Slashdot Mirror
Good: Companies Care About Data Privacy Bad: No Idea How To Protect It
Esther Schindler writes: Research performed by Dimensional Research demonstrated something most of us know: Just about every business cares about data privacy, and intends to do something to protect sensitive information. But when you cross-tabulate the results to look more closely at what organizations are actually doing to ensure that private data stays private, the results are sadly predictable: While smaller companies care about data privacy just as much as big ones do, they're ill-equipped to respond. What's different is not the perceived urgency of data privacy and other privacy/security matters. It's what companies are prepared (and funded) to do about it. For instance: "When it comes to training employees on data privacy, 82% of the largest organizations do tell the people who work for them the right way to handle personally identifiable data and other sensitive information. Similarly, 71% of the businesses with 1,000-5,000 employees offer such training. However, even though smaller companies are equally concerned about the subject, that concern does not trickle down to the employees quite so effectively. Half of the midsize businesses offer no such training; just 39% of organizations with under 100 employees regularly train employees on data privacy."
"We care about your privacy."
"Oh, by the way, we have TBs of data stolen 3 months ago, but we forgot to tell you until today."
Never collect it to begin with.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
You can't train an employee to care about someone else's data. If you make them take the course they will. They might even retain some of the message but when it comes time to put it into action it better not be more complex than pressing a button cause something else more important is calling their names.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
Elaborating on the concept, the good thing is that businesses have a lot of security tools that are not too expensive:
IDS/IPS.
AD's innate protection and logging.
Management and Alerting software like SolarWinds, SCOM/SCVMM/SCCM, or Splunk/Puppet/Chef/Webmin.
Encapsulating network segments by offering access to data without the ability to fetch the raw items, which can be done with App-V, Remote Desktop, or Citrix.
Disk encryption is in virtually every OS.
Basic routing/firewalling/segmenting either via dedicated appliances or a general purpose PC with a routing OS.
Virtualization/containers to separate applications from each other as well as completely revert the damage done to malware by snapshots.
Backup servers. Even a SMB can buy an edition of Windows Server 2012R2, enable the Essentials package, and back up a number of clients via a pull mechanism which prevents malware on the target clients from being able to tamper with or modify stored data on the server. For larger installs, MS's SCDPM is one alternative, NetBackup, TSM, and other enterprise tier utilities are another.
Now the bad news:
The tools we have are decent. However, it takes not just putting them together to make a cohesive security structure, but also putting policies, procedures, and dealing with the human element. Piss the employees off, and no amount of glued USB ports and Draconian policies will keep them from slurping data offsite out of spite. This is where the expenses come in. It takes people who know what the heck they are doing and know each tools uses and what they can't do (for example, not think that BitLocker to protect against threats over the network.)
A whitehat's job is hard. It requires a broad spectrum of knowledge of products, as well as being able to configure things in a failsafe manner [1] so if one item with security fails, all isn't lost.
Another problem is that there has been such a disincentive for so long for people interested in computer security. I have been told by managers at different companies, "Security has no ROI and if we do get hacked, Tata/Infosys/Geek Squad can fix the problem with a phone call." Because security has been hind teat in the IT world for so long, finding experienced people is hard, and can be expensive.
Maybe this will change, and if companies want security people, more people will start going that route, creating a positive feedback loop. However, I fear this is going to take a major event that causes loss of life before this ever will happen [2].
It may not have to be that expensive a fix... if Sony had an alerting system to notify their SOC that someone was brute-forcing AD, the attack against them likely would have been far less widespread.
[1]: For example, an anonymous FTP site would have the /pub directory NFS mounted read-only with permissions squashing root, but allowing everyone to read that directory. That way, if the FTP server gets compromised, the data offered for public FTP can't be tampered with. Of course, the intruder can dismount /pub and put their own Trojaned downloads in its place, but security is about mitigation about attacks as well as prevention, and cleaning up a hacked FTP server can just be as easy as rolling back to an earlier VMWare snapshot.
[2]: Before the term "cyber 9/11" was coined, it was termed the "Warhol event".
If anybody has looked for a job lately, you know most companies are using some form of applicant tracking system. IE: you don't send your info to the company, you enter it into a 3rd party web form. Mosey on down and read the privacy statement, they all say the same thing: We value your privacy.... we will share all of your data with our "trusted" partners. Who are they? What are they doing with my data? Who are they sharing it with? What is their privacy policy? What control do we have? None obviously. I guess we need more laws.
How about encrypting the data and using PKI over VPN with a full irrevocable audit trail. The keys being stored on a portable hardware token.
Reality: Just about every business says they care about data privacy
The first line of the typical company privacy policy is "we value your privacy", but the next ten pages list all the ways they are going to violate it.
Of course it means their data privacy, not yours.
Corporations always act so corporationy :)
smaller companies care about data privacy just as much as big ones do
so they care deeply until you ask them to spend money at which point they will do the minimum needed to avoid being sued. gotcha, they're directed by sociopath.
Anons need not reply. Questions end with a question mark.
They care about it bad, man, bad!
Suppose a smaller company does care, and wants to implement measures? These tools sound good, but like an auto parts store when you want a whole car, the integration is non-trivial. I guess the current solution is to hire a specialist, if you can find one appropriate. Maybe the industry has to evolve a bit more.
I like all those layers.
A simpler approach: All system developers dealing with personal data must place alongside any stored person data, their own personal SSN and login details for all of their banking and investment account, along with one embarrassing JPG.
Then just let them do whatever comes naturally.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Most everyone is commenting about better security software, firewalls, VPNs, encryption, and all that shit. Isn't the article about employee training?
For example: call up a bank. Try to get the balance on someone's account. This is a task well within reason for the person on the other end of the phone, ASSUMING it is your account, right? That's the point of employee training. The human element is the weakest element of any security system. What training do these employees need in order to not leak out your private information to any random person who calls in? Is simply stating your name on the account enough? Is there more verification steps required?
An example of social engineering security policies at various companies to the extreme that can happen:
http://www.wired.com/2012/08/a...
"Good: Companies Care About Data Privacy Bad"
Do they. Do they really.
LEARN TO USE PUNCTUATION, you American cretins...
"Data privacy" sounds to me like some new phrase only meant to make the concerns people might have about privacy in general insignificant.
Enterprise security management is an ongoing process. The underlying trick is in understanding those vulnerable points that are exploitable, and in identifying the impact on end users and the business. With data infiltration and breaches taking place at an alarming rate, organizations need to build robust enterprise security management strategies. Read: 5 Key Aspects for a Robust Enterprise Security Management Strategy
:/
They solutions exist, and are obligatory in my opinion, but they cost.
More nauseating bull. They don't know what to do? What load of horseshit. One hires qualified security experts and do what they tell you to. Done.
They corps are simply so beholden to the bottom line they can't/won't understand very simple concepts.
Big companies spend time training so they can point to it when something happens? Training is mostly a CYA not a real protection.
Firing that helps a lot you would be amassed at the amount of stupid and lazy, implemented simple ssn email filters. Watch how many people send things with full ssn's outside the company (something that should never happen) everything from not redacting after idiot customer puts full ssn in an email to automated reports getting sent to outside vendors without so much as requiring TLS. It's not a one time thing they will continue to do so after being trained retrained.
Something like a SSN should be sitting in a well secure table that only verifies if it's a match since no human should ever need to do a customer to SSN lookup. You can catch a lot of secondary exposures through good filtering and auditing.
No sir I dont like it.
I don't think privacy is really important until some company mistakenly allows personal information to leak or get hacked. Then all of a sudden everyone is on board. I think the problem lies in how to keep personal information private but allow for easy access to it by authorized people. We saw in the Sony hack, that many managers simply used poor passwords and typically shared passwords over non encrypted means. Its a troubling problem if your employee's don't follow good protocol on maintaining security and privacy. Its like protecting your home. Put all the locks on you want, but if you don't use them or leave the key under the mat. How good is that? The keyword in all of this is laziness of employee's. People have generally become lazy and look for ways to cheat what they perceive as too much work. Whenever we find ways to improve security like finger print recognition or facial recognition. It is rejected because of security problems with in the program. Like Apple's recent IOS issue with storing the finger print on iPhone devices. You create a means to solve one problem and fail at really solving the initial problem which is protecting the device. If your going to create authorizing alternatives for devices. They should be easier, more secure and better. Not just different.
Dont collect so much of it! Smaller companies dont need this data. That way they can focus more on thier own network security and on top of that become less of a target for attackers.
.. the people (who do exist) that know what to do? I feel as if the unsaid thing here is that the experts are out there but no one wants to trigger a wage war.
A comma between 'privacy' and 'bad' would have done wonders for clarifying the headline. It's kind of confusing.
If anyone knows that money solves all ills, it is an independent corporation. They just have to decide the right way to solve their ills with it.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Everywhere I've worked and every company I've ever dealt with acts like I'm as crazy as a schizophrenic homeless person when I ask about the security of my personal information they are requesting. Perfect example is docusign.net. This company is used by many real estate and escrow companies to allow people to electronically sign and deliver PDF documents, but the security is non-existent. Access to the site and documents is by SSL, but once the documents are signed docusign helpfully emails an unsecured PDF copy of the documents to the originator and the signor. This is documents containing SSNs, addresses, spouse names, property titles, and there's no way to turn off this "feature."
My escrow company thought I was insane because I didn't want to send them an email with the SSNs, addresses for the last 10 years, and employers for the last 10 years of both me and my spouse. It wasn't even them that needed the information, but rather the title company. They acted like I was an asshole for faxing the information directly to the title officer instead of sending it plaintext by email.
I encounter this ambivalence and ignorance every single fucking day. Businesses do not give one shit about security because they're not currently liable for the fallout. Pass some strict liability laws and watch that change overnight.
If companies actually cared about data privacy, then they would know how to protect it. If they don't know how to protect it, then they only care about *appearing* to care about data privacy.
> The first line of the typical company privacy policy is "we value your privacy"
Well, they do value your privacy... at some specific dollar amount. The confusion is that the sentence looks like it should mean that they care about your privacy, rather than the reality, which is that your private data is worth money to them.