Blog: Pete Loshin

Main

June 29, 2007

How NOT to Protect Sensitive Data

If you work as a bank teller, I'm pretty sure you can't take your cash drawer home to count out your currency. Likewise, I don't think jewelers allow their employees to take precious metals or stones home and pharmacists probably don't have the option of taking drugs home to fill prescriptions.

Most companies whose employees handle valuable commodities have strict security protocols intended to prevent losses due to carelessness as well as outright theft.

Except the IT industry, apparently.

It seems to be perfectly OK for employees--and contractors, consultants and various other third-party non-employees--to walk out the door with corporate databases loaded onto laptops or portable hard drives, with predictable results when those laptops or hard drives are lost/stolen.

When laptops with sensitive data get lost and/or stolen, it doesn't matter how conscientiously you've protected your personal information from identity thieves. You are at risk because someone who should have known better acted irresponsibly. Maybe it was a human resource clerk at your current employer--or maybe at a company you haven't worked for since the Reagn administration.

Maybe it was someone at a hospital where you received emergency medical treatment, or the insurance company that paid your claim, or your university. Or someone who works for a government agency.

Whoever did it may never be held accountable. And you may not even hear about it until you get a letter informing you that your data may have been compromised and you can sign up for a free credit monitoring service, sponsored by the company or organization that lost your data in the first place.

To get an idea of the scope of the problem, check out numbrX Security Beat, "an online record of reported personal, private and confidential data breaches which can lead to identity theft and credit fraud."

And remember, the breaches you read about on numbrX are probably only the tip of the iceberg: these are only the breaches that have been reported publicly.

Posted by at 8:00 AM | Permalink | Comments (0)