Data loss prevention. It's come to be one of the terms that we have become unusually familiar with. Data loss prevention isn't about the outright cessation of the loss of personal records; it's about reducing the risk to an acceptable level. There isn't a quadrant in health, finance, construction or any other sector that doesn't have some measure of risk. When the frequency and cost of data breaches outweigh other security concerns, it is time to reassess the risks.

If we take a look at 2008 we can clearly see that it was a year of unprecedented events. From a security perspective let's look at data breaches. The amount of records containing sensitive personal information that were involved in data breaches (in the U.S.) in the last three years also falls under the "unprecedented" category -- approximately 250 million records. Last year alone 38 million records accounted for part of that number. In 2007 there were over 127 million records involved in data breaches.

A point to keep in mind is that the number of records involved in data breaches are either under-reported or, in some cases, not reported at all. A trend that I've seen is that corporations are facing greater financial risk from insufficient controls and unclear policies. Problems also arise when controls are put in place before the policies are written or completed -- the controls are designed to be put in place to enforce policies.

With respect to data loss, increasing penalties as well as increased transparency, or at least opaqueness (limited transparency), are two paths that have been cited time and again in regard to increasing corporate responsibility.

Another topic to consider is preventing breaches. Even in corporations that have well-written policies and effective controls, the percentage of data breaches that occur due to human error is still above 80 percent.

I'd like to take some time to dissect a data breach that occurred in 2008 which involved the exposure/release of 4.2 million records. As in the aviation world, when there is an accident it is referred to as a "chain of events" or the "error chain." These terms simply mean that multiple factors, rather than a single one, lead to an accident. The same can be said for security incidents or such as data leakage. Take, for instance, the case of the Maine-based Hannaford Brothers grocery stores. Let's look at this chain of events:

1. The supermarket chain reported to Massachusetts Regulators that the scope of the malware infections appears to be larger than anything that is remotely possible. It is Hannaford's belief that a "trusted" source had physical access to the servers.
2. A trusted source with administrative remote or physical access to one or more servers installed malicious software (malware) onto those servers.
3. The malware intercepts customer card data and transmits that data outside of the network to remote servers.
4. WebSphere MQ, which is a popular network messaging carrier for ATM and credit card transactions, does not encrypt this data by default. Since the traffic is sent in clear text, it is easy to "sniff" and capture or transmit this information.

-1-

Explore Our Topics

• BPM & Enterprise Architecture
• BPM Standards
• BPM Implementation
• BPM Best Practices
• Cloud BPM
• Continuous Process Improvement
• BPM Governance
• Service Governance

• Business to Business (B2B)
• BPM for Supply Chain
• BPM for Customer Management
• BPM for Financial Services
• BPM for Healthcare & Insurance
• BPM for Government

• Business Activity Monitoring
• Event Processing
• Process Intelligence
• Business Rules Management
• Decision Management
• Operational Intelligence

• Workflow Automation
• BPM & Enterprise 2.0
• BPM & Web 2.0
• BPM & ECM
• Case Management
• Collaboration
• Enterprise Portals
• Social BPM

• BPM & Cloud Integration
• BPM Analysis & Optimization
• Business Process Simulation
• Process Visibility & Monitoring
• Process Orchestration
• Process Discovery
• Process Modeling

Home
Webinars
Blogs
ebizQ Forum
All Topics
Subscriptions
White Papers
Analyst Corner
Follow us on Twitter
Fan us on Facebook

Explore Our Topics

BPM Strategy
BPM Solutions
Event Processing Strategy
Content-Centric & Collaborative BPM
Process-Centric BPM

About Us
Editorial Submissions
Feedback
FAQ
Advertise With Us
Site Map
Privacy Policy
Unsubscribe