Reported UK data breaches top 350 in past year

Tip of the iceberg

This news exposes the extent to which data loss has come to. With another two high profile breaches this week the security industry is taking yet another hammering by the press and each organisation?s customers by failing to adequately protect private records. It?s the tip of the iceberg as to the problem though - we?re more concerned about the number of breaches going unnoticed and unreported! At least these organisations acknowledged the breaches ? many companies don?t even monitor for or can?t detect such losses. Databases are always going to attract security attacks ? especially for identity theft given the type of information they hold. There?s a huge black market out there for personal data - bank account details sell for 5-10% of the account value and credit card data can sell for up to £30 per account. Take this and multiply by the 51,000 records at Zurich or the data for the 0.5 million CV?s at The Guardian, and whoever did this would have a pretty nice payday. It?s widely recognised that 100% prevention of these types of violations is very difficult, but organisations need to be even more vigilant in managing processes and procedures for protecting sensitive data and also monitoring access rights (and keeping on top of it ? a policy is great, but only if you maintain it!). They need to consider threats and attacks from both internal and external threats and protect all data copies, locations and platforms. It should be actionable in real-time to detect, alert and prevent. The need to preserve the confidentiality and integrity of data and monitor privileged user activity is driving CIOs and auditors to re-consider their strategy for database security and impose stringent controls across database systems. It?s critical they implement a workable, secure solution and that they not only act upon it, but that they maintain processes and stay up-to-date with patches and controls. Compliance demands it and the public expect it. Guy Churchward, CEO, LogLogic

Posted by: Guy Churchward, CEO, LogLogic 27 Oct 2009