranded on the tarmac for hours -- and the resultant Passenger Bill of Rights -- could act as a model for this. If companies must make reparations for lax data security, it's more likely that they will pay attention to keeping it locked up to begin with.
  • Massachusetts is taking note: A bill in the Legislature would make businesses pay for poor data security. Companies would be mandated to pay to cancel or reissue cards, stop payments, or block transactions. That may be too complicated; all that might be needed is a financial penalty, payable to the victim. For example, $100 would be payable to the person whose data has been breached. It's then up to that person if he or she even wants the credit card reissued. This system is straightforward and can be easily calculated. But whatever remedy is chosen, the time has come for some "incentive" to be invoked.

    Comment  | 
    Print  | 
    More Insights
    Register for Dark Reading Newsletters
    White Papers
    Cartoon
    Current Issue
    Dark Reading Tech Digest, Dec. 19, 2014
    Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
    Flash Poll
    Video
    Slideshows
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2014-8893
    Published: 2015-01-28
    Multiple cross-site scripting (XSS) vulnerabilities in (1) mainpage.jsp and (2) GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

    CVE-2014-8894
    Published: 2015-01-28
    Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter.

    CVE-2014-8895
    Published: 2015-01-28
    IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote attackers to bypass intended access restrictions and read the image files of arbitrary users via a crafted URL.

    CVE-2014-8917
    Published: 2015-01-28
    Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media A...

    CVE-2014-8920
    Published: 2015-01-28
    Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 5R4, 6.1, and 7.1 on Windows allows local users to gain privileges via unspecified vectors.

    Best of the Web
    Dark Reading Radio
    Archived Dark Reading Radio
    If youíre a security professional, youíve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.