As the saying goes, it’s not IF, but WHEN will your personal information will be stolen in a data breach.
On October 8, 2009 I wrote a blog entitled “What’s the Value of Your Mobile Phone’s Address Book?” which highlighted the fact that iPhone applications have access to your phones entire address book and you are trusting that the developer is (hopefully) not a rogue one. This has been known since at least January 26, 2009. The possible abuse that my blog was aimed at pointing out to readers came to light recently. A class action lawsuit has been filed against app developer Storm8 and the full details of the proceedings can be found here.
Read more!
Showing posts with label data breach. Show all posts
Showing posts with label data breach. Show all posts
Friday, December 4, 2009
Tuesday, September 9, 2008
"So What's Everyone Else Doing???"
As a security auditor, I can't tell you how many times I've been asked this when talking about compliance. If I only had a nickle for every time someone asked me that question... well... I'd probably want to throw it at the person who just asked me it. This is such a bad question on so many levels and it still frustrates me each time. That being said, I suppose I should answer it here so that maybe, just maybe, they won't ask next time.
My first response is, 'everyone else' is not doing a good job, not enough, and likely the wrong things. For example, take PCI compliance. Even after all this time, only 77% of Level 1 Merchants are compliant. Now if everyone is being as tough as they should be, those merchants are getting fined $25,000 per month and a possibly higher transaction rate. Compliance basically exists because when 'everyone else' was doing what 'everyone else' did, 'everyone' sucked! So somebody had to step in and raise the bar for them. It's like the flock needing a shepherd.
Now imagine that all of sudden you get breached because your 'average' organization is doing things just like 'everyone else,' which isn't enough... do you really want to stand at the podium and state that you didn't do enough because others aren't? Is that really a good, defensible position? On average, the average isn't good. So do you really want to measure yourself against them?
I think it's also ironic when you realize that just prior to this question is the statement made by the same person that "Well, we're unique here at Company X". Of course you are! If not, I can't imagine you'd have differentiators and be unique. There is no reason why that can't be security. It is probably a pretty good reason to not be like 'everyone else'. I'm hoping the next time someone asks me this, they want to know so they can use it for out marketing 'everyone else'.
Read more!
My first response is, 'everyone else' is not doing a good job, not enough, and likely the wrong things. For example, take PCI compliance. Even after all this time, only 77% of Level 1 Merchants are compliant. Now if everyone is being as tough as they should be, those merchants are getting fined $25,000 per month and a possibly higher transaction rate. Compliance basically exists because when 'everyone else' was doing what 'everyone else' did, 'everyone' sucked! So somebody had to step in and raise the bar for them. It's like the flock needing a shepherd.
Now imagine that all of sudden you get breached because your 'average' organization is doing things just like 'everyone else,' which isn't enough... do you really want to stand at the podium and state that you didn't do enough because others aren't? Is that really a good, defensible position? On average, the average isn't good. So do you really want to measure yourself against them?
I think it's also ironic when you realize that just prior to this question is the statement made by the same person that "Well, we're unique here at Company X". Of course you are! If not, I can't imagine you'd have differentiators and be unique. There is no reason why that can't be security. It is probably a pretty good reason to not be like 'everyone else'. I'm hoping the next time someone asks me this, they want to know so they can use it for out marketing 'everyone else'.
Read more!
Friday, August 1, 2008
Thank You For Putting Customer Satisfaction Last!
Taking a break from the normal week to write on this topic that has been bothering me for quite a while. If a company loses your data… and you are at risk for identity theft, they think it is kosher to offer you “up to one year of identity theft monitoring”.
So my question is… What about the next 2-20 years of your life?
A quick search on Google reveals that credit monitoring costs sit in the $12/month range. Yes that means if they lose your Social Security Number, Credit Card Numbers, PINs, etc… They owe you just $144. A sort of… “Oops! Sorry we lost your data.”
Five years down the road when someone decides to cash in on the theft they have made of YOUR data… Weellllllll… You’re on your own!
What organizations should start doing (besides including security in everything they do) is at least offer a lifetime worth of this service. This would say “We are extremely sorry that we lost your data, we will do anything we can to make sure that it will not be used maliciously. And if someone does… this will help you be able to stop them before they get anything!”
So until that day comes... (or never)… Those who have had their identity stolen will have problems like this guy... for years to come for much longer than “up to one year.”
Read more!
So my question is… What about the next 2-20 years of your life?
A quick search on Google reveals that credit monitoring costs sit in the $12/month range. Yes that means if they lose your Social Security Number, Credit Card Numbers, PINs, etc… They owe you just $144. A sort of… “Oops! Sorry we lost your data.”
Five years down the road when someone decides to cash in on the theft they have made of YOUR data… Weellllllll… You’re on your own!
What organizations should start doing (besides including security in everything they do) is at least offer a lifetime worth of this service. This would say “We are extremely sorry that we lost your data, we will do anything we can to make sure that it will not be used maliciously. And if someone does… this will help you be able to stop them before they get anything!”
So until that day comes... (or never)… Those who have had their identity stolen will have problems like this guy... for years to come for much longer than “up to one year.”
Read more!
Subscribe to:
Posts (Atom)
Posts
