Secure Value

Forget customer privacy for a moment ... are you protecting your key business information?

With so much focus these days on data privacy and individual identities much of the conversation within the security community and from the security community to the business community skips over other critical information types that need to be protected.

This is a list of information that you should also work to protect:

1.    Information about your systems and networks.  When I backpack I don't do very well if I have to go off trail and I don't have a map.  The same is true for someone trying to break into your information systems.  If you fail to protect the information describing your systems and networks (network maps, configuration files, etc.) then you may just be providing a map to someone who wants to explore your network and find more valuable information.  Are you making your network an outside explorers paradise?

2.    Your company's secret sauce.  You may not have a secret sauce made of "11 herbs and spices". Or your business may not depend on the mysteries of an ancient chinese secret (Remember the Calgon commercials?) but all of us in small business have our secret sauces.  For Jacadis, it is the unique way we deliver many of our services.  For a printing client of mine, it is the unique steps that they have created to protect confidential data transmitted to them from larger customers.  That process has helped them win business because other printers aren't doing it.  Years ago we did work for a company that made a unique material used in the florist business.  They were the only company in the world that could produce the material at quantity and had factories world wide that did it.  Their key asset was the chemical formula and process to produce that material.  Are you protecting your secret sauces?

3.  Intellectual property, according to wikipedia, refers "to a number of distinct types of creations of the mind for which a set of exclusive rights are recognized—and the corresponding fields of law.   Under intellectual property law, owners are granted certain exclusive rights to a variety of intangible assets, such as musical, literary, and artistic works; discoveries and inventions; and words, phrases, symbols, and designs. Common types of intellectual property include copyrights, trademarks, patents, industrial design rights and trade secrets in some jurisdictions."  To maintain those rights you need to actively assert those rights, which as I understand it from my friends in the legal profession, includes protecting the digital versions of those rights.  Are you asserting your IP rights?

3.    Work.  Think of the endless hours that you spent putting together that killer sales presentation.  Should it be corrupted or removed from your computer you’ll have to redo the work.  The same is true for data entry, etc.  The work itself might not be “secret” but should you lose it you’ll really be losing time and value.  As I sit here typing most of my work is electronic collections of media (words, video, slide presentations, papers, articles, Secure-Value, jacadis.com).  For your business your work may be many other things.  My sales team would tell me that their biggest collection of work is the information they have on clients.  A friend of mine has a laser cutting business.  Unique programs are written to consistently and repeatedly cut 3D designs into different materials.  These programs are his work.  Another friend has a much lower tech manufacturing business, an old sand mold foundary.  His forms and molds breaking means he has to redo them just as my more high tech laser cutting friend would have to do should those laser programs get lost or corrupted.  In the end the loss of work means the loss of time or information.  You'll have to invest time to recreate the information.  In some cases you may not be able to recreate it.  Are you protecting your work?

4.    Personal information about your executives, leaders and key employees.  Again, to explore something you need a map.  To attack a target you need a map.  Freely and without thought sharing personal information on your executives, leaders and key employees may just be providing a map.  This is a tricky subject though.  I won't do business with a company if I can't see some information about its ownership.  Most people do business with people so a company that completely hides the details of their key players doesn't earn my trust.  Likewise, though, a firm that freely shares contact information, addresses, personal information, etc. about its members opens itself up.  On a simple level, executive emails sprinkled all over a web site invite spam.  On a more complicated level, in some businesses, travel plans and other locational information improperly shared invites more nefarious attacks.  Are you protecting your key people? Are you protecting all of your people?

5.  Personal, though non-protected, information about your customers and prospects.  Again, protect the map.  Customer lists, detailed information about your customer's pains and challenges, and the other sort of information that fuels a personal realationship between your business and your clients should be protected regardless of whether or not the informaiton is consdiered private, confidential or in some way protected by law or regulation.  Protecting your customers information promotes trust.  Are you promoting trust with your customers?

What types of information that must be protected did I miss?

Related articles

• Do Not Tell Anyone: An Overview of Non-Disclosure Agreements (dunnerlawblog.com)
• Intellectual property 'cannot be ignored with green products' (premierlinedirect.co.uk)

Epsilon Aftermath Will Expand Seriousness of 3rd Party Verification for Suppliers -- Is your firm ready?

Jacadis helps businesses prepare and respond to security questionnaires and audit requests from their usually larger customers.  We also are the audit and assessment team for some firms who choose to use external resources to review their key vendors' security.

Frankly, as breaches Epsilon isn't a big of deal.    No protected information, just names and email addresses were taken.  And more sophisticated attacks have come and gone in the press largely unnoticed. 

Epsilon has received more attention than the more impactful breaches in part because it touched so many people.  Non techies are talking about it.  We believe that buzz is going to find its way into the executive suites and audit teams of big companies and boost the rigor and frequency with which larger firms test, prod, and assess their supply partners.

In fact it isn't just us that thinks that.  The Wall Street Journal reported in Insulating Your Firm from Third Party Breaches that:

Experts suggest that companies that outsource technology services take some of the following steps:

• Make sure the vendor has a recognized certification for information security, such as ISO 27001 or SAS 70 Type 2, granted by an accredited auditing organization such as the International Standards Organization;
• Sign agreements that oblige vendors to undergo regular audits by third parties, at least annually. Auditors should test software (especially software that can be accessed via the Internet) and hardware as well as people, to ensure that vendors’ employees themselves don’t fall prey to scams;
• Make sure vendors assume liability for breaches that affect customers and end users; and
• Make contingency plans with the vendor so that neither is caught by surprise in the event of a security breach.

Management consultants and corporate governance experts are providing similar advice to their Fortune 2000 and similarly sized customers.  These recommendations have been around for several years, however, the buzz from Epsilon has the potential to fuel the recommendations to reality.

This will impact you if you answer yes to any of the questions below:

• Your business is part of the supply or services chain for larger regulated firms.  We see most of the third party verification activity from firms that have regulatory obligations to HIPAA; PCI, GLBA or other financial privacy rules, or Sarbanes-Oxley.  We have seen these type of firms apply the highest security and privacy standards to their vendors even if their vendors don’t process confidential or protected information.  Do you provide services to these types of firms?
• Your business provides a service that includes considerably volatile information.  If, for instance, you process non-protected personal information but it is somehow seen as critical to your client’s business or it’s relationship with its customers this might apply.  Or, if, for another instance, you process company confidential information such as trade secret related information.  Do you provide services to these types of firms?
• Firms in the supply chain stack.  You may not be doing business with a regulated firm, but you may be providing services to firms that provide goods or services to firms that provide services to regulated businesses.  You know what they say about it rolling downhill.   Are you at the bottom of a supply chain?

Take action

If you answered yes to any of those questions we suggest the following:

1.  Look at your customer agreements with firms in the categories above. 

• Do any of those agreements place obligations on your company to protect your client’s information in a certain way? 
• Do they have the right to audit? 
• Have you told your IT team about these obligations? 
• Are you prepared to meet these obligations?

2.  Sit down with your technical leadership and discuss:

• Are we secure? Vulnerable? Do we follow a best practices approach to information security? Which one?
• Do we routinely check through tests, assessments, and/or audits our answers to the questions above?
• If we got an auditing letter from an existing customer would we be ready for the audit in a week? a month? 3 months? 
• When the auditor arrives do we have documentation that defines our security programs values (policies), details the routines we follow to meet those values (processes), shows that those routines are being followed (logs, action reports, scorecards, etc.) and that our staff is aware of their obligations (awareness training)?
• If we committed during the sales process with a new customer to do certain things to secure their data did IT and the others in the company responsible for delivering on that obligation have a hand in the answer? Are we overcommitting?
• Are we managing security well enough that we can create a competitive advantage over other firms in our class?  Can we use that advantage to build new business?

If your business provides business to regulated businesses upstream in your market we recommend you keep asking these questions until you feel comfortable with the answers.

 

Related articles

• Favorite Epsilon Hack Articles (secure-value.com)
• Aftermath of Epsilon Hack ... More FUD on Horizon, Third Party Verification Gets Boost, Confirm You Have Strong Passwords ... (secure-value.com)
• Hit By the Epsilon Security Breach? Here's How to Protect Your Personal Information (dailyfinance.com)
• Insulating Your Firm from Third-Party Breaches (blogs.wsj.com)
• Krebs on Security: Epsilon Breach Raises Specter of Spear Phishing (boxofmeat.net)
• Who is Epsilon and why do they have my data? (news.cnet.com)

Show B2B Customers Your Firm is Trusted - Win Business!

Does your business process customer data? Show your business to business customers that your firm handles their information in a secure fashion and you may win new business.

Jacadis works with emerging firms (those in start up mode or those in high growth arcs) that suddenly find themselves with information security and privacy concerns.  Usually, they have been so focused on building business features and functions that security has been an afterthought.  Customers raise concerns about how information is handled, many times because the customer is regulated and is expecting our client to properly handle their data.  By the time Jacadis gets involved these concerns are creating barriers to new markets or have become minimum requirements to win new business or retain existing business. 

Our mantra is that if you can show yourcustomers, particularly your regulated business-to-business customers you operate in a manner that you can be trusted you have the potential to create competitive advantage and win new business.

And it is true.

Yesterday, we got word from a client that our efforts in implementing a security program for them had translated into a higher level trusted relationship with a key client AND a new $200,000 order.  The joy the sales manager had in telling me reminded me of the excitement my 8-year old has when he comes home from a great day at school.

Being secure does create competitive advantage.

Do you have those same concerns?

One tool we used was QualysGuard.  We used it to measure the vulnerabilities (fancy security jargon word meaning weaknesses) to attack that their technical infrastructure.  We used it initially to create a prioritized list of corrective steps for our client to take and now use it to maintain the current security levels and show the client's customers they are attending to security properly. 

You can test your network on your own with Qualys' free scan.

Jacadis HIPAA Workshop Candidate for Columbus Innovation Award

Jacadis’ Facilitated HIPAA/HITECH Impact Assessment Workshop has been nominated for the Columbus Innovation Awards Outstanding Service Award for a company with less than 50 employees.

What is the workshop?

In a nutshell one of our HIPAA experts join a selected team of individuals from your organization for a rapid assessment of where your organization stands against its obligation to meet HIPAA and HITECH.  We bring the HIPAA expertise, you bring expertise in how you protect and handle health information within your organization. Together we create a scorecard and a roadmap for what needs to be done to reach compliance.

We created the workshop because -- even though we offer a set of services and safeguards that would solve almost any HIPPA regulated organization's compliance challenge -- most of our sales conversations around the HIPAA topic were starting with an "I don't know enough ... " in the client's introductory paragraph.

Detailed Workshop Description

The purpose of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 was to improve the efficiency and effectiveness of the US health care system. Much of the improvements were based on the standardization of electronic transactions. HIPAA also included provisions to protect the privacy and security of medical information, due to the increased exposure of electronic medical records to data theft and accidental disclosure.

In February 2009, Congress amended HIPAA with the Health Information Technology for Economic and Clinical Health (HITECH) Act. Incentives to invest in projects like Electronic Health Records (EHR) were paired with more stringent requirements, including breach notification for covered entities, business associates, and vendors of personal health records.

Many organizations have requirements to protect the privacy and security of the Personal Health Information (PHI) entrusted to them. These same organizations do not have an understanding of how HIPAA and HITECH affect their business and personal risk. Such lack of awareness is dangerous, in light of the criminal provisions for neglect included in HITECH.

In this one day workshop, Jacadis aligns your compliance, security, and information technology teams around HIPAA and HITECH. Through facilitated discussion, we compare your organization’s current practices against the regulations, equipping you with the tactical and strategic information needed for compliance.

Upon Completion:

• Working knowledge of information security and privacy basics
• Working knowledge of HIPAA and HITECH rules and regulations
• Working knowledge of the HIPAA Security Assessment (HSA) Tool™
• A gap assessment of your organization’s HIPAA privacy practices
• A gap assessment of your organization’s HIPAA security practices

Who should attend?

• Assigned and named Security Officer, Privacy Officer
• Practice Administrators, Legal Counsel, Compliance Officers, Human Resources
• Security Officers, Privacy Officers, Internal Auditors
• Corporate Security Architects, Security Engineers, & Security Analysts

Jacadis has always been a consulting firm that teaches our clients to fish so our workshop covers the learning areas that we see lacking in those we are trying to help so they can help themselves over time:

Module 1: HIPAA and HITECH overview and review

• Trends related to HIPAA and HITECH
• Compliance Challenges
• Implementation Deadlines
• Enforcement
• Penalties

Module 2: Information Security and Privacy Principles

• Are Computer Threats Real?
• Information Security 101: Defining Security
• Confidentiality, Integrity and Availability (CIA)
• Risks, Threats, Vulnerabilities
• Safeguards
• Security / Privacy Definition and Terminology
• Basic Security Principals

Module 3: HIPAA Security Rule

• Safeguard Review
• Administrative Safeguards
• Physical Safeguards
• Technical Safeguards
• Policies, Procedures and Documentation Requirements 
• Facilitated Security Self Assessment

In the workshops we've done to date there have been moments where the process of doing the facilitated self-assessment brings a moment of clarity to the table.  Management thought something was being done.  The PO or SO says, sure we have the policy, but you didn't fund the safeguard, so we aren't compliant with HIPAA or our own policy. 

As you may know, I'm a huge advocate for a management level information security steering committee.  These gaps in knowledge and gaps in understanding that ultimately feed a gap in compliance only get cleared up when those that are responsible for security and privacy from funders to doers can learn and coordinate in a regular fashion. 

We are finding that our workshop is a clear step in helping create the foundation for that ongoing focused committee structure.

Ask yourself these questions:

• Does your firm work with employee or customer health information?
• Do you provide services to firms in the health care industry or to firms that provide services to the health care industry?
• Are you aware of your compliance obligations to HIPAA and HITECH?
• Are you aware of the costs of not being compliant?
• Do you have a working security steering committee? Is it functioning to help you build understanding of security’s and privacy’s importance to your business and/or to your customer(s)?
• Is that understanding translating into a more secure organization? Into an organization more able to meet the security and privacy expectations of your market in a way that creates competitive advantage?

 

Data breach reporting sites useful for entrepreneurs whose businesses work with protected data

When I am working with enterpreneurs who provide services into markets that have protected data I am often asked "Where can I go to see a list of data breaches?"

Reviewing reported data breaches can provide a lot of value if you are in a business that handles protected or highly confidential data.

1.  Lessons can be learned from other's mistakes.  Look into the details of breach announcements and ask yourself "could this happen to us?" and "how would we respond if this happened to us?"

2.  If you outsource to the Cloud, to a business services provider or in some other way share data you are obligated to protect it is good to use these lists to make sure you don't have a vendor with data protection problems.

3.  Breach types tend to repeat in certain industries.  If you are in health care for instance loss and theft, primarily of physical assets, abound.  If you control physical assets in the health market what are you doing to protect them?  Others in your vertical are having challenges maintaining control of them.  Do you have those same challenges?

4.  Finally, I am a big believer that firms that provide services into regulated markets like health care, retail and publicly traded firms can create a competitive advantage if they treat security as a service to be provided to their customer.

Here are 3 lists we use:

The Privacy Rights Clearinghouse Chronology of Data Breaches

Health and Human  Services "Wall of Shame" reporting and documenting Breaches Affecting 500 or More Individuals which is required by the HITECH Act.

A well done blog DataBreaches.net

Have you found another data breach reporting site that I should include?

Evaluate Your Company's HIPAA & HITECH Compliance Quickly with Expert Help

HITECH (known also by the mouthful Health Information Technology for Economic and Clinical Health Act) signed into law in February, 2009, changed the information security and privacy landscape in health care in two important ways. 

First, it broadened the scope of the HIPAA rules, including business associates or those that provides services to health care covered entities on the hook for compliance with HIPAA. 

Second, it included enforcement provisions including breach notification, mandatory audits and criminal penalties in an attempt to put teeth into the HIPAA tiger.

As Health and Human Services has proposed and written into rule various rule sets implementing the law our conversations with those who previously thought they were compliant with HIPAA and those newly required to be compliant have expanded.

We have found two common cases in the market:

1. A firm embraced the original compliance dates in 2003-2005, developed a policy based HIPAA security and privacy program and then “put it on the shelf”.  Those programs are out of date and because they include policies and procedures that are not being followed are high risk.
2.  Business associates, who provide products and services into the health care market, know they are not compliant and have no idea where to start.  Many of these firms have a real issue in that they must show compliance or bind themselves legally to it to keep and gain customers.

It is no wonder that either case presents an issue.

Since 2005 most firms have dealt with a number of external and internal changes while not constantly reevaluating their compliance with HIPAA or their information security program.

These changes include, but are not limited to:

1)    regulatory changes (e.g., The HITECH Act as well as numerous state level data protection laws)
2)    business growth or decline
3)    uncertain economy
4)    geographic expansion;
5)     personnel changes;
6)    increased penalties and sanctions; and,
7)     technology changes. 

If a company was compliant in 2006 based on a security program built for HIPAA compliance in 2005, most likely they have drifted into a state of non-compliance by 2009.  HITECH amends the rules.  That company is likely now far off the mark in an environment where liabilities are increased and personal for the company’s leadership.

If a company is new to HIPAA compliance, particularly those small businesses that serve the health care market but run lean and mean, they don’t know where to start their compliance program or how to do it affordably.

In either case firms need to assess quickly their information security and privacy program  to  have various aspects of your program audited/assessed in order to determine whether your administrative, physical and technical safeguards are reasonable and appropriate as required by the HIPAA Privacy and Security Rules, as amended by the HITECH Act.

In response to these dynamics we’ve built a collaborative workshop that puts the key business and technical leadership into a room to address the questions and uncertainties of HIPAA and HITECH compliance.

Based on our successful experience with other clients, including several in the long-term care industry, we believe our collaborative, education-based and results-oriented process will delivers a great amount of value in a short period of time.

Our HIPAA-HITECH Security Assessment WorkShop™ is a high-value, high-impact two-day engagement that meets customer needs including, but not limited to:

•    Reevaluating your organization’s compliance status
•    Jump-starting your program
•    Revitalizing your efforts
•    Updating your program with HITECH Requirements
•    Developing an internal benchmark score
•    Establishing an executive compliance dashboard
•    Evaluating current safeguards
•    Identifying gaps and new safeguards to implement

Upon Completion, You and Your Team Can Expect These Outcomes:

•    Working Knowledge Of Security And Privacy Basics
•    Working Knowledge Of HIPAA And HITECH Regulations
•    Jump Start Your HIPAA-HITECH Compliance Program
•    Compliance Indicator Benchmark Score
•    Gap Analysis of HIPAA Security practices
•    Gap Analysis of HIPAA Privacy practices
•    “Low Hanging” Remediation Items and Action Plan
•    Solid Foundation for Completing HIPAA Risk Analysis

Executive Dashboard on HIPAA Security – One of the Deliverables:

 

Clients have successfully used the dashboard as a baseline for the beginning or revitalizeation of their HIPAA information security and privacy program.  They have used it to communicate to customers and prospects where they stand.  They have used it internally to prioritize work on missing components.

Included with the workshop is the the HIPAA Security Assessment ToolKit™, which gives each firm, post workshop, to continue to track their complianace efforts.

Twitter FTC Settlement ... What Lessons Does it Have for Your Firm?

Image via Wikipedia

The Federal Trade Commission (FTC) announced yesterday Twitter's settlement against charges that Twitter "deceived consumers and put their privacy at risk by failing to safeguard their personal information."

In a non-technical pedestrian manner David Vladeck, Director of the FTC’s Bureau of Consumer Protection boils it down in this quote on the FTC site:

“When a company promises consumers that their personal information is secure, it must live up to that promise.  Likewise, a company that allows consumers to designate their information as private must use reasonable security to uphold such designations."

Twitter was hacked twice, once in January, 2009 and again that same year in April. And during that time period Twitter's privacy policy stated that:

"Twitter is very concerned about safeguarding the confidentiality of your personally identifiable information. We employ administrative, physical, and electronic measures designed to protect your information from unauthorized access.”

Twitter had borrowed some of the language from another firm's privacy statement (how did your privacy statement get written?).

The FTC acted under Section 5 of the FTC Act which gives them the power to hold firms accountable for "unfair and deceptive" practices.  The deception here is that Twitter publicly proclaimed it did something that in fact it did not do.

There were no monetary fines levied.  According to legal friends of mine this is due to the fact that Section 5 of the FTC Act does not grant the FTC the power to levy fines or penalties.

Again, according to the FTC:

"...Twitter was vulnerable to these attacks because it failed to prevent unauthorized administrative control of its system, including reasonable steps to:

• require employees to use hard-to-guess administrative passwords that they did not use for other programs, websites, or networks;
• prohibit employees from storing administrative passwords in plain text within their personal e-mail accounts;
• suspend or disable administrative passwords after a reasonable number of unsuccessful login attempts;
• provide an administrative login webpage that is made known only to authorized persons and is separate from the login page for users;
• enforce periodic changes of administrative passwords, for example, by setting them to expire every 90 days;
• restrict access to administrative controls to employees whose jobs required it; and
• impose other reasonable restrictions on administrative access, such as by restricting access to specified IP addresses.

Under the terms of the settlement, Twitter will be barred for 20 years from misleading consumers about the extent to which it protects the security, privacy, and confidentiality of nonpublic consumer information, including the measures it takes to prevent unauthorized access to nonpublic information and honor the privacy choices made by consumers. The company also must establish and maintain a comprehensive information security program, which will be assessed by an independent auditor every other year for 10 years."

Again, according to my legal friends that means that Twitter is now in a spot that should they fail to fulfill their part of the settlement the FTC may find them in contempt of the settlement which then would permit the FTC to levy fines and penalties.

There is plenty of debate in the security blogosphere discussing whether or not the FTC "went too far" or was legislating by regulation. 

For me the important element of the case is the lesson for other growing and emerging businesses.

Twitter has grown more rapidly than they could have known when they started up.  As the subscriber based sky rocketed, however, the start up culture that is more feature focused than formal process focused carried onward.  One of the hacks was because a dictionary word, easily guessed, was used to protect an executives Google Applications account.  A dictionary-based password can be guessed easily especially if you know the person who owns it.  Strong passwords are the foundation of information security. If a company isn't using strong passwords we question their commitment to security.  Ultimately that lack of commitment is what got them. 

Here are some lessons to consider:

Start security and privacy planning with business and application planning and design from the beginning.  That is particularly true if your key processes involve confidential, consumer or protected information.  The cost of doing security later will be much higher because you'll have to re-engineer.  Metaphorically it is similar to adding a basement after your house is built.

Likewise, include information security, privacy and trust considerations in your culture early on.  Technology, difficult and expensive to re-engineer, is easy in comparison to restructuring a company's culture.  You can operate securely and create a loose modern team oriented culture.  Focus on the customer trust issue as a rallying point rather than the constraints you feel security places on you.

Plan for your future value from the get go.  Twitter's apparent laissez faire attitude toward information security and privacy earned them a 20 year dance with the FTC.  It also puts a mark of toxicity on their value.  If I had the money laying around to purchase Twitter would the potential of an historical lapse in security or the potential for one in the future, either of which would spawn a contempt finding and financial penalties, give me pause or give me leverage to reduce my offering price?  Understand now how a breach or poorly architecture might impact your future value and work with that in mind.

Don't cut and paste privacy statements or other statements of values or customer trust from other sites and call them your own.   Get an attorney or a privacy professional or both engaged in your developing your privacy policy.  That policy is a sign of trust for your customer now.  But poorly executed it could be a weapon used against you in the future.  And as you work on developing that policy remember it is a legal and technical document and not a marketing brochure. 

Finally, don't say things you don't mean or that you can't back up.  Be honest.  That should be true in all your business dealings as a start up or emerging firm.  Customers purchase trust.

Have you built security into your culture and technology from the start? Working on it now?

Related articles by Zemanta

• Twitter and FTC reach agreement on new security measures (newstatesman.com)
• Twitter Settles F.T.C. Charges Over Privacy (nytimes.com)
• Twitter settles privacy charges (theglobeandmail.com)
• Twitter Gets FTC's Attention on Privacy Concerns (marketingpilgrim.com)
• Twitter settles privacy case with the FTC (v3.co.uk)
• Twitter settles over security charges (cbc.ca)
• Twitter Settles FTC Complaint (techdailydose.nationaljournal.com)
• Twitter settles security inquiry (boston.com)
• Twitter settles FTC charge on security, privacy violations (Cecilia Kang/Post Tech) (techmeme.com)
• FTC Forces Twitter to Shape Up Security (foxnews.com)
• Twitter settles with FTC over data security lapses (sfgate.com)
• Twitter settles with FTC over data security lapses (washingtontimes.com)
• Twitter Settles Charges that it Failed to Protect Consumers' Personal Information; Company Will Establish Independently Audited Information Security Program (ftc.gov)
• Twitter settles privacy charges with U.S. (financialpost.com)
• Twitter, FTC Settle Over Security Breaches (abcnews.go.com)

Are you finding larger customers are increasingly asking questions about your information security and privacy practices?

Image via Wikipedia

Are you finding larger customers are increasingly asking questions about your information security and privacy practices?

Yesterday, we met with a client that provides services to a horizontal business portfolio including firms serving a diverse set of vertical markets.  Many of these markets have regulated information privacy and security practices at the local, state and/ or federal level as well as through contractual obligations with suppliers and customers. 

As a service provider our client is being asked on a customer to customer basis to show compliance with this myriad of regulations.  With each customer request comes a different state law, a different federal regulation, and a new pile of letters in the alphabet soup.

As my client exclaimed, "The volume of these questions just keeps growing. And most of the time they are asking questions that don't even pertain to what we do for their company."

The volume of requests is climbing because larger, regulated businesses through simple prioritization, have realized that now that they have their own houses in order (sorta, somewhat) their greatest risks lie in the information handling of their information by vendors, partners and other third parties.

They are asking questions that don’t pertain to my client because the audit and security teams know how to ask questions to secure the information in their business.  Given the volume of vendors, partners and other third parties they must address they don’t have time to move far off the path they are used to or to get creative.

So you get some strange requests that require a valuable company staff member to answer questions to prove something that really shouldn’t need proving.  Some other examples from my client base:

• A design firm dealing in product design is asked to show how they protect protected health information under HIPAA from their insurance company client even though they don’t maintain health records.  It is what their customer expects to build trust.
• A collections network is asked to show how they maintain the privacy of collections records under Graham Leech Bliley even though what they do has been vetted by an attorney not to be covered by GLBA.  It is what their customer expects to build trust.
• A Software as a Service application publisher is required to prove they manage their network to conform to the Payment Card Industry’s Data Security Standard even though – you’ve guessed it by now – they don’t take credit card data.  It is what their customer expects to build trust.

Customers expect their vendors to treat their information as if it your own.  Call it stewardship.  Prospective customers are going to probe for your ability to be a good steward as they explore your operations through the RFP process or through Q&A during the sales process.  Customers are then going to probe for continuity of that good steward's stance as auditors ask for information that shows you are doing things their way.

• Failing the questions during the prospects presales process will cost you a sale or make that sales win that much harder to earn.
• Failing during the audit stage will cost you a customer and depending on how you fail (as in the case of a breach driven post incident audit) may cost more.

How do you represent yourself as a good steward when multiple customers are asking for different things?

Given the increasing volume of requests covering multiple compliance constructs my company, Jacadis, recommends creating an internal information security, privacy and business continuity organization (committee, team or whatever you might call it) using the ISO 27000: Information Security Management Model. The model, an internationally recognized standard in the information security field, provides a framework from which to evaluate and/or organize an Information Security Program.
  
The team then focuses on the most likely risks facing the company balancing your own information security, privacy and business continuity concerns as well as those of customers and prospective customers.

The committee, properly assembled, organized and managed, can then anticipate customer needs, respond to them more cost effectively and more efficiently and in most cases we’ve seen create a competitive advantage for the company.  It is likely your competitors are dealing with the same issues.  The ISO based committee structure gives you a tool to do it better, cheaper, faster.
 
How do you handle customer requests to “prove” your information security, privacy and business continuity plans? Are they just asking? Or would wrong answers .. not having a program … tarnish the relationship?

Facebook is making privacy changes, if it was your business would you?

Image via CrunchBase

Faced with vocal and public customer complaints how would you respond if you were jeopardizing customer privacy?  Faced with customer silence on the topic would you change your practices if you knew you were jeopardizing customer privacy?

After consumer outcry that created a press and blogosphere frenzy, Facebook announced changes to its privacy stance this week.  As summarized by Facebook the changes include: ... three things: a single control for your content, more powerful controls for your basic information and an easy control to turn off all applications.

In response, some are saying "too little, too late" and others that they are well done and "dead simple". 

I am not going to spend words here detailing the changes or commenting on their validity or effectiveness or advise you on a next action to take.  That's for another posting.

I wonder how my business would respond? many of my customers? you?

Now granted I wouldn't expect to be in the mess that Facebook created for themselves.  Would you?

But set aside the crazy viral success Facebook has had and the company is not any different than mine or yours.  Mark Zuckerberg's challenges are bigger, certainly, but not that much different than every other business out there.

Do something people want to buy.  Sell it to them.  Deliver it at less cost than you take in.  Enjoy the profit.  Innovate to make sure you still do something people want to buy.

Somewhere along that continuum Facebook decided that to innovate and monetize they needed to expose more users information.

(NOTE:  They've claimed the privacy settings prior to this latest round of "fixes" was not motivated on making more money.  Facebook needs to make money.  They've officially said that the privacy changes (the one's before these settings) that exposed their customer base were not money motivated.  But you have to wonder.  You have to think that every day they wonder how they are going to monetize this great creature they've created.   I'm skeptical but willing to give them the benefit of the doubt that it wasn't directly a driver, but improving product happens because companies must innovate to continue customer relationships which drives monetization .)

Facebook, without consulting customers (who are us the users or their advertisers? just asking.), made chnages to the settings that expose me and my friends, you and your friends and so on. 

And your business may be in the same boat.  You need to innovate.  You need to improve service, add more value, etc.  And someone in your company comes up with a great idea to innovate your business.  A bar decides to put patron photos on its Facebook page.  A doctor decides to move scheduling online.   And so on.  You implement without thinking the implications all the way through. Or checking with your customers.

These innovations expose customer privacy.  I'm supposed to be at work but I am at your bar.  My wife sees my appointment online for my bum shoulder which I've told her is healed (honey, Valley has a game this weekend and they need me, the shoulder is fine! Think I'm playing Rugby after that?).  

Our problems are smaller than Mark Zuckerberg's and Facebooks.  And our mistakes don't invite the commentary of privacy organizations, the public ire of our customers and the attention of government regulators (ok, for most of us never, for some mostly never). 

The mistake was public and the publicity forced a change.  So Facebook had the "advantage" of being called to task publicly and being given an opportunity to fix the problem. 

In my smaller world .. in your smaller world .... mistakes that get made aren't going to get that kind of attention.  They just might, in fact, go unnoticed.  But they might impact individual customers in a similar fashion.  In fact, some small business privacy mistakes might impact your customer (really, the shoulder is fine!) more than Facebook's would.

If you caught your mistake and your customer's didn't produce an outcry would you care? would you change?

Have you invested the time to think through how your practices might expose customer information? Perhaps innovations you have made ....  to outsource processes, to automate transactions and ordering, to tailor marketing campaigns, to lower costs ... to solve that critical problem that is between you and more profit ...  created a privacy exposure for your customers.

If you discovered the problem would you change? 

Related articles by Zemanta

• Two cheers for Facebook's privacy reforms (blogs.ft.com)
• How To Use Facebook Privacy Controls (crenk.com)
• Facebook’s privacy changes aren’t get-out-of-jail-free card (newstatesman.com)
• Facebook To Advertisers: New Privacy Controls Immaterial [Your Privacy Is An Illusion] (gawker.com)
• Privacy groups on Facebook updates: meh (arstechnica.com)
• Facebook Not Screwing Around With Its PR Around Privacy Changes (businessinsider.com)
• Poll: Did Facebook's Privacy Changes Go Far Enough? (cbsnews.com)
• Why Facebook's Privacy War Is Not Over (mashable.com)
• Facebook has improved its privacy controls. Should we trust it not to screw up again? (slate.com)
• Facebook: Too Big to Quit? (socialmediatoday.com)
• Facebook and Privacy: It's Time to Move On [VIDEO] (mashable.com)
• 10 Things You Need To Know About Today's Facebook Privacy Changes (Nick O'Neill/All Facebook) (techmeme.com)
• Facebook simplifies privacy settings (sporkings.com)
• Facebook Emails Advertisers to Reassure Them About the Latest Privacy Changes (insidefacebook.com)
• How to Use Facebook's New Privacy Controls (abcnews.go.com)
• Navigate Facebook's new privacy paradigm (thaibrother.com)
• Silicon Alley Insider: I Don't Trust Facebook Enough To Move My Business Into It (businessinsider.com)
• New Facebook privacy settings 'a red herring', say activists (guardian.co.uk)

Secure Value by Understanding the Criminals in the Digital Neighborhood

Image by waltarrrrr via Flickr

I just got a crack at reading Deloitte’s new Center for Security and Privacy Solutions' report titled Cyber Crime: A Clear and Present Danger.  It is a quick 16 page read and worth it for any entrepreneur or emerging business innovator, CEO or COO.

We are building business in a digital world.  Knowing the neighborhood, so to speak, is important.  Along with all the good things things about the neighborhood -- effeciency, effectiveness, new markets, new products and services, collaboration -- comes new forms of crime, new scams, new ways that our business dreams can be damaged or destroyed.

My business partner at Jacadis, Simon Herring, often speaks of our efforts as cyber security and risk professionals at protecting 10-foot walls againts 11-foot ladders.  The reports key finding "Threats posed to organizations by cyber crimes have increased faster than potential victims—or cyber security professionals—can cope with them, placing targeted organizations at significant risk.

In interpreting the survey responses Deloitte reports that "cyber crime constitutes a significantly more common and larger threat than respondents recognize."Bluntly cyber criminals are innovating in the digital marketplace just like the rest of us; only their innovation is outpacing what are traditionally considered best practices.

The report in Deloitte's words "is directed toward senior leaders including CIOs, CSOs, CROs, operational risk managers, government agency budgeting and procurement professionals, and other executives and professionals with decision-making roles in the security of their organization’s IT environment and of the assets within that environment.

It is a quick 16 page read and worth it for any entrepreneur or emerging business innovator, CEO or COO.  It is worth reading for those in the IT audit profession as well.

Some trends pointed out in the report:

• Cyber attacks and security breaches are increasing in frequency and sophistication, with discovery usually occurring only after the fact, if at all.
• Cyber criminals are targeting organizations and individuals with malware and anonymization techniques that can evade current security controls.
• Current perimeter-intrusion detection, signature-based malware, and anti-virus solutions are providing little defense and are rapidly becoming obsolete—for instance, cyber criminals now use encryption technology to avoid detection.
• Cyber criminals are leveraging innovation at a pace which many target organizations and security vendors cannot possibly match.
• Effective deterrents to cyber crime are not known, available, or accessible to many practitioners, many of whom underestimate the scope and severity of the problem.
• There is a likely nexus between cyber crime and a variety of other threats including terrorism, industrial espionage, and foreign intelligence services.

Or more simply put.  You lock your office, warehouse, storage, retail, etc. facility because leaving the door open would invite a criminal. 

Do you lock your digital doors?

Does your business design, operation, IT infrastructure invite criminals?

The report can be found at: http://www.cio.com/documents/whitepapers/CyberCrime.pdf.

Related articles by Zemanta

• Cybercrimes Are Becoming A Serious Threat (techstartups.com)
• 2010 CyberSecurity Watch Survey: Cybercrime Increasing Faster Than Some Company Defenses (eon.businesswire.com)
• Cyber attacks cost businesses an 'average of £1.2 million' a year (telegraph.co.uk)
• Report: Companies unprepared for cybercrime (news.cnet.com)
• The "Unstoppable" Growth of Internet Crime (pindebit.blogspot.com)