Understanding: The Key to Protecting Highly Sensitive Personally Identifiable Information Timothy J. Brueggemann, Ph.D.

Introduction  The reliance of organizations on the collection and storing of data  HSPII is defined as information which can be used to discern or to trace an individual’s identity either alone or when combined with other information which is held in the public domain  Access to information and data is easier than ever to obtain, use, and share

Introduction – cont.Introduction – cont.  Lost or stolen laptops  Challenges that face an organization today  Increase organizational efficiency  the protection of the HSPII  New perspectives in organizational security have grown from the increased amount of government legislation and increased public awareness.  Data security is an area that is one of the most studied, and often the area that is the most confused with a HSPII program.

Privacy  As a legal right privacy was defined by Samuel D. Warren and Louis D. Brandeis in 1890 as “the right to be let alone”  Not currently enacted into law  In the 1960s and 1970s congress became increasingly concerned about the amount of data being stored on databases

Legislation  The Privacy Act of 1974  Health Insurance Portability and Accountability Act (HIPAA)  Family Education Rights Act (FERPA)  Electronic Communications Privacy Act (ECPA), 18 U.S.C

Problem AreasProblem Areas  Increases in online technology  Attacks on privacy occur in many areas  Employment Records  The Internet  Government Databases  Corporate Databases

The StudyThe Study  Define the level of understanding the IT worker had on HSPII at their organization  Four areas reviewed  Knowledge of HSPII Program  Ascription to Technology  Ascription to Technology – Belief  Senior Management Involvement

The Study – cont.The Study – cont.  The population for this study was comprised of all IT workers employed by Fortune 500 companies within and outside of the United States.  A convenience sample was taken from one large Fortune 500 company.  Approximately 8,000 IT employees  A random sample of 10% of the IT staff was selected  A minimum response rate of 260, 32.5%, was necessary to represent the 800 employees selected to participate  Actual response rate was 332 or 41.5%

The Study – cont.The Study – cont.  Six hypotheses were formed for this study.  H 1 : The time in the Information Technology field has a relationship to the Information Technology workers’ understanding of Personally Identifiable Information Programs.  H 2 : The education level of Information Technology employees has a relationship to their understanding of Personally Identifiable Information Programs.  H 3 : The length of time with the company of Information Technology employees has a relationship to their understanding of Personally Identifiable Information Programs.  H 4 : There is a difference in the understanding of Personally Identifiable Information Programs between those who have employees that report to them and those who do not have employees report to them.  H 5 : The role of Information Technology employees has a relationship to their understanding of Personally Identifiable Information Programs.  H 6 : The age of Information Technology employees has a relationship to their understanding of Personally Identifiable Information Programs.

Hypothesis 1: Time Working in Information TechnologyHypothesis 1: Time Working in Information Technology

Hypothesis 2: Formal Education of IT and HSPII Understanding

Hypothesis 3: Length of Time with the Company and HSPII Understanding

Hypothesis 4: Employees Who Have Direct Reports and HSPII Understanding

Hypothesis 6: Age of Employee and HSPII UnderstandingHypothesis 6: Age of Employee and HSPII Understanding

Hypothesis 6: Role of Employee and HSPII Understanding

Summary  1. Explored the understanding level of HSPII programs by the IT professional  2. Additional insights gained from this study  3. The age group of the IT professional

Concluding RemarksConcluding Remarks  The possibility of data loss continuously threatens the security and the availability of IT systems and IT resources. The HSPII program must be a reiterative process and must be ongoing for it to be of value. IT systems and applications need to continually be examined and evaluated to determine any new risks that may arise around HSPII data security. One of the, if not the primary, risk to any HSPII program is a lack of understanding of the individuals most involved in protecting the data; the IT professional.

Questions?