I had not intended this blog to become a security-related publication, or one dealing exclusively with theft of laptops and storage media. But there is certainly a trend developing; let’s hope it does not last.

Following on from yesterday’s post, and from my post of 24 August 2008, we learn today from a report on RTE, Ireland’s national broadcaster, that a laptop computer containing  the records of some 75,000 customers of Bord Gais Eireann (BGE – the Irish Gas Board) was was one of four stolen on 5 June 2009, although news of the theft was only released today, 17 June 2009. The records relate to customers who signed up for the BGE “Big Switch” campaign, which encouraged them to move their account for electricity supply from the Electricity Supply Board (ESB) to BGE. Like previous incidents, data on this laptop was reported not to have been encrypted.

This time it’s personal, as I have been potentially affected by this latest security failing.

It appears to me that many (I suspect a very, very large number) organisations that process personal information simply do not take the issue of electronic data security and data privacy seriously enough. Throughout the world, we learn regularly of significant breaches of customer confidentiality. As  I wrote in my August 2008 post, many of these incidents occur through the failure to manage portable devices and removable media effectively. But there is also a lack of appropriate polices, procedures, practices, guidelines and controls. Indeed, in many organisations, there appears to be little or no attention paid to security at all, except for template procedures and documents.

The 2008 Annual Report of the Irish Data Protection Commissioner provides information on the top ten threats to individual privacy as identified by his staff. The unscientific list represents perceptions of Commission staff of the major threats to privacy at the close of the year 2008, based on the queries and issues they deal with on a day to day basis. The top ten threats are identified as follows:

1. Failure of organisations to have even the most basic protocols in place to minimise the loss of customer and employee data.
2. Continued lack of proper procedures in public and private sector bodies to limit access by their employees to personal data on a ‘need to know’ basis.
3. Failure to take due account of the legitimate privacy expectations of members of the public when moving towards greater efficiency of public services.
4. The tendency of new legislation to seek ever more personal data from the public and the sharing of that data between organisations without (in many cases) any real business case to justify such sharing.
5. Criminals using increasingly sophisticated methods to part individuals from their personal data for criminal and fraudulent use.
6. The extended use of the Personal Public Service Number (PPSN). This is the number given to each citizen by the Government to identify them when they interact with public bodies. More and more services seek to use this identifying number, often without any credible justification.
7. Publication and availability of excessive personal data on the internet (sometimes placed there by the individuals themselves on social networking sites etc).
8. Continued lack of awareness among data controllers of their data protection obligations.
9. Indifference on the part of data controllers to the consequences of their actions when they deliberately and persistently refuse to respect the data protection rights of their customers.
10. Continued lack of awareness on the part of members of the general public (who, as a result, give away their personal information too easily, don’t ask why personal information is needed or fail to ‘tick the box’ to say that we don’t want to be contacted).

BGE issued a short press release advising that it had promptly informed the Irish Police and the Data Protection Commissionerof the theft and that it will be contacting all affected customers. However, since there has been almost a two-week lag between the occurrence of the theft and the issue of the press release today, it is possible that customers’ financial or other personal information could have already been compromised. This is simly not good enough. It is no good doing things right (if you can call a two week delay in advising affected customers “right”) after an incident has occurred; appropriate steps must be taken to ensure that such incidents do not occur in the first place and that, if they do, the risk to information security is minimised or removed entirely. Time will tell whether the “risk assessment” referred to in the BGE statement led them to a correct decision not to advise customers sooner; I hope they got that right.

Organisations must take serious steps to improve security now. Some of the steps they take might include:

• Raising security awareness among all staff and providing appropriate training.
• Assigning responsibility for information security to the right people, not just to the IT department.
• Implementing appropriate and effective security policies, procedures and practices.
• Implementing adequate and effective information security controls and risk management systems.
• Carrying out regular audits of information security practices.
• Encrypting data on laptops, portable devices, tapes, removable storage and other vulnerable media.
• Implementing appropriate controls over removable media and devices.
• Introducing strict penalties for staff who breach security requirements including, for serious breaches, dismissal.
• Revisiting my post of August 2008 for further information on information security.
• Visiting the web site of the Irish Data Protection Commissioner, which is full of good information on information security.
• Reading the 2008 Annual Report of the Data Protection Commissioner, which is an excellent document and gives an overview of the activities of the Commissioner and provides information on prosecutions, investigations, summary data, etc.

Organisations and individuals must realise and accept that information security is not an issue for the IT department alone; it is a business issue and needs to be treated as such. Staff who use laptops, portable devices and removable media must understand that it is their responsibility, not the IT department’s, to keep data safe. And basic security, like locking these devices away or securing them appropriately, as well as encrypting them, must become the norm, not the exception.

Under Irish Data Protection Legislation, penalties for breaches of the law can be severe and encompass both civil and criminal proceedings, fines and forefeiture and destruction of equipment. Bodies corporate and individuals are subject to the provisions of the legislation. Fines of up to 250,000 euros can be imposed. Maybe it is time that fines of this magnitude were imposed. Without tough enforcement, I fear that breaches of the law and loss of personal data will continue to occur.

Kevin Kehoe, who I thank for commenting on my previous post, mentioned that organisations need to assess their appetite for risk. Perhaps it is time to dampen that appetite dramatically and, when it comes to handling the personal private information of customers, staff, prisoners, benefit applicants, etc, accept that no appetite for risk at all is the desired attitude to have.

If you have been affected by the BGE failing and feel strongly enough about the matter to complain, you can get all the information you need to make a complaint from the Data Protection Commissioner’s website.

What do you think? Are you concerned at how easily and how often personal private information is stolen, disclosed or otherwise compromised? Have you been personally affected by a breach of your privacy? Have you lost money or suffered other negative consequences? Have you been responsible for a breach of data security?

Leave a comment and let me know.

If you liked this post, you might also like:

Laptop Theft and Data Loss By Irish Health Service Executive

Data loss by PA Consulting

Receive new articles from johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!

I wrote about this topic on 24 August 2008 in relation to the loss of data about people who became involved with state agencies. I suppose it is hardly surprising that the same issue has happened again. In this most recent case, the Irish Health Service Executive (HSE) lost about 15 laptop computers, which were stolen from their offices in Roscommon Town. RTE, Ireland’s national news broadcaster, reports that, while information on 13 of the laptops has been encrypted, what is described as confidential information on one of the other two machines is accessible to anybody in possession of the laptops. The HSE is reported to have said that it ‘is satisfied that there was no identifying information in relation to patients or clients on one of the non-encrypted laptops.’

The truth is, of course, that the HSE cannot make this statement with any confidence, unless they subject their laptops, removable devices, and other storage media to continuous audit and stringent data management policies and controls, which, I suggest, is highly unlikely. In my opinion, there is as much probability of confidential information being stored on any of those laptops as not. The HSE probably has no way of knowing one way or the other; if it does, it should be required to produce the evidence in public immediately.

The ubiquity, portability and ease of use of laptop computers and other removable storage devices make the occurrence of theft and data loss almost inevitable. Indeed, I am sure that I could probably be found wanting myself in this regard, despite the fact that I advise, consult and speak on the topic of information and data security from time to time. As it happens – and this is merely because of the nature of my work – I do not need to store personal private information on my machine. However, I suspect that, on any of my computers or storage devices, there probably lies an old email, an old file, or a stored chat session that related to some private information. Simply put, it is dangerous in the extreme to believe that private information might not be stored on any electronic device. Therefore, the utmost precautions should be taken in all cases and at all times.

It is really time that all people who are in control of personal private information, whether in the public or private sectors, took this issue seriously and started taking immediate, practical and effective steps to secure the data they store and control. It might well be worth reading my previous article again, where I provided advice and guidance on how to improve data security.

What are you doing about information and data security in your organisation? Do you think data processors and data controllers are taking enough care of personal private data?

Leave a comment and let me know.

If you liked this post, you might also like:

More Laptops Stolen – And This Time It’s Personal!

Data loss by PA Consulting

Receive new articles from johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!

The recent loss by PA Consulting of data about criminals in Britain raises many questions about data security and highlights the difficult of guaranteeing privacy and security of data.  With the proliferation of portable storage devices, coupled with their increasing capacity and low cost, the challenges of maintaining data privacy and security are considerable.

I expect that PA signed all the necessary confidentiality agreements, security policies, data management policies, etc, when agreeing the contract with the Home Office. I expect that they also provided the necessary assurances to the client when negotiating the work. And I expect that the client took assurance from all of this. And yet, despite that, a significant breach of confidentiality and data security occurred, exposing both the contractor and the Home Office to being sued.  So, if policies and procedures, signed declaration and undertakings aren’t adequate protections, what can a client do when engaging third parties, or, indeed, protecting data from disclosure by staff?

Insist on encryption

Naturally, following incidents like the Home Office one, there is a strong focus on the need to encrypt data held on computer disks. However, this does not often lead to action. It is really not that hard to encrypt information at the entire device level, i.e. at disk level, at folder level, or at file level. There are many open source encryption systems available, such as TrueCrypt and Cryptainer. Commercial products are available from PGP Corporation, Symantec, McAfee and others. Even the ubiquitous WinZip allows users to encrypt files.

If users could get into the habit of encrypting all removable media and laptops immediately on acquisition, this would make a significant difference to data security. At a corporate level, all purchased devices should include provision for encryption at the point of purchase.

Ban data exchange and removal

A more extreme approach might be to ban all electronic data exchange between a client and a contractor or supplier, including banning the use of email, laptops, modems, wireless connections, etc.  In this scenario, all work would be carried out on the client’s site, with all computer equipment, network facilities, storage, printers, paper, etc, provided by the client. Even this would be difficult to police, however, as a contractor could easily bring in a portable storage device and connect it to the client’s computer. This might be avoided by providing equipment with all external ports and wireless features disabled, but the difficulty of doing this should be evident. However, in today’s connected world, where business happens at the speed of light, this option would not be really practical.

Ban use of own data processing equipment by contractors

Many, many years ago, a friend of mine worked in the vaults of a very large bank in Ireland. Before starting every day, he had to remove all valuables and money from his person and leave them in secure custody with the bank. At the end of the day he was searched and, when confirmed as penniless as when he went in, his valuables were returned to him and he was escorted off the premises. This happened every day he worked there.  Similar procedures could be implemented with regard to contractors and computing equipment, ensuring that they did not have any data processing or storage equipment in their possession when they entered or left the client’s premises. But, once again, the difficulty of policing this is quite apparent. With contractors working in almost every area of large businesses and the public sector, it would be difficult to get uniform implementation (or, indeed, awareness) of security policies. Nevertheless, it might be necessary to consider measures like these to adequately protect sensitive data.

Control issue and use of portable storage devices and laptops

This would not be easy to do but, coupled with other controls, would be an effective way of ensuring that data is not removed from a client premises. Tight procurement procedures would be required but, as portable devices are now so cheap, individuals can simply buy them themselves. Therefore, it may also be necessary to lock down external ports on machines but, understandably, this would make effective working quite difficult.

Control or prevent access to Internet storage sites

Many companies now offer free or cheap storage over the Internet, which anyone can subscribe to. These enable users to back files up to these sites on demand, or on a schedule.  Similarly, Gmail and Hotmail accounts enable users to store up to 5Gb of data on the Intenet. Therefore, these sites create a new weakness in corporate networks and, where possible, access to them should be denied.

Prevent use of Internet-based email accounts such as Gmail, Hotmail and Yahoo!

Difficult to do, but, if possible, prevent use of free Internet-based mail accounts like Gmail, Hotmail and Yahoo! Do not provide contractors with access to or accounts on your email service so that they cannot mail files to their own work email accounts.

Identify someone in the client organisation responsible for data security and handling contractor requests

Contractors might have a legitimate reason for requiring data to be provided on portable devices; for example, to carry out testing on an application at their own premises. A single person in the client organisation should be responsible for providing such data and ensuring that the request is appropriate, that only data that is absolutely necessary is provided and that it is properly secured. Appropriate undertakings (however shaky) should be received from the contractor, including undertakings concerning the storage, security and encryption of data.

Get contractors to disclose any previous breaches of data security that affected them or their clients

As part of the due diligence process in any contract negotiation, clients should ask contractors to disclose any breaches of data security that affected them or their clients in the last number of years, say three years. Contractors could be held liable for failure to disclose any breaches. If a contractor has suffered breaches of security, perhaps it would be better to avoid using them, particularly on very sensitive contracts.

Make sure your contractor has adequate insurance cover

Make sure that your contractor has adequate professional indemnity insurance and that you are indemnified against any loss or damages arising out of negligence or omission by the contractor.  This should not only extend to the professional execution of the contracted work but also to such eventualities as data loss or security breach, as in the PA case.

Learn about information security standards

The information security landscape is changing and becoming more complex all the time.  The key international standard is ISO 27000 and, if you are concerned with security and data privacy, you should become familiar with this standard.  Also pay attention to sites like the SANS Institute, CoBIT, ISACA, etc.

Conclusion

There’s a lot more to information security and data privacy than I have covered here. As more and more of our personal and corporate information is transmitted over the Internet, we should all pay far more attention to this issue.

If you liked this post, you might also like:

Laptop Theft and Data Loss By Irish Health Service Executive

More Laptops Stolen – And This Time It’s Personal!

Receive new articles from johnlawlor.ie by subscribing to my RSS Feed or by email subscription. You can also share this post by using one or more of the buttons at the top and bottom of the post. Thanks for visiting!