Slashdot Mirror
Data Breaches Rose Sharply In 2008
snydeq writes "According to the Identity Theft Resource Center, more than 35 million data records were breached in the US in 2008. Tracking media reports and disclosures companies are required to make by law, the ITRC noted a 47 percent increase in breaches last year at a range of well-known US companies and government entities. The majority of the lost data was neither encrypted nor protected by a password. A third of the breaches occurred at business entities. One in six breaches were attributed to insider theft, a figure that more than doubled between 2007 and 2008, ITRC said."
With increased layoffs and economic hardships I would expect these numbers to go up again this year. On top of the individual motivations for just attempting it, it's unlikely corporations or governments are going to drastically increase security spending this year.
Developers: We can use your help.
more than 35 million data records were breached in the U.S. in 2008.
;)
Pfft, nowhere near the UK yet, keep trying...
Hint: leave the laptop on a train.
Pardon me for saying, but insider theft in every business aspect has dominated the charts -- over 80% in most cases. Most case studies I've seen in computer security point to this as the overriding concern in setting up corporate networks and systems. And now comes along a report saying that this has been turned on its head and the reverse is true?
I smell a rat, and looking at the name on the report, I think I might have found the cheese too.
#fuckbeta #iamslashdot #dicemustdie
Or, there has been an increase in the reporting of data breaches, since data breaches started to become newsworthy. Previously, we did not care.
"According to the Identity Theft Resource Center, more than 35 million data records were breached in the U.S. in 2008"
Do any of these breaches have anything to do with the underlying Operating System ?
davecb5620@gmail.com
This is just more evidence of what is already widely known: people are generally lax about security matters. What we really need is some way of getting the point across that things like reasonable passwords are turning into a necessity of every-day life.
Both the twitter and Palin e-mail "hackers" just guessed passwords or researched PII to get in. This also shows we definitely need some better form of authentication, and that authorization policies inside organizations should be more paranoid. Of course I'm still lost as to alternatives to passwords, so perhaps people will just have to suck it up and put a bit of effort into it.
There are always the trade-offs between effort and the value of what one is protecting. If the public finds these data breaches unacceptable, why not make the consequences more serious so that from a business standpoint it is more worthwhile to spend on security? This may lead to corporations developing an atmosphere of security awareness, which will keep people actively thinking about important steps to take in typical day-to-day activities.
An increase in REPORTED breaches. There is less stigma on it these days, and more scrutiny.
I want to delete my account but Slashdot doesn't allow it.
Most all data in commercial and government systems are "exposed" or "compromised" to one degree or another virtually all the time. So it is not surprising that as we focus more attention on breaches, we discover an ever-growing number of breaches. Under the presenting thinking, the growth will never stop. Should each citizen therefore be mailed 100 breach notices every day? Legally and ethically speaking, we do not have a competent definition of what is and is not a meaningful security breach. The result is confusion and excessive anxiety on the part of data holders, data subjects, legal authorities and the media. Ben
Benjamin Wright, Dallas, Texas, benjaminwright.us
I suspect that it was you who received the genetic data.
Data to obfuscate should include at least:
The challenge is where a protected value is used as a key into other systems and records have to agree in order to test systems.
Solution? Don't use protected data as keys?
Any other ideas?
I'm sure this was modded Flamebait by someone assuming that Hognoxious is obnoxiously racist. And s/he might be. But, as in police work, you only hamper yourself if you're unwilling to look at culture ("Gah! Not profiling!") or other pigeonholing to narrow down your search.
Personally, from what I know about the Indian culture, I'd be surprised if they were the source of statistically significant amounts of data breaches. But the concept of looking at recent changes to the corporate world to see what has changed is completely valid, and not flamebait at all.
It's also like how airport security tearing apart an old lady's luggage looking for weapons of terror is a waste of resources, when it's far more economical (more likely to find what you're looking for) to tear apart the luggage of someone from countries known to support terror. Or to tear apart luggage of people coming in from known drug countries when looking for drugs. You need to carefully weigh the likelihoods, and spend your time and resource first in the likely places before the unlikely.
So, I think that Hognoxious has a valid point. We need to examine recent changes to the corporate world to figure out what this new statistic means. Does it mean, as many have already said, that we're just reporting better (seems likely to me)? Does it also mean that outsourced workers are selling our data? This seems like a reasonable myth to investigate to determine if outsourced workers are more, less, or similarly likely to sell insider data to the black market, so that we can better focus our efforts on reducing breaches. But it should be based on thorough investigation, and not on knee-jerk calls of racism.
I like to pass along things that work, in hopes that good ideas make their way back to me. Data breaches and thefts are due to a lagging business culture â" and people arenâ(TM)t getting the training they need. As CIO, I look for ways to help my business and IT teams further their education. Check your local library: A book that is required reading is "I.T. WARS: Managing the Business-Technology Weave in the New Millennium." It also helps outside agencies understand your values and practices. The author, David Scott, has an interview that is a great exposure: http://businessforum.com/DScott_02.html - The book came to us as a tip from an intern who attended a course at University of Wisconsin, where the book is an MBA text. It has helped us to understand that, while various systems of security are important, no system can overcome laxity, ignorance, or deliberate intent to harm. Necessary is a sustained culture and awareness; an efficient prism through which every activity is viewed from a security perspective prior to action. In the realm of risk, unmanaged possibilities become probabilities â" read the book BEFORE you suffer a breach.
Flamebait? Crack smoking mods.
It's certainly inflammatory, but it's a perfectly legitimate question, if you ask me.
Lots of data from these US companies is heading overseas to countries which have little, if any, privacy protection legislation. What they do have is routinely ignored due to regional financial needs, payoffs to law enforcement, and other corruption.
So the question still stands: Are outsourced workers counted as insiders for data breach purposes?
"City hall" in German is "Rathaus" Kinda explains a few things......
I expect people are carrying more data. Miniaturization should permit you to carry all the data you need in hip-hugging data breaches in the near future.
Squirrel!
At least he got a girlfriend. His emotion chip works well.
There are a few issues with comparing reported breaches. More laws have required the disclosure of breachs which is going to exaggerated the increase. At the same time the total number of actual breaches and records is still likely much higher than what is currently reported.