Desperate for data on 25m Brits FINAL UPDATE?

The BBC reports that a substantial reward is on offer for the return of two CD-ROMs that went missing in the post en route between two Government offices. They have searched numerous offices (including TNT, a well-known courier company) and at least one rubbish tip, and have completed some forensic analysis (presumably looking to see if individuals implicated in the incident might have something to hide), but these all came up blank. Having forlornly scaled down the search, a cash reward is now on offer and the British populace is warned to keep an eye out for identity theft or similar incidents.

The report notes several other personal information breaches at the Department concerned, and low staff morale as a result of the latest one. Given the sorry history of incidents, heads should roll. If public servants cannot be trusted to protect sensitive information provided to them by the public they serve, the public have every right to withhold information - but the civil disruption this would cause has far-reaching consequences.

UPDATE 19th Jan: more stories of improper disclosure of personal information by officials are adding to the Government's woes, and more importantly increase the risk of identity theft of British residents. Today we read that (1) a Ministry of Defence laptop, stolen from a car (doh!), contained personal details on 600,000 applicants to join the forces, some of whom will have provided the full nine yards necessary to undergo security clearance; and (2) papers containing personal data on benefits claimants were found strewn across a West country roundabout, for at least the second time in two months. The man who discovered the latest batch of papers found and reported a similar load at the same place in November. We don't know if any more papers might have been lost or abandoned there and discovered by criminals during the last two months, or indeed previously or subsequently. ['Strewn across a roundabout' is a rather extreme example of "unstructured data". An article in December 2007's ISSA Journal on managing unstructured data patiently explains how to get a grip on unstructured data in ten steps, most of which are virtually impossible to do any Real World organization and all of which ignore paper records. Data Leakage or Loss Protection (DLP), another security industry buzzword, likewise deals with a small part of the problem, and not very well at that. \rant]

Who will be held accountable for these security screwups? Will anyone lose their job, be fined or end up in prison as a result? Somehow I doubt it. It is the British Government after all. A press release on AccountingWeb says:

"The Information Commissioner, whose office was established to protect personal information and take appropriate action where the law is broken, described the scale of the loss as “unprecedented” and stated that data protection laws have almost certainly been breached. This loss of information serves as a timely reminder to businesses and organisations that they are legally obliged to ensure the safety of personal information relating to individuals."

UPDATED Jan 20th: a USB stick lost by a hospital worker had personal details of thousands of patients but apparently it's OK because "The loss was an accident rather than any systematic failing in management and governance". I assume from the BBC item that the data on the memory stick were not encrypted. What's more, "diaries containing patients' names and addresses were stolen from staff cars in two separate incidents in June." There are two good examples of "a systematic failure of management and governance", and here's a third: local management evidently decided not to inform the patients about the loss of their personal data because, in their estimation, the data could not be used for identity theft. I hope the patients concerned will complain and the Privacy Commissioner will prosecute the hospital under the Data Protection Act.

UPDATE 22nd Jan: the MoD (that's Ministry of Defence, yes, Defence, Her Majesty's Government department charged with, and paid vast amounts of taxpayers' money to protect the Realm and maintaining the freedom of her people) has now revealed that it has lost laptops with sensitive personal data on potential recruits at least twice before. With typical British understatement, shadow defence secretary Liam Fox called it a "dreadful mess". He really is awfully, awfully sorry.

"Data on the laptop stolen in Edgbaston on 9 January included passport, National Insurance and driver's licence numbers, family details and NHS numbers for about 153,000 people who applied to join the armed forces. Banking details were also included for around 3,700 people ... It is clear that the database files were not encrypted, in breach of MoD procedures ... Some 68 MoD laptops had been stolen in 2007, 66 in 2006, 40 in 2005 and 173 in 2004."

The same BBC news story reports that:

"The new rule on laptops comes in an e-mail from the Civil Service chief, Cabinet Secretary Sir Gus O'Donnell, to all government departments. It said: "From now on, no unencrypted laptops or drives containing personal data should be taken outside secured office premises. Please ensure that this is communicated throughout your organisation and delivery bodies and implemented immediately, and that steps are taken to monitor compliance."

New rule? NEW RULE! From now on!! Someone has evidently been asleep at the wheel. The situation is completely out of hand in the UK. Government departments cannot ignore the law and have a clear duty to protect the personal information entrusted to them by citizens. They need to be held to account. If not, citizens will, quite justifiably, withhold their information from public bodies, like for example the tax office and social security department ... and there lies the route to anarchy.

UPDATE Jan 26th: The BBC reports that:

"Marks and Spencer has been found in breach of data protection rules after the theft of a laptop containing the personal details of 26,000 employees. The Information Commissioner's Office (ICO) said the data on the laptop, which was stolen from the home of an M&S contractor, was unencrypted. The ICO has ordered M&S to make sure all laptop hard drives are fully encrypted by April 2008."

So it would appear that laptop encryption is now mandatory in the UK for any organization handling personal data!

UPDATE 5 Feb 15th: 5,000 patients of a Dudley hospital face anxiety over possible identity theft thanks to the theft of a laptop. We're told the laptop was "password protected" which, as we all know, is spin on "not encrypted".

"A spokesman for the trust said the laptop and database were protected with two separate passwords, making it very difficult to access. He added: "We would like to apologise for any concern this matter has caused those patients affected and would like to reassure them that the information on the database is unlikely to be recoverable."

Yeah, right.

UPDATE #6 22 Feb 08: personal medical records on 3,000 patients in Bolton were dumped in landfill. Eee, it's grim up North.


UPDATE #7 Leapday: some good news at last! A laptop and CD which appears to have belonged to the Home Office has been recovered by Police after it was purchased on eBay and sent to a repair shop. Even better news is that the CD and laptop were encrypted. Police are investigating how it ended up there. The repairman should be congratulated for reporting it. As to whether Al Qaida is now moving into the laptop repair business, we can only speculate.

UPDATE #8 - the final update? With no end in sight, I'm getting bored of this blog item, so it's time to close with perhaps just a little hope for the future. I've just chanced across a Liberal Democrat's blog listing several security/privacy incidents that I've mentioned here and a few more for good measure. The blogger, Frank Little, describes himself as a semi-retired hack computer programmer. I'm not entirely sure if that's hack as in journo or hack as in hacker, but at least he has an obvious interest in the UK's data protection mess. Vote wisely at the next election!

UK insurance firm fined for pretexting incidents

The UK's Financial Services Authority has fined insurer Norwich Union £1.26m as a result of inadequate protection of customers' personal data:

"The City watchdog says Norwich Union's life assurance unit did not have effective systems and controls in place to protect customers' confidential information and manage financial crime risks. These failings resulted in a number of actual and attempted frauds against policyholders. Slack call centre security allowed fraudsters to use publicly available information - including names and dates of birth - to impersonate customers and obtain sensitive customer data, says the FSA. In some cases criminals were able to ask for confidential customer records, such as addresses and bank account details, to be altered. The fraudsters then used the information gleaned to request the surrender of 74 customers' policies totalling £3.3 million in 2006. The FSA says its investigation found that Norwich Union Life failed to properly assess the risks posed by financial crime and as a result, its customers were more likely to fall victim to identity theft."

The official FSA report makes interesting reading, disclosing for instance that fraudsters were using information obtained legitimately from public records held at Companies House to respond to authentication questions.

The company has since smartened up its act with better policies, procedures and (hopefully) compliance activities but I doubt that even it would claim to be immune to social engineering risks. Pretexting is a relatively cheap and easy form of attack and the juicy personal data in such databases is clearly luring fraudsters.

Carelessness threatens privacy

Three stories from the BBC today demonstrate, as if demonstration were necessary, that carelessness with IT storage media can easily expose the personal data of thousands of individuals to the potential of identity theft:

1. The Driver and Vehicle Agency in Northern Ireland lost 2 disks containing details of 6,000 people en route to its headquarters in Swansea.

2. Leeds Building Society mislaid personal details of 1,000 employees while moving the HR department from one floor to another.

3. A Merseyside health care trust "accidentally" sent out personal details on thousands of staff to four medical organisations bidding to supply the trust.

If the data involved had been printed out, I suspect those involved would have taken more care with the filing cabinets or boxes of paper but CD-ROMs or DVDs seem so insignificant.

Security policies, procedures and guidelines, coupled with effective security awareness activities and staff training, are obvious controls for such situations, along with encryption of anything confidential and care over the encryption keys.

Breach disclosure net widens

California State Bill 1386 was the first US bill to insist that organizations disclose to Californian citizens details of privacy breaches affecting their financial data, an idea since extended to around 40 US states.

SB1386 opened the flood gates when privacy breaches affecting millions of data subjects were disclosed. Prior to SB1386, even huge privacy incidents were successfully hushed up or downplayed by embarrassed (borderline unethical) organizations' spin doctors. SB1386 woke up an ignorant or complacent public.

The Californian law is now being extended to include privacy breaches involving medical and health insurance information under AB1298:

" AB 1298 adds two new breach-triggering data categories to the law of “health insurance information” defined as a health insurance policy or subscriber number(s), any information in an individual’s application and claims history, including any appeals records; and “medical information” including any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional."

One in two Brits at risk of identity theft, admits HM Government

After two CD-ROMs containing personal data on 25 million Brits from Her Majesty's Revenue and Customs office failed to arrive at the National Audit office, questions were asked in Parliament. Yes, AFTER the event.

Both the BBC and the Grauniad report on the "gasps of astonishment" from MPs when told of the incident. Given the British tendency for understatement, this is about as close as you'll get to a public expression of outrage.

The officials who posted the CD-ROMs evidently did not "follow procedures". If the data hadn't been going to the auditors, there is a very good chance we would never have heard about this incident ... but I can't help asking whether the NAO would have created a stink if the CDs had simply turned up in the ordinary post, instead of being send by a secure courier. I'd be willing to bet that all sorts of juicy stuff turns up in their mail and email every day, but I can't recall seeing them jumping up and down about the risk.

Whether Chancellor Alistair Darling swings for this is presumably in Her Majesty's hands. I believe the death sentence is still on the cards for treason in the UK. Now that's what I call accountability.

Information Asset Protection guideline

ASIS International has released a guideline on protecting information assets.

"This guideline is organized into three primary sections. The first section offers a general framework and some guiding principles for developing an effective Information Assets Protection (IAP) policy within any organizational setting. The second section proposes recommended practices that may be applied in the implementation of a high-quality IAP program. The third section consists of two appendices that provide useful tools for any size organization. Appendix A consists of a Sample Policy on IAP. Appendix B is a Quick Reference Guide, a sample flow chart for assessing information protection needs that can be modified and customized to meet an organization’s needs."

The guideline recommends categorizing, classifying and valuing (or rather "valuating"!) the organization's information such as
● Proprietary information - customer lists, marketing plans, pricing strategies, test results etc.
● Trade secrets
● Patent information
● Copyright information
● Physical products - prototypes, models, molds, dyes and manufacturing equipment etc.
● Trademarks and service marks
● Privacy information - personal data, evaluations, credit info etc.
● Regulated information - health information, financial data, government
classified etc.

It recommends technical/logical, procedural/manual and physical security controls, although technical controls such as firewalls are merely noted and not explained. Information security awareness and training however merits a specific mention in section 12.7:

"Almost invariably, security awareness and training is one of the most cost effective measures that can be employed to protect corporate and organizational information assets. This is largely due to the fact that protecting information, generally more so than any other asset, is best achieved through routine business practices that permeate every element of an organization. Therefore, where each individual entrusted with sensitive information takes prudent measures and personal responsibility for protecting those assets, a robust security environment should occur naturally."

The sample organizational policy on information asset protection in Appendix A is a decent model for a high level/overarching information security policy such as that recommended by ISO/IEC 27002 section 5.

Credit card numbers posted on eBay forum

Someone appears to have posted a load of personal data including credit card numbers on an eBay discussion forum, paradoxically one on trust and safety. Around 1,200 eBay users' details may have been compromised.

Why anyone would do this remains a mystery. Is it just some sort of publicity stunt, or a hacker's brag?

eBay shut down the forum and pulled the pages about an hour after being informed of the incident. There's more about the incident on an eBay blog.

"eBay spokesperson Nichola Sharpe said Tuesday afternoon that posts made on the Trust & Safety board early this morning contained name and contact information for 1,200 eBay members and called the person posting the information a "malicious fraudster." She said the incident was not the result of a security breach from eBay and could have been obtained as part of an account takeover."

It's possoble that a merchant's account may have been compromised, I guess.

Privacy in the 21st Century

This week is the third annual Global Security Week. This year's topic is Privacy in the 21st Century. For information on GSW events, free awareness materials to download and links to further privacy resources, visit the GSW website.

There's also a GSW blog: I've just posted the following item to the GSW blog and there are contributions from supporters of GSW.

Does your organization have a policy on promptly informing those affected by privacy incidents and, where necessary, disclosing breaches to the proper authorities? If not, a privacy incident at John Hopkins Hospital might make you think again:

"A desktop computer containing the personal information of 5,783 patients was stolen from Johns Hopkins Hospital in mid-July, and the hospital waited more than five weeks to inform the patients or their families of the theft. The computer, taken from an "administrative work area" in a building on Johns Hopkins' main campus the night of July 15, contained patients' names, Social Security numbers, birth dates, medical histories and other personal information, according to Hopkins officials. Another computer and a projector were also stolen."

Another suggestion is to make sure your organization's contingency plans cover privacy and security incidents, giving management a blueprint to help them deal with a crisis in the most efficient and professional manner possible under the circumstances.

The business case to protect PII

I'm impressed by a Ponemon Institute study into the business costs incurred through US data breaches involving disclosure of Personally Identifiable Information PII. Ponemon investigated around 80 reported braches, analyzing costs that are often hard to quantify such as customer defections. The results are fascinating: an average breach costs over $4m or ~$180 per record lost. Customer defections (and presumably a reduction in the number of new customers) are the main impact.

Incident costs within IT are negligible - the costs fall primarily on the rest of the business. In extremis, it could be said that IT doesn't care about privacy breaches. Therefore, the onus is very firmly on the rest of the business, not IT, to cost-benefit justify investment in better privacy controls. If the budget is forthcoming, I'm sure IT will happily evaluate, select and implement better privacy controls: if not, they won't. It's that easy.

This clearly demonstrates the distinction between IT security, a function sitting within IT and working on behalf of IT to secure the IT infrastrucutre and services, and information security, a function with responsibilities across the entire organization to protect information assets, not just technology.

Best of all, the Ponemon report provides useful data to build the business case for control improvements. Let's say we anticipate one notifiable serious data breach involving PII every 5 years, at $40m per incident that makes an average cost of $8m per year. So, controls costing up to $8m per year are justified. $8m would buy a lot - it's probably more than enough to implement whole disk encryption for laptops, for example. It's WAY more than enough to implement a security awareness program focusing on protection of PII.

Identity cards and all that

Thanks to Paulo, an Italian blogger talking about his attendance at The European e-Identity Conference held in Paris earlier this month, I've been browsing the conference presentations. Many concern ID cards, massive PKI systems plus the national and international interoperability issues arising.

A case study [PowerPoint presentation and PDF paper] on the national ID card scheme in Estonia ("E-stonia") has several lessons for other nations currently planning their own schemes. It is surely one of the most advanced pilots with live applications in banking, eGovernment (including online voting) and of course routine personal authentication. Mind you, I do hope that Mari-Liis Mannik is happy to see her ID card (complete with mugshot, signature, date of birth and personal code number) displayed for all to see on the WWW.

A fascinating paper (for those with an interest in ePassports and PKI anyway) reveals the authentication schemes being implemented in today's electronic passports. I particularly enjoyed the author's description of Terminal Authentication - no, that's not the final check before execution but the mechanism by which an immigration official's system "convinces" the passport to release sensitive biometric data.

Finally, there's a Carnegie Mellon University study into the privacy implications of social networking sites such as FaceBook. The study team successfully downloaded 4½ thousand FaceBook profiles from the CMU community before being locked out by the site administrators, and then proceeded to analyze the profiles. They correlated information posted on the site with that obtainable from other public sources, and interviewed members to reconcile what people say about privacy to what they actually publish. It is clear that a large proportion of individuals are uniquely identifiable through voluntarily disclosing their real names, email addresses, photographs, birthdays, home towns, schools, interests and even phone numbers. Why people choose to disclose so much in this way is not nearly so clear, though.

Data Protection Act requires personal user IDs

DISCLAIMER: I am not a lawyer. This blog piece is based on incomplete information and hence speculation on various assumptions that may or may not be true. Still, it's an interesting case ...

The UK's Information Commissioner (IC) has released details of an undertaking affecting British mobile phone company, Orange (Orange Personal Communications Services). The issue specifically concerns Orange's practice whereby existing employees share their userIDs and passwords with new employees, presumably before their own have been set up, in contravention of principle 7 of the Data Protection Act.

Principle 7, the security principle, reads as follows:

"7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."

The seventh principle is interpreted further in Part II of the Act:
"

9. Having regard to the state of technological development and the cost of implementing any measures, the measures must ensure a level of security appropriate to -
(a) the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage as are mentioned in the seventh principle, and
(b) the nature of the data to be protected.

10. The data controller must take reasonable steps to ensure the reliability of any employees of his who have access to the personal data.

11. Where processing of personal data is carried out by a data processor on behalf of a data controller, the data controller must in order to comply with the seventh principle -
(a) choose a data processor providing sufficient guarantees in respect of the technical and organisational security measures governing the processing to be carried out, and
(b) take reasonable steps to ensure compliance with those measures.

12. Where processing of personal data is carried out by a data processor on behalf of a data controller, the data controller is not to be regarded as complying with the seventh principle unless -
(a) the processing is carried out under a contract -
(i) which is made or evidenced in writing, and
(ii) under which the data processor is to act only on instructions from the data controller, and
(b) the contract requires the data processor to comply with obligations equivalent to those imposed on a data controller by the seventh principle."

Possibly the IC may have been unable to determine which of a number of people sharing an ID infringed the Data Protection Act in some way, perhaps a privacy incident? Equally, this action may have been taken to forestall such a situation in future.

It seems strange to me that the IC would be concerned about the internal operations of a data processor in this level of detail, especially given that neither the principle nor the explanatory notes explicitly ban the sharing of user IDs.

Sharing of user IDs is not uncommon in practice but is normally covered by a corporate policy stating that the legitimate owner of an ID must keep their ID and password private, and is personally accountable for whatever happens under their ID. In that way, even if someone shares their ID with someone else who creates a problem, the original person is held to account both for disclosing the password and for the incident that ensued. Perhaps Orange did not have such a policy in place, or perhaps it (in effect) forced employees to share their IDs with others? I can only guess. Anyway, Orange has undertaken to cease the practice and is probably busy slickening-up its security admin processes to get personal user IDs and passwords quickly to new employees.

In addition to that made by Orange, undertakings have been made by the following organizations: Littlewoods, Alliance and Leicester, Barclays Bank, Clydesdale Bank, Co-operative Bank plc, Dipesh Limited, HBOS plc, HFC Bank Limited, National Westminster Bank plc, Nationwide Building Society, Phones4U, Post Office Limited, Scarborough Building Society, The Royal Bank of Scotland plc and United National Bank Limited (and presumably others not currently listed on the IC's website).

[The preponderance of banks and financial services companies in this list arises largely from a mass enforcement action in March resulting from the disclosure of bank customers' personal details in the trash.]

US email searches require a search warrant

A ruling by 6th US Circuit Court of Appeals has confirmed that email users have the same 'reasonable expectation of privacy' as they do in respect of their phone calls. A search warrant is therefore required before the Goverment (or indeed anyone I guess) can legitimately access and search emails stored by Internet Service Providers. Furthermore, I understand the owner of the emails must be notified and given the right to object.

"In considering the factors for a preliminary injunction, the district court reasoned that e-mails held by an ISP were roughly analogous to sealed letters, in which the sender maintains an expectation of privacy. This privacy interest requires that law enforcement officials obtain a warrant, based on a showing of probable cause, as a prerequisite to a search of the e-mails."

But remember folks, IANAL. I have no idea whether this ruling is also relevant to companies accessing employees' emails, for example.

Thumbs down for security

A professor on holiday in Madagascar lost a USB drive containing personal data on ~8,000 students, and another one stolen from a Michigan university contained info on ~3,000 students. Both incidents exposed students' names and Social Security Numbers, and could potentially lead to identity theft.

We hear about these kinds of incident because the organizations have to inform the data subjects, and word either leaks out to the media and public or they come clean through press releases.

We don't often hear about such incidents:
- in places where there is no compulsion to inform data subjects about them
- where the loss is unnoticed or goes unreported
- involving loss/disclosure of proprietary or military as opposed to personal information
- on a smaller scale, where it is not considered so newsworthy

... in other words, it's even worse than it seems. USB flash memory drives should be routinely encrypted.

Microsoft beats Google in privacy stakes

Privacy International, a pressure group on privacy issues, recently rated Google as the worst performer in a ranking of major web services companies, worse even than Microsoft. The summary report notes a catalogue of privacy concerns with the way Google operates (some of which have landed it in court facing EU action), and contrasts that with Microsoft's moves to improve its privacy stance in recent years.

The report's conclusion notes that none of the surveyed companies came out semlling of roses.

"Overall, the privacy standard of the key Internet players is appalling, with some companies demonstrating either wilful or a mindless disregard for the privacy rights of their customers. Even the better performing companies create lapses of privacy that are avoidable. With minimal effort most organizations can improve their privacy performance by at least one grade."

Pfizer privacy breached by P2P

Compromise of a laptop PC belonging to Pfizer Inc. has exposed personal data belonging to over 15,000 employees. The breach involved unauthorized peer-to-peer software.

Two more privacy resources

Thanks to a reply to a question on the IIA's IT Audit discussion board, I have discovered two useful privacy resources.

Firstly, the IIA's Global Technology Audit Guide (GTAG) number 5 covers Managing and Auditing Privacy Risks which

"is intended to provide the chief audit executive (CAE), internal auditors, and management with insight into privacy risks that the organization should address when it collects, uses, retains, or discloses personal information. This guide provides an overview of key privacy frameworks which help to understand the basic concepts and aid in finding the right sources for more guidance regarding expectations and what works well in a variety of environments. It also covers the details on how internal auditors complete privacy assessments."

Secondly, the American Institute of Certified Public Accountants (AICPA)'s Generally Accepted Privacy Principles (GAPP) cover the following ten key privacy issues:

1. Management: the organization must define, document, communicate and assign accountability for its privacy polices and procedures.

2. Notice: the organization must provide notice about its privacy policies and procedures and identify the purpose for which personal information is collected, used, retained and disclosed.

3. Choice and consent: the organization must describe the choices available to the individual and obtain implicit or explicit consent with respect to the collection, use, and disclosure of personal information.

4. Collection: the organization must collect personal information only for the purposes identified in the notice.

5. Use and retention: the organization must limit the use of personal information to the purpose identified in the notice and for which the individual has provided implicit or explicit consent.

6. Access: the organization must provide individuals with access to their personal information for review and update.

7. Disclosure to third parties: the organization must disclose personal information to third parties only for the purposes identified in the notice and only with the implicit or explicit consent of the individual.

8. Security for privacy: the organization must protect personal information against unauthorized access (both physical and logical).

9. Quality: the organization must maintain accurate, complete and relevant personal information for the purposes identified in the notice.

10. Monitoring and enforcement: the organization must monitor compliance with its privacy policies and procedures and have procedures to address privacy-related inquiries and disputes.

Anyone familiar with the EU's data protection principles will probably recognize the commonality with GAPP.

New privacy book

A draft of a new book on privacy (Engaging Privacy and Information Technology in a Digital Age) is available for free download from the publisher. Its 400+ pages cover everything from conceptual frameworks to privacy and related laws in the US and elsewhere. If privacy is a core topic for your organization, I'd recommend making time to go through this in depth.

Privacy and insider threats collide in databases

A Ponemon Institute survey into database security found that:

"- Trusted insiders remain a significant, and largely unmonitored risk
- A majority of organizations do not have the technology or processes required to effectively manage against insider threat
- Due to perceived business value, many large organizations assign lower priority to the protection of customer and employee data versus intellectual property
- The vast majority of data exposed in the past two years has been confidential customer and employee information.
The survey found that “trusted” insiders’ ability to compromise critical data is the most serious concern for respondent organizations. Despite this concern, fifty-seven percent of those surveyed do not believe that their organizations have taken adequate measures to protect against malicious insiders and fifty-five percent do not believe that they have taken adequate measures to protect against “data loss.”
The survey also found that despite being aware of these threats, inadequate protection of corporate databases is the norm rather than the exception. Forty percent of those surveyed do not have the mechanisms in place, or are unaware of whether databases are monitored for suspicious activity. This shortfall can be attributed to the massive scale of corporate data stores and the lack of IT resources. Eighty-eight percent of those surveyed manage greater than one hundred databases and a majority of respondents manage in excess of 500 databases."

Although the survey was sponsored by a company with a vested interest in database security, the survey sample was large enough for the results to be statistically significant. The Ponemon Institute is a respected survey institution, for instance including notes in the report about possible biases in the respondants and responses. To a non-scientist, it may seem perverse that pointing out possible weaknesses in the method actually makes is stronger, but better that than to ignore or gloss over them.

As to what needs to be done about database security, the survey commentary merely suggests a few hints e.g.:

"Among core security and IT professionals, operational efficiencies and system optimization are consistently higher priorities than efforts related to Sarbanes-Oxley, PCI, NIST 800-53 or other similar compliance initiatives ... our results show that intellectual property and business confidential information in databases is not generally protected. Even in the face of frequent, expensive, and highly publicized breaches, respondents have not made protecting customer and employee information a high priority."

... so priorities need to be adjusted (but how?).

Perhaps Lloyds TSB has (part of) the answer?

Privacy breach affects 100k Texan police

The personal information of "every police officer in Texas" (nearly 100,000 people) has been compromised by the theft of a laptop from a Houston company that stores sensitive records for the Texas Commission on Law Enforcement.

Well that's one way to raise police awareness about identity theft, I suppose.

VA privacy breach leads to significant security improvements

A decidedly up-beat Computerworld article identifies 5 significant security improvements that were spurred on, if not triggered, by the theft of a U.S Department of Veterans Affairs laptop and external hard drive containing personal data on 26.5 million vets and active-duty military personnel:

1. A greater focus on data encryption within government
2. Stronger breach notification guidelines within agencies
3. More attention to data retention, classification and minimization
4. Stronger remote access policies
5. More authority for agency CIOs

The piece is so positive in style, it almost smacks of wishful thinking or marketing spin but even if only partly true, these are all indeed worthwhile changes, especially if they are as widespread in US Government circles as the journalist says.

It is a shame, of course, that it took a massive security breach (ex facto rather than a priori risk analysis) to prompt the changes but nevertheless this is a good example of closing the circle on an incident.