Data Breaches: Trends, Costs and Best Practices

Data breaches: Trends, costs and best practices 2008, from ITaGovernance Publishing, gives you the latest information and worldwideatrends in corporate data breaches - those that affect personally identifiable information and contravene laws such as the UKaData Protection Act, HIPAA and so ona- and identifiesabest practice for avoiding business, regulatory and brand damage."

Table of Contents:
1 Introduction 2 Key recommendations 3 Trends in reported data breaches 3.1 The numbers of data breaches3.2 The numbers of data breaches by sector 3.3 Data breaches arising from insider and outsider threats 4 Costs of data breaches 4.1 Costs to organisations4.1.1 Unavoidable costs which are consequent on compliance with a data breach law 4.1.2 Costs which may be necessary to restore the brand 4.1.3 Costs resulting from customer churn4.1.4 Costs resulting from legal action 4.2 Costs to customers4.3 Costs to banks4.4 Costs to police/federal organisations4.5 Costs incurred through the fraudulent purchase of goods 5 Data protection legislation and regulation 5.1 Europe5.2 UK 5.2.1 Rights of data subjects (subject access requests)5.2.2 The sharing of sensitive personal data within the public sector 5.3 US 5.3.1 The Gramm-Leach-Billey Act 5.3.2 The Fair Credit Reporting Act 5.3.3 Safe Harbor 5.3.4 HIPAA 5.3.5 The Federal Information Security Management Act (FISMA) 5.3.6 The Federal Financial Institutions Examination Council standards (FFIEC) 5.3.7 Sarbanes-Oxley (SOX) 5.3.8 Basel 2 5.4 Canada 5.5 South Africa 5.6 Australia 5.7 Outsourcing5.7.1 The Payment Card Industry Data Security Standard (PCI DSS) 6 Causes of data breaches 6.1 External threats6.1.1 Hacking6.1.2 Phishing, pharming, whaling and other targeted attacks6.1.3 Malware6.1.4 Fraud6.1.5 Physical theft6.1.6 Social engineering attacks6.2 Internal threats 6.2.1 Disposal 6.2.2 E-mail6.2.3 Lost portable storage media6.2.4 Web application weaknesses6.3 Trends in data breach causes 6.3.1 Causes of data breaches in the US 6.3.2 Causes of data breaches in the UK 7 Recommendations for improved data security 7.1 Create a defence-in-depth using ISO27001 7.1.1 Organisational processes 7.2 Encryption7.2.1 Laptop encryption 7.2.2 Encryption of portable storage devices 7.2.3 Wireless encryption 7.3 Establish rigorous procedures to ensure physical destruction of redundant computer drives and magnetic media prior to disposal 7.4 Protect credit card data7.5 Provide regular training and awareness on legal responsibilities for all staff that deal with personal data 7.6 Deploy outward-bound channel (e-mail, instant messenger) filtering software, with customised dictionaries7.7 Establish a vulnerability patching programme and deploy anti-malware software Implement anti-malware software 7.8 Implement a business-driven access control policy, combined with effective authentication 7.9 Maintain an inventory of the types of data held, apply an information classification system, and ensure that data retention and destruction, of both electronic and paper-based information, is carried out in line with a formal matrix of data retention periods 7.10 Develop an incident management plan that enables the organisation to respond effectively to any data breaches 3APPENDIX A Glossary APPENDIX B Examples of data breaches by cause [Source: Attrition database 2008] APPENDIX C examples of data breaches showing consequent organisational cost and impactAPPENDIX D State laws governing security breach notification APPENDIX E European directive on data protection APPENDIX F References