PC Data Security Blog

What’s scarier than a hacker? Your employees.

In a study recently released by Compuware, results showed most data breaches are caused by employees, not hackers. The survey of 1,112 IT workers found that only one percent of data losses this year were the result of hackers. Here’s a breakdown of the results:

Negligent insiders were overwhelmingly cited as the cause of data breaches in the survey. What does this mean for company security policies? Will we soon see a shift towards tying up the internal loose ends that compromise company data?

It might be a good idea. Especially when you add to the equation the data from other security studies showing the impact of a data breach on a small company. One-third of companies in one survey said that a major security breach could put their company out of business. Additionally, a data breach that exposed personal information would cost companies an average of $268,000 to inform their customers–even if the lost data is never used. Or, to break it down further, which a Forrester survey did, a breach will cost a company between $90 and $305 per exposed record.

In today’s economy, every dollar spent in a security budget has to get scrutinized. A better strategy for security professionals is to put those dollars toward preventitive measures that combat insider negligence instead of throwing money at an outside threat.

Security News Brief: 10-22-08

• Study shows biggest threat to data security comes from the inside. 80% of respondents to the survey said they’ve had at least one data breach this year. 58% of breaches come from mobile devices, including laptops, PDAs and memory sticks. (Dark Reading, Oct. 9, 2008)
• Over half of British companies have lost data. Two-thirds of respondents said negligence was the cause for the data breach in their company. (Computerworld, Oct. 10, 2008)
• Stolen laptop in W.Virginia contained personal information of over 500 state workers. The laptop was stolen from the vehicle of an employee of the state’s accounting firm. (The Charleston Gazette, Oct. 7, 2008)
• Laptops stolen from Boston ACORN office. Police were investigating a break-in at the office of the community activist group. (WBZtv.com, October 17, 2008)
• Newark TSA employee accused of stealing 31 laptops from passenger baggage. Pythias Brown was finally caught when he allegedly stole a $50,000 camera from an HBO crewmember and a camcorder from the bag of a CNN employee. (New Jersey Star-Ledger, Oct. 7, 2008.)

I lost my USB flash drive!

What if it’s Your Data on a Lost or Stolen Device?

It’s important to consider the information you’re storing on them. Do your devices include online banking information, bills, receipts, tax returns, personal photos and videos, contact information, online account information, electronic signatures, emails, and…? If this information is intercepted by another person, they can learn a great deal about you. Losing such a device now becomes a much larger undertaking than most people realize. It’s like losing your wallet. What do you do when your wallet is lost or stolen? You cancel your credit cards, get a new id/driving license, perhaps subscribe to a credit reporting/protection agency. Would you do the same thing if you lost one of these electronic devices? You might not - but you should.

These are necessary precautions against identity theft and other damaging uses of your personal information. Your vulnerability may be even greater. Do you store photos or video of your family on these devices? How would it feel if they were in the hands of a complete stranger? A stranger with the morals that justified stealing the device in the first place?
I encourage you to think about all the information you keep on such devices and to ask yourself what would happen if someone got access to that data? What will you do? These are some questions to think about and plan for - preferably before it happens to you.

Security News Brief: 10-03-08

• New federal law targets ID theft and cybercrime. The bill lowers the bar prosecutors need to clear before bringing hacking and other cybercrime charges against an individual. (Security Fix, October 1, 2008.)
• Laptop stolen in break-in at McCain campaign office in St. Louis. Campaign officials said the laptop contained information about areas that Republicans are targeting for support. (STLToday.com, October 2, 2008.)
• October is Cyber Security Awareness Month. (Network World, October 3, 2008.)