Opinion: Current levels of identity theft are inexcusable

Powered by SC Magazine
 

Any IT chief worth their salt knows how to combat data theft, so why is it still so common, asks Ian Schenkel.

With all the noise about the PCI DSS payment card security standard and the importance of protecting data, you might think the situation is under control or at least being addressed seriously.

But potentially hundreds of thousands of records containing personally identifiable information (PII) are still at risk, stored unencrypted and unprotected in databases not subject to PCI DSS compliance. HR databases are a perfect example.

It is ridiculous that PII is being exposed time after time. We know how to solve this problem ­ education combined with good data protection policies and processes.

One of the positive steps a company can take is to institute security awareness training. Ensure that everyone understands how to identify confidential information, the importance of protecting data, how to choose and use passwords, acceptable use of system resources, email, and the firm’s security policies and procedures. Enforce policies with role-based access and auditing.

Security policies should evolve with the times. Consider instituting a weekly meeting with senior managers to talk about data security and regulatory concerns. Look at the data security tools firms use, what threats are out there, and consider what policies the company may need to enact to deal with these issues. Risk analysis should be performed to determine which assets need the most stringent security. And employees’ PII data should be included in security policies.

Data security regulations tend to deal with specific issues rather than addressing the entire network and applications. A system can pass a regulatory audit and still harbour security problems. Work towards comprehensive security rather than simple compliance with regulations.

Data storage guidelines are vague at best and often overlooked or ignored. Data security regulations need to be tightened and strictly enforced if we have any hope of stamping out identity theft.

Ian Schenkel is a BCS contributor, and vice president at Protegrity.

Copyright © 2010 Computing


Opinion: Current levels of identity theft are inexcusable
 
 
 
Top Stories
NBN to offer TV connections through fibre for greenfields
Ditching aerials to come at a cost.
 
Tech SWAT teams kicking down the digital door
From dam engineers in Ecuador to Sydney light-rail gurus, Cardno's global CIO Karen Wagner is linking up her widespread organisation.
 
AusPost board approves Fujitsu outsourcing
End user computing to be handed over to partner.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Is site blocking effective in stopping piracy?


   |   View results
Yes
  2%
 
No
  85%
 
Somewhat
  13%
TOTAL VOTES: 661

Vote