Two-fer Thursday!

It is rare that we see two security and data breach related reports cause a stir on the same day. However, today Forrester and lesser known Risk Based Security Inc. delivered two reports with a similar theme -- data breaches can and will affect you personally as well as your organization.


Forrester reports that in a questionnaire distributed to 2,300 IT executives via LinkedIn 25% responded that their organization has had a data breach in the last year. Even more surprising, 21% declined to answer despite being assured that names and responses are kept confidential. 7% of very honest IT executives reported that they don't know and Forrester believes that many of the remaining who reported no breaches in the last year, were probably breached but just don't know it yet.


The above findings by Forrester make this second report more understandable but no less shocking. According to Risk Based Security Inc. and research done by the Open Security Foundation as of October 2011 there have been over 1 billion records exposed. In the first nine months of 2011 we have seen  176,385,870 records exposed compared to 88,473,589 records for all of 2010.


All of these statistics server to prove a point that organizations still are not taking the necessary measures to protect their data and the data of their customers and clients. When it comes to securing your organization taking a holistic approach is the first step to enforcing better protection. By better understanding business needs and processes your security department can better determine where risks reside. Security is more than a simple technology solution. Aligning IT security with business needs requires a combination of policies, people and enforcement.


Links to the above reports
Forrester
Risk Based Security Inc.

Massachusetts Executive Office of Labor and Workforce Development Breached

Client names, social security numbers, email addresses and residential addresses and bank account detail of users of the Massachusetts Executive Office of Labor and Workforce Development claim system. The 1,200 system users were warned that their personal details may have been accessed by a data-stealing worm named W32.QAKBOT.

Symantec defined the W32.QAKBOT as a worm that is capable of keylogging, collecting cookie data, DNS, operating system, private keys from system certificates and URLs. The virus can spread through a computer network, open a back door on a compromised computer that would allow someone to control the machine and keep itself hidden.

Although the problem has been fixed, Executive Office of Labor and Workforce Development is hoping people continue to use the system. It has been communicated that all possible steps are being taken to avoid future recurrence.

Do you consider your ZIP code "personal identification information" ?

The California Supreme Court does.  In a recent decision, the California Supreme Court ruled that a ZIP code is "personal identification information" for purposes of California Civil Code §1747.08. As a provision of the Song-Beverly Credit Card act of 1971, California Civil Code §1747.08 prohibits prohibits businesses, as a condition to accepting a credit card as payment for goods or services, from requesting and recording personal identification from credit card holders during credit card transactions. Personal identification is further defined in the statute as:

"information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number."

The lawsuit was filed by a private citizen against retailer Williams-Sonoma after a ZIP code was requested at checkout and was later used in conjunction with other information to determine the customer's address for marketing purposes.

This decision comes as a further reminder to credit card processing retailers of the increasing complexity of credit card compliance. With the new Payment Card Industry Data Security Standards (PCI-DSS) and decisions such as this one, non-compliance is becoming more costly than ever. 

Does your organization process credit cards? Would your business be hurt by losing the ability to process credit cards? If you answered yes it is time to discover your compliance requirements and start working towards meeting the standards put in place by credit card companies and the courts. A great place to start is Attevo's DLP Toolkit where you can search a database of compliance regulations tailored to your business.