ARMAGEDDON IS HERE: IDENTITY AND COMPUTER BREACHES

You Don’t Know What You Don’t Know There’s No Such Thing as Worthless Data The bad guys gather seemingly worthless bits of data to launch social engineering attacks or use a small piece of information to complete the attack puzzle Compromises Happen All of the Time Even to companies who take security seriously Even to companies who do everything reasonable It may not be YOUR data but it is YOUR responsibility to protect it

IT’S NOT JUST NORMA AND MIKE’S PROBLEM RICK assumes the risk for the loss of data IT protects the data to the identified risk level Data protection, breach prevention MUST be a joint operation for success

Breach Scenario

There is a Cost for a Compromise

Who are the Victims? 37% of breaches affected financial organizations 24% of breaches occurred in retail and restaurants 20% of network intrusions involved manufacturing, transportation, and utilities 20% of network intrusions hit information and professional services firms 38% of breaches impacted larger organizations 27 countries affected

Who Perpetrated the Breaches?

What Can I Personally Do? Only collect and use information that is absolutely necessary, and only share with those who absolutely need the information “Review and reduce”—inventory your PII and PII data flows, and look for ways to reduce PII Follow all Departmental policies and procedures Think before you hit the “send” button (E-mail is by far the #1 source of breaches) “Scramble, don’t gamble”—encrypt, encrypt, encrypt Minimize (or eliminate) the use of portable storage devices Protect PII on paper—enforce a clean desk policy, use secure shredding bins, locked cabinets, etc.

Questions?