…looks like to me.
Sure, you’ve got your own home-grown database security system all designed and working in development. And then you ask me to confirm that it’s “safe”. I’ll tell ya “it’s safe as long as you don’t actually put any data in it”.
News about yet another health data breach comes, with millions affected. The largest breach of about 5 million people involves yet again, a USB drive.
I could see why a CIO would want to order the disabling of all USB ports on corporate computers. Then will someone is going to come up with a “USB Drives Don’t Breach Data, People Do” solution?
I’m still wondering why the tech community can’t come up with a solution to this ongoing attack on people’s data. In these cases, is it that the employees just didn’t care about the people? Were they feeling pressure to just get the job done? Did they not know that sensitive data was on these devices? Perhaps they were just sharing one of their USB bottle openers like the ones I collect?
– June 2012: The health data of about 38,000 individuals was shared with a researcher. The data was linked to Statistics Canada community health survey information. The disclosure of the information breached an agreement with the federal government.
– June 2012: A USB stick which contained a plain text file of 19 types of health data was provided to an authorized ministry contractor. The file included personal health numbers and health conditions – such as Alzheimers – for about five million individuals over several years. Against policy the data that was neither encrypted or made non identifiable.
– October 2010: Health Ministry data containing the personal health numbers of about 21,000 people – with diagnostic information for about 262 chronic diseases conditions – was shared on a USB stick with a researcher without a request being approved.
Disabling USB ports seems like the wrong approach. Right now I’m leaning towards criminal prosecution of people who are careless with our data.
Love your data. Because it’s really our data.
One of the most common discussions I have with other data professionals is “why do we keep having so many silly data breaches?” It seems to me that the data put at risk is done so by sloppy IT practices and negligent employees, not always via hackers and fraudsters. In this case, it appears it was both. Reports and rumours point to insecure system admin practices and outside hackers. We don’t know for certain, because in the US data breach laws are patchy and weak.
Usually the discussion comes around to talking about US companies not having to face many consequences for failing to protect our data. Take a look at this quote about the GlobalPayments breach of 1.5 to 7 million merchant account holder data:
Global says it has now paid all fines related to non-compliance and has reached resolution with certain card networks, although it did not specify which ones. The processor also says its business has not suffered as a result of the breach.
“The impact on revenue of customers or other third parties who have failed to renew, terminated negotiations, or informed us they are not considering us at all, where we can confirm it is related to our removal from the lists, has been immaterial,” Global states. “We continue to process transactions worldwide through all of the card networks.”
Global has spent almost a hundred million dollars on this breach and expects to have to shell out another $25-25 million in 2013. And yet with those numbers they don’t believe it has had a negative impact on their business.
Global handles Visa and MasterCard payment processing of about $120 billion (yes, with a “b”) in payments annually.
Their annual report also seems to imply that they were not PCI-DSS compliant when the breach occurred and Global has been removed from the list of organizations that is compliant. So billions of dollars and millions of account information pass through their non-compliant networks. Because it can.
I wish more companies would treat our data as something that needs to be protected.
It seems like the majority of health data breaches I read about are via insiders with access to patient information systems stealing and selling their data.
Federal authorities say Sergei Kusyakov, who was involved with Metro Chiropractic and Wellness Center and City Lights Medical Center, illegally obtained private information about patients through Dale Munroe II and his wife, Katrina Munroe, who worked at Florida Hospital’s Celebration campus.
Authorities said Dale Munroe accessed more than 763,000 records for patients treated at various Florida Hospital locations. He focused on patients who were in automobile accidents, and inappropriately reviewed in detail more than 12,000 patient records.
The interesting part of this is that first it was the husband stealing the data, then when he was fired, his wife took up the work. I would think that there would have been better monitoring of her data access in this case, given the highly-sensitive nature of the data.
Does your organization sufficiently monitor data access to sensitive data? Are you told that you should be using production data for testing of IT development solutions? Do you know that may be illegal in some jurisdictions?
I’ve always refused to accept production data for testing purposes. I think if all data professionals would do that, it would help everyone understand just how risky it was.
Loving your data involves protecting it, too. It’s our job as data professionals to ensure organizations do that.
I think about data encryption, physical access controls to servers and such on a regular basis. But there are all kinds of formats via which data gets stored or communicated. The Rhode Island Department of Labor recently had a data breach involving their call center. Customers were able to hear conversations on other calls. The department estimates fewer than 700 people were affected.
- Paper forms in which data is originally collected. Think membership forms, applications, feedback and suggestion forms. I remember seeing a binder full of membership forms being used to prop open a door on the sidewalk in front of a store. When I pointed out to the manager that this was a problem, he shrugged and said it wasn’t a problem because all the data had already been keyed in and therefore no longer had any value to them except when the systems were down.
- Video and photographs. The advent of video analytics and photo analysis means that we are collecting, storing, and putting at risk more data than ever before. I remember seeing a retailer’s security video tapes sitting all lined up on a counter at the back of a store. The only thing that made this somewhat safe is that most likely the security system was probably so poor it would be impossible to determine who was on those videos. But now video analytics allow retailers to determine when you visit their store, who you shop with and what products interest you.
- Conversations. Yes, all those "may be recorded for quality purposes" call center calls are most likely chock full of your personal information. I worry how well those data sets are being protected, too.
I believe our role as data professionals should go beyond protecting the data held in a traditional database. Because I’m not sure anyone else is even considering that data. And I’d bet the bad guys are betting that no data professional is involved in protecting it.
Love your data. Love your customers’ data, too.
I recently talked with my good friend Denny Cherry (@mrdenny | blog) about my experience at the NoSQL Now! conference and working with NoSQL technologies. Denny’s new podcast series is called People Talking Tech and he has other interesting topics and people coming up soon.
My comments focused on how at the NoSQL professionals understand that it means "Not Only SQL" and can’t mean "No SQL" and have much of a future. Using the right tool for the right job. Cost, benefit, risk and all.
One of the things we talked about on the closing panel is "how do you find somebody that is a good architect who can tell you which types of technologies you can use for which use cases…"
Even though many people talk about NoSQL needing no architecture, we still need people to help choose when and what NoSQL technologies to use. Seems to me that having experience working hands-on with relational and NoSQL technologies is going to be hugely valuable in the next couple of years. If you have relational experience, now is the time to start learning about non-relational ones.
By the way, we talked a bit about database security. Denny’s new edition of his book Securing SQL Server, Second Edition: Protecting Your Database from Attackers has recently been released. Check it out.
A recent CMIO post describes the data breach of 34,000 patients’ personally identifiable information.
A former contractor’s personal laptop containing patient information was stolen, according to a statement from Larry Warren, CEO of the hospital. “This information was downloaded in violation of Howard University Hospital policy,” he wrote.
I’ll give you 30 seconds to spot 3 problems with the situation. Tick, Tock.
I can see three especially worrisome problems:
- Information was downloaded in violation: I’m guessing that there was no monitoring of downloads of sensitive data at this medical institution. This sort of monitoring may have prevented this data from leaving the building.
- Former contractor: So a person who had access to this sensitive data was allowed to leave the organization with it. I personally refuse to put data such as this on my own devices, mainly because I do not want the liability of having to protect it or report it if something were go wrong. I am usually the only person on the project who refuses. However, I have never even been asked or reminded about removing any company data from any of my storage devices when I go on to other projects.
- Personal Laptop: I sometimes use my own equipment when working at a client and that is normally due to the fact that client systems are often less powerful than my own and they don’t have licenses for tools that I need to do my job.. But I’d rather use systems that have enterprise-class security, encryption and monitoring. I wish more corporate systems supports such practices.
Since the article did not mention that the data was encrypted, I’m guessing it wasn’t. I’m also wondering why this ever got reported…most former consultants would not do so, I’m guessing, if they had the data in violation. Perhaps the laptop was recovered and the breach was reported that way.
I’ve previously blogged about how poorly medical data is protected.
This sort of data breach makes me mad. It’s nice that the hospital says that they are now “implementing enhanced security measures”, but why didn’t they do that before? Did their compliance officer recommend it but management said “no, too expensive”? Did their DBA say “the database is encrypted, so we are covered”? Did the former contractor take the data maliciously? Did he have to put it on his personal laptop? Why do we continue to treat data as if it is someone else’s problem to manage? Do we not understand that we have a professional obligation to protect patient data? Even with legislation it seems the message still isn’t making it through to everyone.
Does your organization have security monitoring in place to protect patient or customer data? If it doesn’t, have you recommended that it do so? Go do it, now.
Subscribe via E-mail
- September 2016
- August 2016
- June 2016
- May 2016
- April 2016
- March 2016
- February 2016
- January 2016
- December 2015
- November 2015
- September 2015
- July 2015
- June 2015
- May 2015
- April 2015
- March 2015
- February 2015
- January 2015
- December 2014
- November 2014
- October 2014
- August 2014
- July 2014
- June 2014
- May 2014
- April 2014
- March 2014
- February 2014
- January 2014
- December 2013
- November 2013
- October 2013
- September 2013
- August 2013
- July 2013
- June 2013
- May 2013
- April 2013
- March 2013
- February 2013
- January 2013
- December 2012
- November 2012
- October 2012
- September 2012
- August 2012
- July 2012
- June 2012
- May 2012
- April 2012
- March 2012
- February 2012
- January 2012
- December 2011
- November 2011
- October 2011
- September 2011
- August 2011
- July 2011
- June 2011
- May 2011
- April 2011
- March 2011
- February 2011
- January 2011
- December 2010
- November 2010
- September 2010
- August 2010
- July 2010
- February 2009