Logblog: People Have Grown Immune to Breach Notifications

« Find Your HIPAA Violations Before Others Do | Main | Are IT Security Professionals the Last Line of Defense for Patient Privacy? »

People Have Grown Immune to Breach Notifications

by Lex van den Berghe
LogLogic Customer Evangelist

Back in simpler times, the “high tech” approach to breach notification was a gang of domestic geese or peacocks posted as sentries ‘round the farm to squawk bloody murder whenever strangers approached the property line. Times have changed, as has the definition of “high tech”…but the basic principles and necessity of effective breach notification remain the same.

I spoke with Sudha Iyer, Director of Product Management at LogLogic, and she shared her two cents on breach notification and why it pays to be prepared…

It seems that not a day goes by without a report of a data breach, or a discussion of the latest attack of the Conficker (or other malware) variant. Lest organizations become desensitized to such attacks, I’ve noticed that that breach notifications can have a negative impact on the organization’s net worth.

Take the case of Heartland Payment Systems (NYSE - HPY) for example. When markets opened after Heartland’s public announcement of their credit card breach in January 2009, their stock price shrunk to $8.54 and plummeted to $3.95 by March 2009. Today, Heartland is fortunate that their stock is almost back to its pre-breach notification price of $14.53.

Despite the continuous flood of public breach notifications like Heartland Payment Systems, I find it troubling that so many organizations continue to act as if they are immune to such attacks. Has the barrage of public breach notifications bred enough apathy so as to undermine the primary reasons for public notifications in the first place? I thought breach notifications were meant to…

· Spur the offending organization into action to put in place the necessary process, people and technology to do the right thing for the individual(s) and the business to which they are accountable.

· Serve as a warning to other organizations to do the same before their data is compromised.

Consider the healthcare industry. The Health Information Technology for Economic and Clinical Health Act (HITECH) includes a health care breach notification law. This interim final rule on the HITECH Act just became effective on September 23^rd, and the law requires any organization covered under the Health Insurance Portability and Accountability Act (HIPAA) to notify patients of a data breach involving their personal health information. Will this law, especially with its recent amendments that critics say completely guts the original intent of the bill, achieve the aforementioned aims of data breach notification? This leads to a larger question, does data breach notification adequately protect the consumer or patient whose information is compromised?

If there’s a lesson to be learned here, it would have to be: “Don’t put off until tomorrow, what you can do today.” Rather than be vulnerable and exposed to attack, enterprises should enact the proper defenses and alerts to fend off the perpetrators. If your high tech “farm” could use a good flock of geese or peacocks, check us out…we can help!

Posted October 05, 2009 in | Permalink

Sun	Mon	Tue	Wed	Thu	Fri	Sat
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30	31

People Have Grown Immune to Breach Notifications

Post a comment

August 2010

Categories

Archives

Blogroll

Blogroll

Compliance

Good Reading

LogLogic

LogLogic Partners

Sites We Watch