4 Points About the Target Breach and Data Security



1. Beware of fraudsters engaging in post-breach fraud.




3. Data breaches cause harm.


A data breach also causes a harm because people are at greater risk for fraud and will feel anxiety and concern. People might reasonably spend money and time to protect themselves. One problem is that recognizing harm can be a Hobson’s choice for courts. Recognize harm, even a tiny one, and there’s a floodgate of class action suits and damage awards that could total billions because of the enormous numbers of people whose data is affected in a breach. A small harm multiplied by tens of millions of people can really add up to catastrophic damages for a company. Failing to recognize harm is bad, too, because there really is harm, and it needs to be appropriately deterred and redressed. I’ve been thinking a lot about privacy and security harm and I’ll discuss the issue later on in another post.

4. Data security is hard.

In the past, when I heard of breaches, I used to want to scream: “Come on! How can this still keep happening?” But now that I have a business providing data security awareness training, I have realized just how challenging maintaining data security can be. Data security requires an odd combination of controlling technology as well as controlling people. On the technology side, it is expensive to do things right. And even if everything is done right, a breach can still happen. On the people side, humans are one of the biggest sources of vulnerability. People are too quick to click, too eager to grab data and take it places, and often lack sufficient awareness to be careful and vigilant. And people are hard to control. Tell a computer what to do, and it’s done. Tell a human what to do, and who knows what will happen?

Of course, the fact that data security is hard should not absolve organizations that fail to follow best practices. But we must respect the fact that data security is hard. It is hard to follow best practices, and a breach can still happen even if best practices are followed. There is something missing with the discussion about the NSA gathering zillions of pieces of data and with President Obama’s rather anemic solution of just having the data stored somewhere other than the NSA. What is missing is the recognition that this huge repository of data must be kept secure – no matter where it is kept!

Far too often, the fact that data security is hard is ignored by government and companies when deciding to collect and use personal data. And this fact is ignored by the government when requiring businesses to keep and store data. For example, in recent years, the IRS began requiring businesses to file 1099 forms for a wide array of services provided by others. Now, all businesses (many of which are small businesses) must collect and store many more people’s Social Security numbers. That’s a huge security risk. I point this out not to suggest that this measure is wrongheaded, but that data security is implicated in so many measures like this one, and thus deserves more consideration and attention.

As government and industry rush into using biometric identifiers, such as fingerprints and iris scans, as they collect and store sensitive data in larger data repositories, they are doing so in a world where data security is hard. At the very least, the fact that data security is hard should lead to greater pause and caution.

Cross-posted at LinkedIn

You may also like...