details, and numerous other data points. Enough information is often collected that even 2

Size: px
Start display at page:

Download "details, and numerous other data points. Enough information is often collected that even 2"

Transcription

1 Big Data Study Office of Science and Technology Policy Eisenhower Executive Office Building 650 Pennsylvania Avenue, NW Washington, D.C. 050 VIA E MAIL March, 04 Re: Big Data Study, Document Number Dear Ms. Wong, Thank you for the opportunity to provide public comment in response to your comprehensive review of big data and its implications for privacy, the economy, and public policy. Access (https://www.accessnow.org) is a global organization dedicated to defending and extending the digital rights of users at risk around the world. Access works through its Policy, Technology, and Advocacy teams to achieve this mission. Access provides thought leadership and policy recommendations to the public and private sectors to ensure the internet s continued openness and universality and wields an action focused global community of nearly half a million users from more than 85 countries. Access also operates a 4/7 digital security helpline that provides real time direct technical assistance to users around the world. I. The Challenges of "Big Data" The growth in large scale collection, retention, transfer, and analysis of personal data places everyone s privacy at risk. All types of organizations consumer facing companies, third party data brokers, government agencies, and others develop comprehensive profiles at times containing identifying information, such as names, addresses, and phone numbers, as well as buying habits, personal interests, ethnic identities, political affiliations, marital status, credit card details, and numerous other data points. Enough information is often collected that even anonymous information can be re identified easily. In one high profile case, reporters were able to identify several anonymous users based solely on their AOL search history, which had been publicly released. Information in one user's records provided detailed information on her medical history and love life. There has been an exponential increase in the amount of data collected and stored by private companies in recent years. Facebook announced in 0 that its data center had grown 500x big data does and doesnt know about me professor re identifies anonymous volunteers indna study/

2 4 since 008. By 0, Facebook was collecting about 80 petabytes of data per year. For reference, one petabyte is the equivalent of 0 million 4 drawer filing cabinets filled with text. Retailers, whether focused at online markets or off, also track customers. It is estimated that in one hour Wal Mart processes about million customer transactions containing.5 petabytes of data. "Free services offered by companies are often possible because these practices are part of a business model that relies on interpreting high quality data about their users in order to serve revenue generating targeted advertising. And over the years, many of these same internet companies have simplified their privacy policies by eliminating granular user controls while increasing the capacity to track each and every online action. 5 Data collection practices have been connected to specific practices that negatively impact internet users. For example, in 0, it was discovered that some online travel booking companies, including Orbitz Worldwide Inc., were charging customers using Apple products 6 close to 0% more for flights and hotels than visitors using Windows. Such digital market 7 manipulation leads to economic and privacy harms. A recent breach of Target s systems is 8 estimated to have affected up to one third of all Americans. Ensuring that citizens have adequate knowledge and control over their data would greatly reduce the privacy and other human rights risks associated with big data. Currently, comprehensive standandards apply to medical and financial data, but not other types of sensitive information. It is not only private entities where data collection has skyrocketed. Recent revelations have shown that US government intelligence agencies have been implementing programs to collect personal information and communications of users around the world at unprecedented levels. Some of these programs are implemented through legal processes, which compel companies to produce user information that the companies have otherwise collected for their own purposes. These collection programs are overseen by the secret FISA Court, which issues orders requiring production while preventing companies from publicly revealing that the collection has occurred. Under other programs, often authorized under Section 70 of the FISA Amendments Act and Executive Order, the US is tapping fiber optic cables directly (BLARNEY, OAKSTAR, 4 https://www.facebook.com/notes/facebook engineering/under the hood scheduling mapreduce jobs more effi ciently with corona/ privacy/ 6 wsj&ur l=http%a%f%fonline.wsj.com%farticle%fsb html breach affected 70 million customers.html

3 9 STORMBREW, FAIRVIEW), breaking into the private links between corporate data centers 0 (e.g., MUSCULAR), or collecting the content of a whole country s phone calls (e.g., MYSTIC/RETRO). Given the preponderance of attacks on the US Government, these mass surveillance places a tremendous amount of users and user data at risk. II. The Problem of Unauthorized Access Once collected, bad data security practices have led to the unauthorized access to and use of personal information, compromising users around the world. Data breaches are increasing in frequency. Last year saw the highest total records breached, according to a report by Risk Based Security. In one incident, attackers obtained records with addresses and passwords from around 5 million Adobe accounts. In another breach, approximately 0 4 million Target accounts, about a third of the US, were affected by a data breach. While the Adobe and Target breaches are two of the largest known breaches to date, data continues to be compromised with such great frequency that these incidents account for only a small portion of the total data that is known to have been exposed in 0. Indeed, last year there were,64 incidents of data breaches with 8 millions records exposed reported worldwide. Attacks against US entities accounted for nearly half of all breaches globally. 5 Unauthorized access to user data is not a new problem. For the past years, identity theft has 6 been the biggest source of complaints to the Federal Trade Commission, which underlines that the identity and finances of citizens are consistently at risk due to needless collection practices and insufficient security practices employed by companies online. The economic impact of data breaches, and the accompanying reputational and legal fallout, is undoubtedly huge. Target spent $6 million in breach related costs in the first three months after the breach, which experts 7 estimate may grow to as high as $ billion. Target s data breach is expected to be so 8 expensive, in part, because it revealed data placing credit at risk. That might be good for credit monitoring agencies, but it can create everyday challenges for victims when they try to get a mortgage, get a credit card, or buy a car. Data breaches are also particularly expensive in the US for the companies who lost or had records stolen. In 0, companies paid on average $88 per lost or stolen record. That equated to about $5.4 million in loss for each entity with a data 9 nsa slide you havent seen/0/07/0/8046 e8 e6 e aa9f c0a7ed4_story.html 0 https://www.accessnow.org/blog/0//0/nsa hacks internet company data centers https://www.accessnow.org/blog/04/0/0/nsa bulk collection is out of control https://www.riskbasedsecurity.com/reports/0 DataBreachQuickView.pdf adobe cyberattack idusbre9a6d breach affected 70 million customers.html 5 https://www.riskbasedsecurity.com/reports/0 DataBreachQuickView.pdf 6 events/press releases/0/0/ftc releases top complaint categories 0 7 target results idusbreap0wc target data theft victims become a credit agencygoldmine

4 breach. 9 Governments also take advantage of insecure data. While the surveillance programs discussed above often operate under a system of compelled production, others skip official channels and, instead, use back doors. One such program is the "Upstream" programs alluded to in slides released in June 0, and later confirmed by government officials. Upstream collection takes data right off the "backbone" of the internet the wires over which information is transmitted from computer to computer. Further revelations have brought to light backbone collection by US 0 and other governments of remotely activated webcam feeds, e mail contact lists, and information on internal company networks. It has also been revealed that the government has acted to preserve these collection programs by undermining data security standards. Unauthorized access or use of information by governments, as well as private actors, fundamentally threatens the internet as we know it. The world s largest internet companies build their business models around user trust in the networks that transmit and entities that store their personal data. Google s public Chief Legal Officer David Drummond, has said, Our business depends on the trust of our customers." More acutely at risk, U.S. based cloud computing firms spoke out after losing business following last summer s NSA revelations, and fear losing up to $5 billion in worldwide contracts as European regulators look to tighten restrictions on the cloud. Trust is also eroded when the NSA shares data with government agencies not dealing with foreign intelligence. For example, the NSA has provided evidence to the DEA, which then uses parallel construction, whereby agents find alternative grounds to justify arrests and skirt 4 legal challenges. Rule of law is threatened when legal limitations fail to protect even the narrow existing privacy protections. III. The Role of Data Security As data are transferred from entity to entity, they become increasingly vulnerable, with more points at which unauthorized parties may be able to gain access to those data and use them for unintended purposes. Bad actors may compromise the financial or physical safety of users, and governments could use personal information to target dissidents, stifle speech, or influence 9 https://www4.symantec.com/mktginfo/whitepaper/050_gl_na_wp_ponemon 0 Cost of a Data Brea ch Report_daiNA_cta78.pdf 0 us spies hacked webcams millions yahoo users/ security/nsa collects millions of e mail address books globall y/0/0/4/8e58b5be 4f9 e 80c6 7e6dd8dd8f_story.html security/nsa infiltrates links to yahoo google data centers wo rldwide snowden documents say/0/0/0/e5d66e 466 e 8b74 d89d74ca4dd_story.html backdoored and stole keys/ 4 switch/wp/0/08/05/the nsa is giving your phone records to thedea and the dea is covering it up/ 4

5 political outcomes. Access has attempted to move the global conversation on security of big data forward. In March 5 04, Access released the Data Security Action Plan. In creating the Data Security Action Plan, Access considered what common sense practices were needed to mitigate the extreme risk posed by the increasing amounts of data stored online. The Action Plan consists of seven steps that companies should take to protect their users. The seven steps are:. Implement strict encryption measures on all network traffic;. Executive verifiable practices to effectively store user data stored at rest;. Maintain the security of credentials and provide robust authentication safeguards; 4. Promptly address known, exploitable vulnerabilities; 5. Use algorithms that follow security best practices; 6. Enable or support the use of client to client encryption; and 7. Provide user education tools on the importance of digital security hygiene. All entities should support the implementation of these security measures on all relevant data and networks under their control. Widespread adoption would benefit all internet users around the world, and would raise the floor on minimally acceptable data security practices. If we fail to consider data security in the debate on big data public policy, we are standardizing unacceptable risks for users, companies, and the public at large. IV. Conclusion To mitigate the harms of data breach and misuse and to build user trust, the White House should consider what steps are necessary to protect user data. Companies should take proactive steps to protect user data. Specifically, this means adopting privacy centered approaches to the collection and processing of user data, including: data minimization to limit collection of data where possible; ensuring that data is collected and stored for strictly defined purposes, and not used in a way that is incompatible with those purposes; and applying appropriate security measures to data both in transit and at rest. Accordingly, Access calls on the government to bolster data protection standards, promote data security, and continue to foster a robust discussion on best practices. Thank you for the opportunity to provide comment as part of this Big Data Study. For more information, please visit https://www.accessnow.org or contact the authors of this comment, Amie Stepanovich and Drew Mitnick, at and respectively. 5 More information is available at https://encryptallthethings.net 5

Government Surveillance, Hacking, and Network Security: What Can and Should Carriers Do? Kent Bressie PITA AGM, Tonga April 2015

Government Surveillance, Hacking, and Network Security: What Can and Should Carriers Do? Kent Bressie PITA AGM, Tonga April 2015 Government Surveillance, Hacking, and Network Security: What Can and Should Carriers Do? Kent Bressie PITA AGM, Tonga April 2015 1 Network and cybersecurity vs. access Fundamental tension exists between:

More information

SEC update: Cybersecurity initiatives. SEC update: Cybersecurity initiatives. Intelligize // 02

SEC update: Cybersecurity initiatives. SEC update: Cybersecurity initiatives. Intelligize // 02 Intelligize // 02 As is tradition, at the beginning of the year, the U.S. Securities and Exchange Commission outlined both its current state of affairs and annual goals for maintaining proper compliance

More information

Privacy and data protection in a post-snowden world. Carly Nyst Head of International Advocacy

Privacy and data protection in a post-snowden world. Carly Nyst Head of International Advocacy Privacy and data protection in a post-snowden world Carly Nyst Head of International Advocacy The great irony is that we re the only ones not spying on the American people. - Keith Alexander, head of the

More information

Reducing Cyber Risk in Your Organization

Reducing Cyber Risk in Your Organization Reducing Cyber Risk in Your Organization White Paper 2016 The First Step to Reducing Cyber Risk Understanding Your Cyber Assets With nearly 80,000 cyber security incidents worldwide in 2014 and more than

More information

National Security Agency

National Security Agency National Security Agency 9 August 2013 The National Security Agency: Missions, Authorities, Oversight and Partnerships That s why, in the years to come, we will have to keep working hard to strike the

More information

INFORMATION SECURITY GUIDE. Cloud Computing Outsourcing. Information Security Unit. Information Technology Services (ITS) July 2013

INFORMATION SECURITY GUIDE. Cloud Computing Outsourcing. Information Security Unit. Information Technology Services (ITS) July 2013 INFORMATION SECURITY GUIDE Cloud Computing Outsourcing Information Security Unit Information Technology Services (ITS) July 2013 CONTENTS 1. Background...2 2. Legislative and Policy Requirements...3 3.

More information

Proactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation. By Marc Ostryniec, vice president, CSID

Proactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation. By Marc Ostryniec, vice president, CSID Proactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation By Marc Ostryniec, vice president, CSID The increase in volume, severity, publicity and fallout of recent data breaches

More information

Franchise Data Compromise Trends and Cardholder. December, 2010

Franchise Data Compromise Trends and Cardholder. December, 2010 Franchise Data Compromise Trends and Cardholder Security Best Practices December, 2010 Franchise Data Security Agenda Cardholder Data Compromise Overview Breach Commonalities Hacking Techniques Franchisee

More information

Advanced Biometric Technology

Advanced Biometric Technology INC Internet Biometric Security Systems Internet Biometric Security System,Inc.White Papers Advanced Biometric Technology THE SIMPLE SOLUTION FOR IMPROVING ONLINE SECURITY Biometric Superiority Over Traditional

More information

NSA Surveillance, National Security and Privacy

NSA Surveillance, National Security and Privacy NSA Surveillance, National Security and Privacy Ir Roy Ko Former HKCERT Manager 20 August 2014 HKIE Veneree Club 1 Agenda Background Edward Snowden National Security Agency (NSA) What NSA has done PRISM

More information

Just Net Coalition statement on Internet governance

Just Net Coalition statement on Internet governance Just Net Coalition statement on Internet governance (Just Net Coalition is a global coalition of civil society actors working on Internet governance issues) All states should work together to provide a

More information

WRITTEN TESTIMONY OF

WRITTEN TESTIMONY OF WRITTEN TESTIMONY OF KEVIN MANDIA CHIEF EXECUTIVE OFFICER MANDIANT CORPORATION BEFORE THE SUBCOMMITTEE ON CRIME AND TERRORISM JUDICIARY COMMITTEE UNITED STATES SENATE May 8, 2013 Introduction Thank you

More information

Cyber security Time for a new paradigm. Stéphane Hurtaud Partner Information & Technology Risk Deloitte

Cyber security Time for a new paradigm. Stéphane Hurtaud Partner Information & Technology Risk Deloitte Cyber security Time for a new paradigm Stéphane Hurtaud Partner Information & Technology Risk Deloitte 90 More than ever, cyberspace is a land of opportunity but also a dangerous world. As public and private

More information

The Kennedy Privacy Law Firm

The Kennedy Privacy Law Firm The Kennedy Privacy Law Firm 1050 30th Street, NW Washington, DC 20007 www.kennedyonprivacy.com Charles H. Kennedy (202) 250-3704 (202) 450-0708 ckennedy@kennedyonprivacy.com Via ECFS May 22, 2015 Ms.

More information

REGULATIONS FOR THE SECURITY OF INTERNET BANKING

REGULATIONS FOR THE SECURITY OF INTERNET BANKING REGULATIONS FOR THE SECURITY OF INTERNET BANKING PAYMENT SYSTEMS DEPARTMENT STATE BANK OF PAKISTAN Table of Contents PREFACE... 3 DEFINITIONS... 4 1. SCOPE OF THE REGULATIONS... 6 2. INTERNET BANKING SECURITY

More information

PRIVACY POLICY. Last updated February 2, 2009 INTRODUCTION

PRIVACY POLICY. Last updated February 2, 2009 INTRODUCTION PRIVACY POLICY Last updated February 2, 2009 INTRODUCTION This Privacy Policy explains how personal information about you may be collected, used, or disclosed by the Canadian Education and Research Institute

More information

Myths and Facts about the Cyber Intelligence Sharing and Protection Act (CISPA)

Myths and Facts about the Cyber Intelligence Sharing and Protection Act (CISPA) Myths and Facts about the Cyber Intelligence Sharing and Protection Act (CISPA) MYTH: The cyber threat is being exaggerated. FACT: Cyber attacks are a huge threat to American lives, national security,

More information

Overview of the HIPAA Security Rule

Overview of the HIPAA Security Rule Office of the Secretary Office for Civil Rights () Overview of the HIPAA Security Rule Office for Civil Rights Region IX Alicia Cornish, EOS Sheila Fischer, Supervisory EOS Topics Upon completion of this

More information

NATIONAL CYBER SECURITY AWARENESS MONTH

NATIONAL CYBER SECURITY AWARENESS MONTH NATIONAL CYBER SECURITY AWARENESS MONTH Tip 1: Security is everyone s responsibility. Develop an awareness framework that challenges, educates and empowers your customers and employees to be part of the

More information

Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence. AIBA Quarterly Meeting September 10, 2015

Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence. AIBA Quarterly Meeting September 10, 2015 Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence AIBA Quarterly Meeting September 10, 2015 The Answer 2 Everyone The relationship between the board, C-suite, IT, and compliance leaders

More information

Privacy and Data Collection in the Transportation Industry

Privacy and Data Collection in the Transportation Industry in the Transportation Industry May 1, 2014 Introduction The transportation industry has faced challenges regarding privacy and data collection. Privacy advocates, privacy-conscious individuals and others

More information

Privacy 101 Awareness and Best Practices

Privacy 101 Awareness and Best Practices Privacy 101 Awareness and Best Practices GPO Protection of Personally Identifiable Information (PII) National Institute Of Standards & Technology What is Privacy It is more than information security Privacy

More information

Statement for the Record. Richard Bejtlich. Chief Security Strategist. FireEye, Inc. Before the. U.S. House of Representatives

Statement for the Record. Richard Bejtlich. Chief Security Strategist. FireEye, Inc. Before the. U.S. House of Representatives Statement for the Record Richard Bejtlich Chief Security Strategist FireEye, Inc. Before the U.S. House of Representatives Committee on Energy and Commerce Subcommittee on Oversight and Investigations

More information

Big Data Big Security Problems? Ivan Damgård, Aarhus University

Big Data Big Security Problems? Ivan Damgård, Aarhus University Big Data Big Security Problems? Ivan Damgård, Aarhus University Content A survey of some security and privacy issues related to big data. Will organize according to who is collecting/storing data! Intelligence

More information

Nine Steps to Smart Security for Small Businesses

Nine Steps to Smart Security for Small Businesses Nine Steps to Smart Security for Small Businesses by David Lacey Co-Founder, Jericho Forum Courtesy of TABLE OF CONTENTS INTRODUCTION... 1 WHY SHOULD I BOTHER?... 1 AREN T FIREWALLS AND ANTI-VIRUS ENOUGH?...

More information

Intelligent Security Design, Development and Acquisition

Intelligent Security Design, Development and Acquisition PAGE 1 Intelligent Security Design, Development and Acquisition Presented by Kashif Dhatwani Security Practice Director BIAS Corporation Agenda PAGE 2 Introduction Security Challenges Securing the New

More information

Mobile Application Security. Helping Organizations Develop a Secure and Effective Mobile Application Security Program

Mobile Application Security. Helping Organizations Develop a Secure and Effective Mobile Application Security Program Mobile Application Security Helping Organizations Develop a Secure and Effective Mobile Application Security Program by James Fox fox_james@bah.com Shahzad Zafar zafar_shahzad@bah.com Mobile applications

More information

DETECT MONITORING SERVICES MITIGATING THE EPSILON EMAIL BREACH SUMMARY

DETECT MONITORING SERVICES MITIGATING THE EPSILON EMAIL BREACH SUMMARY DETECT MONITORING SERVICES MITIGATING THE EPSILON EMAIL BREACH SUMMARY The April 1st statement released by the marketing firm Epsilon has turned out to be no April Fools Day joke. Sophisticated and targeted

More information

SECURITY CONSIDERATIONS FOR LAW FIRMS

SECURITY CONSIDERATIONS FOR LAW FIRMS SECURITY CONSIDERATIONS FOR LAW FIRMS Enterprise Risk Management Professional consulting firm that specializes in cyber security Founded in 1998 in Miami, Florida Serves more than 150 clients, locally,

More information

The Impact of Wireless LAN Technology on Compliance to the PCI Data Security Standard

The Impact of Wireless LAN Technology on Compliance to the PCI Data Security Standard The Impact of Wireless LAN Technology on to the PCI Data Security Standard 339 N. Bernardo Avenue, Suite 200 Mountain View, CA 94043 www.airtightnetworks.net Wireless LANs and PCI Retailers today use computers

More information

Transforming the Customer Experience When Fraud Attacks

Transforming the Customer Experience When Fraud Attacks Transforming the Customer Experience When Fraud Attacks About the Presenters Mike Young, VP, Product Team, Everbank Manages consumers and business banking products, as well as online and mobile banking

More information

Security Breach: 10 Industries Impacted

Security Breach: 10 Industries Impacted WWW.IBISWORLD.COM April 2013 1 April 2013 Security Breach: 10 Industries Impacted By David Yang Digital information and web-based business are driving demand for increased cyber security. IBISWorld identifies

More information

How to Justify Your Security Assessment Budget

How to Justify Your Security Assessment Budget 2BWhite Paper How to Justify Your Security Assessment Budget Building a Business Case For Penetration Testing WHITE PAPER Introduction Penetration testing has been established as a standard security practice

More information

Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst

Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst ESG Brief Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: APTs first came on the scene in 2010, creating a wave

More information

Justin Brookman and G.S. Hans *

Justin Brookman and G.S. Hans * WHY COLLECTION MATTERS SURVEILLANCE AS A DE FACTO PRIVACY HARM Justin Brookman and G.S. Hans * Consumer privacy remains one of the most pressing issues in technology policy. The interactions between individuals

More information

KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com

KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global

More information

Profound Outdoors Privacy Policy

Profound Outdoors Privacy Policy Profound Outdoors Privacy Policy Our Commitment to Privacy Our Privacy Policy has been developed as an extension of our commitment to combine quality products and services with integrity in dealing with

More information

Reducing Risk. Raising Expectations. CyberRisk and Professional Liability

Reducing Risk. Raising Expectations. CyberRisk and Professional Liability Reducing Risk. Raising Expectations. CyberRisk and Professional Liability Are you exposed to CyberRisk? Like nearly every other business, you have likely capitalized on the advancements in technology today

More information

Opinion and recommendations on challenges raised by biometric developments

Opinion and recommendations on challenges raised by biometric developments Opinion and recommendations on challenges raised by biometric developments Position paper for the Science and Technology Committee (House of Commons) Participation to the inquiry on Current and future

More information

Doyourwebsitebot defensesaddressthe changingthreat landscape?

Doyourwebsitebot defensesaddressthe changingthreat landscape? WHITEPAPER Doyourwebsitebot defensesaddressthe changingthreat landscape? Don tletbotsturnaminorincident intoamegasecuritybreach 1.866.423.0606 Executive Summary The website security threat landscape has

More information

Your Agency Just Had a Privacy Breach Now What?

Your Agency Just Had a Privacy Breach Now What? 1 Your Agency Just Had a Privacy Breach Now What? Kathleen Claffie U.S. Customs and Border Protection What is a Breach The loss of control, compromise, unauthorized disclosure, unauthorized acquisition,

More information

As the US debates email privacy a Berlin start up surges with...

As the US debates email privacy a Berlin start up surges with... TOP STORIES / SCI-TECH DATA PROTECTION As the US debates email privacy a Berlin start up surges with 'anonymous post' No matter how much we say we're angry about the NSA scandal, we still use all the services

More information

Presented by Evan Sylvester, CISSP

Presented by Evan Sylvester, CISSP Presented by Evan Sylvester, CISSP Who Am I? Evan Sylvester FAST Information Security Officer MBA, Texas State University BBA in Management Information Systems at the University of Texas Certified Information

More information

Is Your Company Ready for a Big Data Breach? Sponsored by Experian Data Breach Resolution

Is Your Company Ready for a Big Data Breach? Sponsored by Experian Data Breach Resolution Is Your Company Ready for a Big Data Breach? Sponsored by Experian Data Breach Resolution Independently conducted by Ponemon Institute LLC Publication Date: April 2013 Ponemon Institute Research Report

More information

Information Security Incident Management Guidelines

Information Security Incident Management Guidelines Information Security Incident Management Guidelines INFORMATION TECHNOLOGY SECURITY SERVICES http://safecomputing.umich.edu Version #1.0, June 21, 2006 Copyright 2006 by The Regents of The University of

More information

10 Quick Tips to Mobile Security

10 Quick Tips to Mobile Security 10 Quick Tips to Mobile Security 10 Quick Tips to Mobile Security contents 03 Introduction 05 Mobile Threats and Consequences 06 Important Mobile Statistics 07 Top 10 Mobile Safety Tips 19 Resources 22

More information

White Paper on Financial Industry Regulatory Climate

White Paper on Financial Industry Regulatory Climate White Paper on Financial Industry Regulatory Climate According to a 2014 report on threats to the financial services sector, 45% of financial services organizations polled had suffered economic crime during

More information

Security Awareness Fourth Edition. Chapter 1 Introduction to Security

Security Awareness Fourth Edition. Chapter 1 Introduction to Security Security Awareness Fourth Edition Chapter 1 Introduction to Security Objectives After completing this chapter, you should be able to do the following: Describe the challenges of securing information Define

More information

M&T BANK CANADIAN PRIVACY POLICY

M&T BANK CANADIAN PRIVACY POLICY M&T BANK CANADIAN PRIVACY POLICY At M&T Bank, we are committed to safeguarding your personal information and maintaining your privacy. This has always been a priority for us and this is why M&T Bank (

More information

OCIE Technology Controls Program

OCIE Technology Controls Program OCIE Technology Controls Program Cybersecurity Update Chris Hetner Cybersecurity Lead, OCIE/TCP 212-336-5546 Introduction (Role, Disclaimer, Background and Speech Topics) SEC Cybersecurity Program Overview

More information

Email Data Security. The dominant business communication tool

Email Data Security. The dominant business communication tool Email Data Security Jim Brashear General Counsel Zix Corporation Dallas Business Uses Email The dominant business communication tool Time spent on email exceeds time spent on all other communication tools

More information

Impact of Data Breaches

Impact of Data Breaches Research Note Impact of Data Breaches By: Divya Yadav Copyright 2014, ASA Institute for Risk & Innovation Applicable Sectors: IT, Retail Keywords: Hacking, Cyber security, Data breach, Malware Abstract:

More information

Middle Class Economics: Cybersecurity Updated August 7, 2015

Middle Class Economics: Cybersecurity Updated August 7, 2015 Middle Class Economics: Cybersecurity Updated August 7, 2015 The President's 2016 Budget is designed to bring middle class economics into the 21st Century. This Budget shows what we can do if we invest

More information

Cloud Computing Concept, Technology & Architecture

Cloud Computing Concept, Technology & Architecture Cloud Computing Concept, Technology & Architecture Chapter 06 Fundamental Cloud Security 課程名稱 : 雲端管理系統 授課教師 : 高勝助 Contents Security topics and concepts relevant and distinct to cloud computing are introduced,

More information

A BUSINESS CASE FOR BEHAVIORAL ANALYTICS. White Paper

A BUSINESS CASE FOR BEHAVIORAL ANALYTICS. White Paper A BUSINESS CASE FOR BEHAVIORAL ANALYTICS White Paper Introduction What is Behavioral 1 In a world in which web applications and websites are becoming ever more diverse and complicated, running them effectively

More information

FINAL // FOR OFFICIAL USE ONLY. William Noonan

FINAL // FOR OFFICIAL USE ONLY. William Noonan FINAL // FOR OFFICIAL USE ONLY William Noonan Deputy Special Agent in Charge United States Secret Service Criminal Investigative Division Cyber Operations Branch Prepared Testimony Before the United States

More information

Assessing the strength of your security operating model

Assessing the strength of your security operating model www.pwc.com Assessing the strength of your security operating model May 2014 Assessing the strength of your security operating model Retail stores, software companies, the U.S. Federal Reserve it seems

More information

A Proposal of Employee Benefits. Innovations in IDENTITY THEFT

A Proposal of Employee Benefits. Innovations in IDENTITY THEFT A of Employee Benefits Innovations in IDENTITY THEFT Innovations in IDENTITY THEFT Name or Logo 2 Innovations in IDENTITY THEFT A Complete Identity Theft Solution Prevention to Prosecution Solution

More information

Healthcare Cybersecurity Perspectives from the Michigan Healthcare Cybersecurity Council

Healthcare Cybersecurity Perspectives from the Michigan Healthcare Cybersecurity Council Healthcare Cybersecurity Perspectives from the Michigan Healthcare Cybersecurity Council Presented by Doug Copley, Chairman Michigan Healthcare Cybersecurity Council Mr. Chairman and Committee Members,

More information

Chapter 6: Fundamental Cloud Security

Chapter 6: Fundamental Cloud Security Chapter 6: Fundamental Cloud Security Nora Almezeini MIS Department, CBA, KSU From Cloud Computing by Thomas Erl, Zaigham Mahmood, and Ricardo Puttini(ISBN: 0133387526) Copyright 2013 Arcitura Education,

More information

2015 CENTRI Data Breach Report:

2015 CENTRI Data Breach Report: INDUSTRY REPORT 2015 CENTRI Data Breach Report: An Analysis of Enterprise Data Breaches & How to Mitigate Their Impact P r o t e c t y o u r d a t a Introduction This industry report attempts to answer

More information

Public Cloud Security: Surviving in a Hostile Multitenant Environment

Public Cloud Security: Surviving in a Hostile Multitenant Environment Public Cloud Security: Surviving in a Hostile Multitenant Environment SESSION ID: EXP-R01 Mark Russinovich Technical Fellow Windows Azure, Microsoft @markrussinovich The Third Computing Era Security Could

More information

PCI Security Compliance in KANA Solutions How KANA Applications Helps Companies Comply with PCI Security Standards

PCI Security Compliance in KANA Solutions How KANA Applications Helps Companies Comply with PCI Security Standards PCI Security Compliance in KANA Solutions How KANA Applications Helps Companies Comply with PCI Security Standards Table of Contents PCI Security Compliance in KANA Solutions...1 The Importance of Protecting

More information

Contact: Henry Torres, (870) 972-3033

Contact: Henry Torres, (870) 972-3033 Information & Technology Services Management & Security Principles & Procedures Executive Summary Contact: Henry Torres, (870) 972-3033 Background: The Security Task Force began a review of all procedures

More information

GUIDELINES FOR RESPONSIBLE USE OF IDENTITY MANAGEMENT SYSTEMS

GUIDELINES FOR RESPONSIBLE USE OF IDENTITY MANAGEMENT SYSTEMS GUIDELINES FOR RESPONSIBLE USE OF IDENTITY MANAGEMENT SYSTEMS When used appropriately, identity management systems provide safety and security where they are needed. When used improperly, identity management

More information

The Problems With SEC s Cybersecurity Approach

The Problems With SEC s Cybersecurity Approach Portfolio Media. Inc. 860 Broadway, 6th Floor New York, NY 10003 www.law360.com Phone: +1 646 783 7100 Fax: +1 646 783 7161 customerservice@law360.com The Problems With SEC s Cybersecurity Approach Law360,

More information

Cybersecurity and Hospitals. What Hospital Trustees Need to Know About Managing Cybersecurity Risk and Response

Cybersecurity and Hospitals. What Hospital Trustees Need to Know About Managing Cybersecurity Risk and Response Cybersecurity and Hospitals What Hospital Trustees Need to Know About Managing Cybersecurity Risk and Response This resources was prepared exclusively for American Hospital Association members by Mary

More information

WHITE PAPER. PCI Basics: What it Takes to Be Compliant

WHITE PAPER. PCI Basics: What it Takes to Be Compliant WHITE PAPER PCI Basics: What it Takes to Be Compliant Introduction A long-running worldwide advertising campaign by Visa states that the card is accepted everywhere you want to be. Unfortunately, and through

More information

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF ARIZONA

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF ARIZONA David W. Lincicum (California Bar No. 223566) Burke W. Kappler (D.C. Bar No. 471936) Federal Trade Commission 600 Pennsylvania Avenue, N.W. Mail Stop NJ-8122 Washington, D.C. 20580 dlincicum@ftc.gov bkappler@ftc.gov

More information

How Your Current IT Security System Might Be Leaving You Exposed TAKEAWAYS CHALLENGES WHITE PAPER

How Your Current IT Security System Might Be Leaving You Exposed TAKEAWAYS CHALLENGES WHITE PAPER WHITE PAPER CHALLENGES Protecting company systems and data from costly hacker intrusions Finding tools and training to affordably and effectively enhance IT security Building More Secure Companies (and

More information

Nine recommendations for alternative funds battling cyber crime. kpmg.ca/cybersecurity

Nine recommendations for alternative funds battling cyber crime. kpmg.ca/cybersecurity Nine recommendations for alternative funds battling cyber crime kpmg.ca/cybersecurity Cyber criminals steal user names and passwords and use it to conduct financial trading activity illicitly. Hackers

More information

Standard: Information Security Incident Management

Standard: Information Security Incident Management Standard: Information Security Incident Management Page 1 Executive Summary California State University Information Security Policy 8075.00 states security incidents involving loss, damage or misuse of

More information

Michael Seltzer COMP 116: Security Final Paper. Client Side Encryption in the Web Browser Mentor: Ming Chow

Michael Seltzer COMP 116: Security Final Paper. Client Side Encryption in the Web Browser Mentor: Ming Chow Michael Seltzer COMP 116: Security Final Paper Client Side Encryption in the Web Browser Mentor: Ming Chow 1 Abstract Web service providers generally look to encryption as a means of ensuring data privacy

More information

Why is this National Cyber Security Month? Stephen G. Austin, CPA, MBA Swenson Advisors, LLP

Why is this National Cyber Security Month? Stephen G. Austin, CPA, MBA Swenson Advisors, LLP Why is this National Cyber Security Month? Stephen G. Austin, CPA, MBA, LLP Created as a collaborative effort between government and industry to ensure every American has the resources they need to stay

More information

PCI Compliance: Protection Against Data Breaches

PCI Compliance: Protection Against Data Breaches Protection Against Data Breaches Get Started Now: 877.611.6342 to learn more. www.megapath.com The Growing Impact of Data Breaches Since 2005, there have been 4,579 data breaches (disclosed through 2013)

More information

FEDERAL IDENTITY THEFT TASK FORCE. On May 10, 2006, the President signed an Executive Order establishing an Identity Theft

FEDERAL IDENTITY THEFT TASK FORCE. On May 10, 2006, the President signed an Executive Order establishing an Identity Theft FEDERAL IDENTITY THEFT TASK FORCE Attorney General Alberto Gonzales Federal Trade Commission Chairman Deborah Platt Majoras On May 10, 2006, the President signed an Executive Order establishing an Identity

More information

TYPES, PREVALENCE, AND PREVENTION OF CYBERCRIME. Haya Fetais & Mohammed Shabana. Saint Leo University COM- 510

TYPES, PREVALENCE, AND PREVENTION OF CYBERCRIME. Haya Fetais & Mohammed Shabana. Saint Leo University COM- 510 TYPES, PREVALENCE, AND PREVENTION OF CYBERCRIME Haya Fetais & Mohammed Shabana Saint Leo University COM- 510 November 23, 2014 Introduction Globalization and technological developments have infiltrated

More information

Is Your Company Ready for a Big Data Breach? Sponsored by Experian Data Breach Resolution

Is Your Company Ready for a Big Data Breach? Sponsored by Experian Data Breach Resolution Is Your Company Ready for a Big Data Breach? Sponsored by Experian Data Breach Resolution Independently conducted by Ponemon Institute LLC Publication Date: March 2013 Ponemon Institute Research Report

More information

Reducing the Cost and Complexity of Web Vulnerability Management

Reducing the Cost and Complexity of Web Vulnerability Management WHITE PAPER: REDUCING THE COST AND COMPLEXITY OF WEB..... VULNERABILITY.............. MANAGEMENT..................... Reducing the Cost and Complexity of Web Vulnerability Management Who should read this

More information

Privacy Impact Assessment

Privacy Impact Assessment AUGUST 16, 2013 Privacy Impact Assessment CIVIL PENALTY FUND AND BUREAU-ADMINISTERED REDRESS PROGRAM Contact Point: Claire Stapleton Chief Privacy Officer 1700 G Street, NW Washington, DC 20552 202-435-7220

More information

Committee on Civil Liberties, Justice and Home Affairs - The Secretariat - Background Note on

Committee on Civil Liberties, Justice and Home Affairs - The Secretariat - Background Note on Committee on Civil Liberties, Justice and Home Affairs - The Secretariat - Background Note on US Legal Instruments for Access and Electronic Surveillance of EU Citizens Introduction This note presents

More information

[WEB HOSTING SECURITY 2014] Crucial Cloud Hosting. Crucial Research

[WEB HOSTING SECURITY 2014] Crucial Cloud Hosting. Crucial Research 2014 Crucial Cloud Hosting Crucial Research [WEB HOSTING SECURITY 2014] Security is a growing threat for hyper-connected and Internet-dependent businesses whose activities increasingly rely on web hosting

More information

Privacy Engineering Objectives and Risk Model - Discussion Deck. Objective-Based Design for Improving Privacy in Information Systems

Privacy Engineering Objectives and Risk Model - Discussion Deck. Objective-Based Design for Improving Privacy in Information Systems Privacy Engineering Objectives and Risk Model - Discussion Deck Objective-Based Design for Improving Privacy in Information Systems Purpose and Scope This discussion deck describes initial draft components

More information

Austin Peay State University

Austin Peay State University 1 Austin Peay State University Identity Theft Operating Standards (APSUITOS) I. PROGRAM ADOPTION Austin Peay State University establishes Identity Theft Operating Standards pursuant to the Federal Trade

More information

STATEMENT OF RANDY S. MISKANIC VICE PRESIDENT, SECURE DIGITAL SOLUTIONS U.S. POSTAL SERVICE BEFORE THE SUBCOMMITTEE ON FEDERAL WORKFORCE, U.

STATEMENT OF RANDY S. MISKANIC VICE PRESIDENT, SECURE DIGITAL SOLUTIONS U.S. POSTAL SERVICE BEFORE THE SUBCOMMITTEE ON FEDERAL WORKFORCE, U. STATEMENT OF RANDY S. MISKANIC VICE PRESIDENT, SECURE DIGITAL SOLUTIONS U.S. POSTAL SERVICE BEFORE THE SUBCOMMITTEE ON FEDERAL WORKFORCE, U.S. POSTAL SERVICE AND THE CENSUS UNITED STATES HOUSE OF REPRESENTATIVES

More information

Protect Your Identity

Protect Your Identity Protect Your Identity What Is Identity Theft? The short answer is that identity theft is a crime. Identity theft and identity fraud are terms used to refer to all types of crime in which someone wrongfully

More information

Unisys Security Insights: Germany A Consumer Viewpoint - 2015

Unisys Security Insights: Germany A Consumer Viewpoint - 2015 Unisys Security Insights: Germany A Consumer Viewpoint - 2015 How consumers in Germany feel about: Personal data security, ranked by industry Experiences concerning security of personal data Research by

More information

The Ethical Implications of NSA Surveillance for Lawyers. David G. Ries Clark Hill Thorp Reed

The Ethical Implications of NSA Surveillance for Lawyers. David G. Ries Clark Hill Thorp Reed The Ethical Implications of NSA Surveillance for Lawyers David G. Ries Clark Hill Thorp Reed 2 3 The June 2013 Headlines: NSA collecting phone records of millions of Verizon customers daily The Guardian,

More information

LOOKING AT CLOUDS FROM BOTH SIDES NOW

LOOKING AT CLOUDS FROM BOTH SIDES NOW ANALYSIS, ADVANCED KEY POINTS OF THE ARTICLE: LOOKING AT CLOUDS FROM BOTH SIDES NOW WRITTEN BY W. KUAN HON, CHRISTOPHER MILLARD & IAN WALDEN 1/12 SUMMARY 1. Analysis history...3 2. Context...4 3. The evolution

More information

The Evolving Cybersecurity Landscape: Reviewing Trends in Data Breaches and Incident Response

The Evolving Cybersecurity Landscape: Reviewing Trends in Data Breaches and Incident Response WilmerHale Cybersecurity, Privacy and Communications Webinar Series The Evolving Cybersecurity Landscape: Reviewing Trends in Data Breaches and Incident Response July 28, 2015 Attorney Advertising copyright

More information

Microsoft s cybersecurity commitment

Microsoft s cybersecurity commitment Microsoft s cybersecurity commitment Published January 2015 At Microsoft, we take the security and privacy of our customers data seriously. This focus has been core to our culture for more than a decade

More information

Cybersecurity Workshop

Cybersecurity Workshop Cybersecurity Workshop February 10, 2015 E. Andrew Keeney, Esq. Kaufman & Canoles, P.C. E. Andrew Keeney, Esq. Kaufman & Canoles, P.C. 150 West Main Street, Suite 2100 Norfolk, VA 23510 (757) 624-3153

More information

Cybersecurity Enhancement Account. FY 2017 President s Budget

Cybersecurity Enhancement Account. FY 2017 President s Budget Cybersecurity Enhancement Account FY 2017 President s Budget February 9, 2016 Table of Contents Section 1 Purpose... 3 1A Mission Statement... 3 1.1 Appropriations Detail Table... 3 1B Vision, Priorities

More information

CDT ISSUE BRIEF ON FEDERAL DATA BREACH NOTIFICATION LEGISLATION

CDT ISSUE BRIEF ON FEDERAL DATA BREACH NOTIFICATION LEGISLATION CDT ISSUE BRIEF ON FEDERAL DATA BREACH NOTIFICATION LEGISLATION January 27, 2015 A September 2014 Ponemon study found that 60% of U.S. companies have experienced more than one data breach in the past two

More information

MICROSOFT OFFICE 365 PRIVACY IMPACT ASSESSMENT. Western Student E-Communications Outsourcing

MICROSOFT OFFICE 365 PRIVACY IMPACT ASSESSMENT. Western Student E-Communications Outsourcing MICROSOFT OFFICE 365 PRIVACY IMPACT ASSESSMENT Western Student E-Communications Outsourcing Paul Eluchok - University Privacy Officer David Ghantous - Associate Director of Technical Services Dated: August

More information

Panel Title: Data Breaches: Industry and Law Enforcement Perspectives on Best Practices

Panel Title: Data Breaches: Industry and Law Enforcement Perspectives on Best Practices Panel Title: Data Breaches: Industry and Law Enforcement Perspectives on Best Practices Over the course of this one hour presentation, panelists will cover the following subject areas, providing answers

More information

1. Understanding Big Data

1. Understanding Big Data Big Data and its Real Impact on Your Security & Privacy Framework: A Pragmatic Overview Erik Luysterborg Partner, Deloitte EMEA Data Protection & Privacy leader Prague, SCCE, March 22 nd 2016 1. 2016 Deloitte

More information

Important Customer Notice. Information Concerning Data Security Incident at Some Staples Stores

Important Customer Notice. Information Concerning Data Security Incident at Some Staples Stores Important Customer Notice Information Concerning Data Security Incident at Some Staples Stores Staples wants to make customers aware that we have confirmed a data security incident involving customer payment

More information

CYBER SECURITY THREAT REPORT Q1

CYBER SECURITY THREAT REPORT Q1 CYBER SECURITY THREAT REPORT Q1 Moving Forward Published by UMC IT Security April 2015 0 U.S. computer networks and databases are under daily cyber-attack by nation states, international crime organizations,

More information