Ponemon Institute© Private & Confidential DocumentPage 1 Recent Research on Privacy, Trust and Data Protection The Privacy Symposium at Harvard University Dr. Larry Ponemon, Chairman Ponemon Institute LLC August 22, 2007

Ponemon Institute© Private & Confidential DocumentPage 2 Ponemon Institute LLC The Institute is dedicated to advancing responsible information management practices that positively affect privacy and data protection in business and government. The Institute conducts independent research, educates leaders from the private and public sectors and verifies the privacy and data protection practices of organizations. Ponemon Institute is a full member of CASRO (Council of American Survey Research Organizations. Dr. Ponemon serves as CASRO’s chairman of Government & Public Affairs Committee of the Board. The Institute has assembled more than 50 leading multinational corporations called the RIM Council, which focuses the development and execution of ethical principles for the collection and use of personal data about people and households. The majority of active participants are privacy leaders (CPOs).

Ponemon Institute© Private & Confidential DocumentPage 3 Proposed Agenda  What is privacy trust?  What does recent research tell us? Scott & Scott – business impact of data breach Redemtech – debut today of newest study on off- network security Ponemon – Is desktop safe  Implications, privacy and the public’s trust  Questions

Ponemon Institute© Private & Confidential DocumentPage 4 How the World Looks at Privacy Based on over 100 studies conducted between 2003 and 2006, we compiled the following distribution for adult-aged individuals in 16 countries with respect to their preferences for privacy: –About 12% of the public appear to be privacy-centric. Events that minimize their sense of privacy or diminish the safety of their sensitive personal information will have a significant impact on behavior. –About 68% of the public appear to be privacy-sensitive. While they say that privacy is important to them, it will not change their behaviors or information sharing practices. –About 21% of the public appear to be privacy-complacent. They really don’t care very much about the sharing or selling of their most sensitive personal information, such as Social Security number or Country ID.

Ponemon Institute© Private & Confidential DocumentPage 5 Distribution of the Public by Four Geographic Regions

Ponemon Institute© Private & Confidential DocumentPage 6 What is Privacy Trust?  A process for engendering trust and confidence in how an organization’s leaders, employees, agents and contractors handle, manage, retain and secure private information about people and our families.  Privacy trust requires an organization to ensure that actual practices are aligned with the perceptions of key stakeholders such as customers, consumers and employees.  The key components of privacy trust include: disclosure and notice, choice or consent, good security measures, reasonable access rights and data quality (accuracy).

Ponemon Institute© Private & Confidential DocumentPage 7 How Does Privacy Increase Corporate Value?  Good privacy creates real value to organizations because it promotes the trust of stakeholders such as customers, employees and business partners.  Beyond perception, privacy practices create real economic benefits in terms of: Reducing operating inefficiencies Improving information flows about people Increasing brand or marketplace image Decreasing risk of regulatory action, fines and lawsuits  Cost and ROI metrics can be developed that demonstrate the full value of good privacy practices in corporations and governmental entities.  Starting point: need to understand what the public (consumers) thinks – or, what do they care about?

Ponemon Institute© Private & Confidential DocumentPage 8 Business Impact of a Data Breach Study released in May 2007 Sponsored by Scott & Scott, LLP

Ponemon Institute© Private & Confidential DocumentPage 9 About the study Sample of 702 IT and IT security practitioners in US companies Following are the key questions in our inaugural study: Are organizations prepared to respond to the breach and what do they consider the most important actions to take? Do they measure the cost of the breach to their organization? What causes data breach incidents? How has the breach affected an organization’s strategy for preventing a breach? What are the differences in approaches to the prevention and detection of a data breach between organizations that have experienced a breach and organizations that have not had a data breach?

Ponemon Institute© Private & Confidential DocumentPage 10 85% of respondents’ companies experienced a breach incident

Ponemon Institute© Private & Confidential DocumentPage 11 42% of data breaches occurred because of missing devices such as a laptop computers

Ponemon Institute© Private & Confidential DocumentPage 12 What technologies are not being deployed to remedy future breaches?

Ponemon Institute© Private & Confidential DocumentPage 13 57% did not have an incident response plan in place when the breach happened

Ponemon Institute© Private & Confidential DocumentPage 14 Notification strategy 37% over-report

Ponemon Institute© Private & Confidential DocumentPage 15 Majority of respondents do not believe that breach victims suffer monetary damages

Ponemon Institute© Private & Confidential DocumentPage 16 National Survey: The Insecurity of Off-Network Security Study released today (August 2007) Sponsored by Redemtech

Ponemon Institute© Private & Confidential DocumentPage 17 About the study Sponsored by Redemtech, Ponemon Institute independently conducted this study to better understand how business and government organizations are securing confidential data on off-network electronic equipment. Our national survey queried 735 respondents who are employed in corporate information technology (IT) departments within U.S.-based business or governmental organizations. Our survey focused on the following four key issues: –How important is it for an organization to control data on electronic devices that are off-network? –What controls or procedures do organizations have in place to secure off- network data-bearing equipment or devices? –How rigorous is the enforcement of policies and procedures to protect confidential off-network data? –What are the primary causes for the theft or loss of data on electronic devices that are off-network? –Is an organization’s confidential data as much at risk off-network as when it is on-network?

Ponemon Institute© Private & Confidential DocumentPage 18 About the study Off-Network electronic equipment – includes all data-bearing devices that are disconnected from your organization’s system or network for various reasons, such as for relocation, repair or disposition. Electronic equipment includes data-bearing servers, desktop and laptop computers, PDAs or other portable storage devices. Off-network includes equipment that is idle; not actively in use or in storage. The term also applies to equipment being moved; for transition to another user or being sent for repair, refurbishment, reconfiguration, redeployment, return on lease, or retirement (disposal).

Ponemon Institute© Private & Confidential DocumentPage 19 Sample of respondents

Ponemon Institute© Private & Confidential DocumentPage 20 Attitudes

Ponemon Institute© Private & Confidential DocumentPage 21 Data breach experience

Ponemon Institute© Private & Confidential DocumentPage 22 Off-network data loss

Ponemon Institute© Private & Confidential DocumentPage 23 Most likely causes

Ponemon Institute© Private & Confidential DocumentPage 24 Devices lost

Ponemon Institute© Private & Confidential DocumentPage 25 Security steps

Ponemon Institute© Private & Confidential DocumentPage 26 Is policy enforced?

Ponemon Institute© Private & Confidential DocumentPage 27 How long will it take to detect data loss?

Ponemon Institute© Private & Confidential DocumentPage 28 Is Desktop Search Safe? Study released in July 2007

Ponemon Institute© Private & Confidential DocumentPage 29 Background Security researcher Robert Hansen recently published details of a man-in- the-middle attack against Google’s Desktop, which places an attacker between Google and someone launching a desktop search query. From this position, the attacker is able to manipulate the search results and possibly take control of or install other programs on the desktop. According to Hansen, this drives home the point “that deep integration between the desktop and the Web is not a good idea.“ A security research firm named Watchfire identified a cross-site scripting vulnerability that would allow an attacker to place malicious code on a Google Desktop user's computer and possibly to take full control of the computer. Google says that it fixed this particular flaw.

Ponemon Institute© Private & Confidential DocumentPage 30 Survey Our Web based study was conducted between June 8 and June 12, Our national sampling frame included adult-aged respondents (≥ 18 years) who are in corporate IT or IT security. In total, people who reside in the United States received an invitation to participate. This resulted in 1,268 individuals responding (with approimxately a 5.4% response rate). About 60% of respondents said they were aware of this controversey. Only this sub-sample were asked to take the survey the remaining survey questions.

Ponemon Institute© Private & Confidential DocumentPage 31 Do you agree with Hansen?

Ponemon Institute© Private & Confidential DocumentPage 32 Is the problem resolved?

Ponemon Institute© Private & Confidential DocumentPage 33 Does antivirus software fix the problem?

Ponemon Institute© Private & Confidential DocumentPage 34 What should users do?

Ponemon Institute© Private & Confidential DocumentPage 35 What should users do?

Ponemon Institute© Private & Confidential DocumentPage 36 What can we learn from this jumble of findings?  Privacy matters. Take steps to implement responsible information management practices across the enterprise for all data subjects.  Technology makes a difference. Take stock in new enabling technologies that help protect personal information such as data leak prevention and encryption solutions.  Human factor is important. One of the top privacy risks concern negligent or incompetent employees (a.k.a. the Insider Threat). Make sure employees, temporary employees and contractors understand good privacy and data protection practices. Also, take steps to vigorously monitor behaviors that push the limits of the company’s policies or SOPs.  Understand the law. Privacy requirements vary by state, industry sector and nation. You need to understand how legal requirements impact the company’s information technology requirements. Responsible information management requires more than an adequate level of compliance.

Ponemon Institute© Private & Confidential DocumentPage 37 Questions? Dr. Larry Ponemon Ponemon Institute LLC Tel: Toll Free: New Michigan HQ: 2308 US 31 N. Traverse City, MI