Research and retrieval of news articles by:
Bennett Gold LLP, Chartered Professional Accountants

SPECIAL NOTE TO ALL VISITORS:
Effective December 31 2012, articles are no longer being updated on this web site.
The site is now maintained as an historical archive, covering notable e-commerce news articles from the period 1999 to 2012.

OFF-NETWORK SECURITY - IT'S ALL ABOUT ASSET MANAGEMENT

Posted on November 30, 2009

After a decade of privacy laws and billions of dollars spent on data protection, data breaches are still common and persistent. The media loves to report them. Companies have learned to fear them, and for good reason. Breaches that expose customer or employee personal data are hideously expensive, and can lead to immense brand damage. One well-publicized breach cost $256 million. In 2008, the average cost per compromised record was $202, according to the Ponemon Institute.

Despite the best efforts of hackers and data thieves to find new ways to compromise corporate network security, the majority of breaches occur when data-bearing devices are taken "off the wire," i.e., off-network, and simply lost. In a 2007 Ponemon Institute study of 735 security professionals, 73 percent report that their companies had lost a data-bearing asset in the previous two years. Even worse, 30 percent report that they would never know if an off-network loss occurred - a fact that does not relieve them of their legal duty to report and remediate a breach under privacy laws.

The root cause behind most of this loss, cost and brand damage is mundane: errors stemming from failure to follow procedures, and simple sloppiness. Contrary to common perception, most losses do not occur off the back of a truck, but rather while assets are idle at a company facility. Effective corrective action requires more than exhorting people to be more careful. To prevent off-network data breaches, companies must apply tools and new rigor to create the necessary controls for avoiding that most human of outcomes: error.

What and where is it?

Accurate inventory information at every change of control is the basis of all asset security. Serialized lists must be created for all equipment that is removed from the network, and those serial numbers should be logically associated with a secure, physical location in the facility. Ideally, companies should establish a live asset repository for all inventory information. When assets are moved, the repository lists must be updated, and the individuals involved in the change of custody must be responsible for their accuracy. Periodic cycle counts should verify inventory accuracy, and any time the numbers donŐt match, every effort should be made to reconcile the discrepancy. One of the best ways to encourage a lax attitude about security is to find a shortage and do nothing.

Is it a data bearing device, and if so, is it encrypted or sanitized (erased)?

Asset information for each device should include its data-bearing status. Under most privacy laws, loss of an encrypted or sanitized asset is not considered a breach. Extra care must be taken to ensure the security of those devices containing live, unencrypted data, and extra diligence is required to ensure that inventory figures for such devices are accurate. Ideally the data-bearing status of each asset is recorded in the asset repository.

It is tempting to think of data-bearing devices as limited to PCs, servers, SANs, and the like, but everything that stores data must be included in off-network security procedures: telephony, printers, copiers, certain network hardware, and more.

Is it secure in transit?

Though in-transit losses are relatively infrequent, assets are certainly much less secure during shipping. The logistics industry was designed for moving consumer goods and bulk materials, not data. Freight companies are often challenged even to maintain accurate inventories by serial number, and will insure consignments only for a nominal per-pound value. It is the shipperŐs responsibility to reconcile asset inventories before and after shipping. Many companies require that data-bearing assets be sanitized before shipping. Think twice before putting live, unencrypted data on a truck.

What is the chain of custody between its current and future states?

Errors will happen. The ability to track each asset through all changes of control is critical to containing the cost of inventory discrepancies. A 2009 Ponemon study documenting the cost of a lost laptop found that the faster a company learned that a laptop was lost, the lower the average cost. It showed that when losses go undetected for more than a week, the cost is almost 13 times higher than when losses are detected within one day. When resolved the same day as the loss was first noticed, the average cost is $8,950. If it takes more than one week, the average cost rises to approximately $115,849. When shipping data-bearing assets, it is important to note that the average shipment will change trucks at least twice before delivery. Though more expensive, it is much more secure to specify direct-to-destination delivery, and even sealed trailers, when shipping live, unencrypted data.

Where has all the data gone?

There is a tendency to equate end-of-life data protection with data sanitization, which is only one essential component of the process. "Drive wiping" to a "DoD standard" is the common practice of using software to overwrite live data with a pattern on obliterating data. Though reliable when it works, it rarely works more than 90 percent of the time. Overwrite failures occur for a variety of reasons, including human error, hardware/software incompatibility, and drive hardware failures.

Therefore, verification is an essential component of any overwrite process. Drives that cannot be overwritten must be physically destroyed. Some companies believe that destroying all hard drives is more secure than overwriting. However, the added complexity of inventory and records management in a "shred everything" approach usually leads to more inventory discrepancies - not less. Destroying hard drives entails a substantial loss of asset value, and a corresponding increase in total cost of ownership. Regardless, documentation should be maintained verifying the sanitization of each hard drive in each data bearing device.

Are people part of the solution?

If human error is at the root of most data breaches, then discipline and accountability are fundamental to the fix. Communication of data protection policy and procedure must be clear and repetitive. Individuals with control of data bearing devices must receive training in their personal responsibilities for data protection. People who demonstrate lack of care, or even negligence, should be disciplined. Effective off-network data protection encompasses good policy, good procedures, good tools, and good training. As in an athletic performance, high performers add one essential elementŃdiscipline.

E-Commerce Alerts are issued by Bennett Gold LLP, Chartered Professional Accountants as situations develop. Bookmark this site and check back often. Our e-mail address is: info@BennettGold.ca

In accordance with United States Code, Title 17, Section 107 and Article 10 of The Berne Convention on Literary and Artistic Works, the news clippings on this web site are made available without profit for research and educational purposes.

ALERT
ARCHIVES
Final Entries
2012
2011
2010
2009
2008
2007
2006
2005
2004
2003
2002
2001
2000
1999