Opinion: Current levels of identity theft are inexcusable

Powered by SC Magazine

Any IT chief worth their salt knows how to combat data theft, so why is it still so common, asks Ian Schenkel.

With all the noise about the PCI DSS payment card security standard and the importance of protecting data, you might think the situation is under control or at least being addressed seriously.

But potentially hundreds of thousands of records containing personally identifiable information (PII) are still at risk, stored unencrypted and unprotected in databases not subject to PCI DSS compliance. HR databases are a perfect example.

It is ridiculous that PII is being exposed time after time. We know how to solve this problem ­ education combined with good data protection policies and processes.

One of the positive steps a company can take is to institute security awareness training. Ensure that everyone understands how to identify confidential information, the importance of protecting data, how to choose and use passwords, acceptable use of system resources, email, and the firm’s security policies and procedures. Enforce policies with role-based access and auditing.

Security policies should evolve with the times. Consider instituting a weekly meeting with senior managers to talk about data security and regulatory concerns. Look at the data security tools firms use, what threats are out there, and consider what policies the company may need to enact to deal with these issues. Risk analysis should be performed to determine which assets need the most stringent security. And employees’ PII data should be included in security policies.

Data security regulations tend to deal with specific issues rather than addressing the entire network and applications. A system can pass a regulatory audit and still harbour security problems. Work towards comprehensive security rather than simple compliance with regulations.

Data storage guidelines are vague at best and often overlooked or ignored. Data security regulations need to be tightened and strictly enforced if we have any hope of stamping out identity theft.

Ian Schenkel is a BCS contributor, and vice president at Protegrity.

Copyright © 2010 Computing

Opinion: Current levels of identity theft are inexcusable
Top Stories
Inside the stalemate on Australia's piracy code
Still not registered almost five months on.
IT staff outline deep anger in Macquarie Uni survey
‘Morale at lowest point in a decade’.
Cost blowout to push NBN past $41bn budget
But government funding cap to remain.
Sign up to receive iTnews email bulletins
Latest Comments
New Windows 10 users, are you upgrading from...

   |   View results
Windows 8
Windows 7
Windows XP
Another operating system
Windows Vista