Slashdot Mirror
Good: Companies Care About Data Privacy Bad: No Idea How To Protect It
Esther Schindler writes: Research performed by Dimensional Research demonstrated something most of us know: Just about every business cares about data privacy, and intends to do something to protect sensitive information. But when you cross-tabulate the results to look more closely at what organizations are actually doing to ensure that private data stays private, the results are sadly predictable: While smaller companies care about data privacy just as much as big ones do, they're ill-equipped to respond. What's different is not the perceived urgency of data privacy and other privacy/security matters. It's what companies are prepared (and funded) to do about it. For instance: "When it comes to training employees on data privacy, 82% of the largest organizations do tell the people who work for them the right way to handle personally identifiable data and other sensitive information. Similarly, 71% of the businesses with 1,000-5,000 employees offer such training. However, even though smaller companies are equally concerned about the subject, that concern does not trickle down to the employees quite so effectively. Half of the midsize businesses offer no such training; just 39% of organizations with under 100 employees regularly train employees on data privacy."
"We care about your privacy."
"Oh, by the way, we have TBs of data stolen 3 months ago, but we forgot to tell you until today."
Never collect it to begin with.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
You can't train an employee to care about someone else's data. If you make them take the course they will. They might even retain some of the message but when it comes time to put it into action it better not be more complex than pressing a button cause something else more important is calling their names.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
Elaborating on the concept, the good thing is that businesses have a lot of security tools that are not too expensive:
IDS/IPS.
AD's innate protection and logging.
Management and Alerting software like SolarWinds, SCOM/SCVMM/SCCM, or Splunk/Puppet/Chef/Webmin.
Encapsulating network segments by offering access to data without the ability to fetch the raw items, which can be done with App-V, Remote Desktop, or Citrix.
Disk encryption is in virtually every OS.
Basic routing/firewalling/segmenting either via dedicated appliances or a general purpose PC with a routing OS.
Virtualization/containers to separate applications from each other as well as completely revert the damage done to malware by snapshots.
Backup servers. Even a SMB can buy an edition of Windows Server 2012R2, enable the Essentials package, and back up a number of clients via a pull mechanism which prevents malware on the target clients from being able to tamper with or modify stored data on the server. For larger installs, MS's SCDPM is one alternative, NetBackup, TSM, and other enterprise tier utilities are another.
Now the bad news:
The tools we have are decent. However, it takes not just putting them together to make a cohesive security structure, but also putting policies, procedures, and dealing with the human element. Piss the employees off, and no amount of glued USB ports and Draconian policies will keep them from slurping data offsite out of spite. This is where the expenses come in. It takes people who know what the heck they are doing and know each tools uses and what they can't do (for example, not think that BitLocker to protect against threats over the network.)
A whitehat's job is hard. It requires a broad spectrum of knowledge of products, as well as being able to configure things in a failsafe manner [1] so if one item with security fails, all isn't lost.
Another problem is that there has been such a disincentive for so long for people interested in computer security. I have been told by managers at different companies, "Security has no ROI and if we do get hacked, Tata/Infosys/Geek Squad can fix the problem with a phone call." Because security has been hind teat in the IT world for so long, finding experienced people is hard, and can be expensive.
Maybe this will change, and if companies want security people, more people will start going that route, creating a positive feedback loop. However, I fear this is going to take a major event that causes loss of life before this ever will happen [2].
It may not have to be that expensive a fix... if Sony had an alerting system to notify their SOC that someone was brute-forcing AD, the attack against them likely would have been far less widespread.
[1]: For example, an anonymous FTP site would have the /pub directory NFS mounted read-only with permissions squashing root, but allowing everyone to read that directory. That way, if the FTP server gets compromised, the data offered for public FTP can't be tampered with. Of course, the intruder can dismount /pub and put their own Trojaned downloads in its place, but security is about mitigation about attacks as well as prevention, and cleaning up a hacked FTP server can just be as easy as rolling back to an earlier VMWare snapshot.
[2]: Before the term "cyber 9/11" was coined, it was termed the "Warhol event".
If anybody has looked for a job lately, you know most companies are using some form of applicant tracking system. IE: you don't send your info to the company, you enter it into a 3rd party web form. Mosey on down and read the privacy statement, they all say the same thing: We value your privacy.... we will share all of your data with our "trusted" partners. Who are they? What are they doing with my data? Who are they sharing it with? What is their privacy policy? What control do we have? None obviously. I guess we need more laws.
How about encrypting the data and using PKI over VPN with a full irrevocable audit trail. The keys being stored on a portable hardware token.
Reality: Just about every business says they care about data privacy
The first line of the typical company privacy policy is "we value your privacy", but the next ten pages list all the ways they are going to violate it.
Of course it means their data privacy, not yours.
smaller companies care about data privacy just as much as big ones do
so they care deeply until you ask them to spend money at which point they will do the minimum needed to avoid being sued. gotcha, they're directed by sociopath.
Anons need not reply. Questions end with a question mark.
They care about it bad, man, bad!
Suppose a smaller company does care, and wants to implement measures? These tools sound good, but like an auto parts store when you want a whole car, the integration is non-trivial. I guess the current solution is to hire a specialist, if you can find one appropriate. Maybe the industry has to evolve a bit more.
I like all those layers.
A simpler approach: All system developers dealing with personal data must place alongside any stored person data, their own personal SSN and login details for all of their banking and investment account, along with one embarrassing JPG.
Then just let them do whatever comes naturally.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Most everyone is commenting about better security software, firewalls, VPNs, encryption, and all that shit. Isn't the article about employee training?
For example: call up a bank. Try to get the balance on someone's account. This is a task well within reason for the person on the other end of the phone, ASSUMING it is your account, right? That's the point of employee training. The human element is the weakest element of any security system. What training do these employees need in order to not leak out your private information to any random person who calls in? Is simply stating your name on the account enough? Is there more verification steps required?
An example of social engineering security policies at various companies to the extreme that can happen:
http://www.wired.com/2012/08/a...
Enterprise security management is an ongoing process. The underlying trick is in understanding those vulnerable points that are exploitable, and in identifying the impact on end users and the business. With data infiltration and breaches taking place at an alarming rate, organizations need to build robust enterprise security management strategies. Read: 5 Key Aspects for a Robust Enterprise Security Management Strategy
:/
Big companies spend time training so they can point to it when something happens? Training is mostly a CYA not a real protection.
Firing that helps a lot you would be amassed at the amount of stupid and lazy, implemented simple ssn email filters. Watch how many people send things with full ssn's outside the company (something that should never happen) everything from not redacting after idiot customer puts full ssn in an email to automated reports getting sent to outside vendors without so much as requiring TLS. It's not a one time thing they will continue to do so after being trained retrained.
Something like a SSN should be sitting in a well secure table that only verifies if it's a match since no human should ever need to do a customer to SSN lookup. You can catch a lot of secondary exposures through good filtering and auditing.
No sir I dont like it.
A comma between 'privacy' and 'bad' would have done wonders for clarifying the headline. It's kind of confusing.
If anyone knows that money solves all ills, it is an independent corporation. They just have to decide the right way to solve their ills with it.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
If companies actually cared about data privacy, then they would know how to protect it. If they don't know how to protect it, then they only care about *appearing* to care about data privacy.