Protecting information in a broken system
Today’s very hot topic: data breaches.
What is a data breach, really? There are a few industry definitions, but let’s start with the most basic: A data breach is the intentional or unintentional release of secure, private, or confidential information.
How do we avoid being caught in breaches? Don’t release information. Pretty simple, huh? Unfortunately, the solution is more complicated than that.
Take, for example, the Target breach; remember that one?
That started when an HVAC vendor that was doing work for Target experienced a breach in their systems. In this case, the bad actors were able to find their way through the vendor’s systems and directly into Target’s, where they were able to access customers’ payment information.
Another more recent example involves a breach at British Airways, where their website was forwarding customers to a malicious site.
And now, even as you read this, we are still learning the details about a breach involving Capital One, which appears to have affected well in excess of 1 million people.
We could go on, including discussions of municipal breaches like the one in the City of Bakersfield, Calif., and the recent three in Florida. There has been no shortage of these events.
Snagged and broken
Although the tactics used in each event were different, the hacks have one fundamental similarity: The hackers took advantage of weaknesses in loosely monitored systems.
Organizations are not adequately monitoring their systems and networks, or they’re using shortcuts to save on their financial bottom line. Things like not using encrypted hard drives or not shredding sensitive paperwork might save time or money, but they create weaknesses. Basically the system itself is broken.
All of these situations could have been avoided. But there’s no standard framework for monitoring, current regulations are often followed too casually, and the only time an organization performs an audit is after they’ve had a breach.
There is a better way
The European Union faced this head-on when they imposed their General Data Protection Regulation (GDPR) to protect private citizens’ information. In the process, they transformed how data is handled by businesses in the EU. The GDPR also requires routine audits with strict penalties for not following the defined structure. Routine audits ensure compliance.
Recently, Oregon’s Governor Kate Brown signed into law an update to Senate Bill 684, which attempts to address breaches like the ones above.
But the fundamental problem with 684 is that it only addresses how businesses are to respond after a breach has occurred. This is still not addressing the root issue. These breaches need to stop happening in the first place.
What to do
We will never see an end to these events as long as we continue to address the problem only after the fact. We need straightforward definitions of how to protect, manage, and distribute data at the front end, which necessarily requires routine training of administrators.
Furthermore, it’s the organization’s obligation to vet the people they hire, to follow industry/compliance best practices, and to no longer follow a broken road.
Although the current landscape is harrowing, we have a solid foundation if we institute some major changes that would include having organizations perform routine internal audits and procedure evaluations. I can report that many of my colleagues in IT/cybersecurity are working to provide solutions to state and local governments, processes that create a monitoring framework that can be easily followed.
Is it time that we each put our own data protection regulations into place? Is your business being proactive? That’s worth thinking about — before there’s a breach.
Email: Jared Swezey (email@example.com)