May 2008

When a breach compromises employee or customer data, it can devastate the life of these victims for years to come. The effects of a Social Security number being stolen, for instance, can have lasting consequences. There are those that use an unauthorized SSN to get a job, and then there are those who use it to assume the identity of another person to commit fraud, which can ruin a victim’s credit or put them into debt. But even if it is used for jobs only, it can affect the victim’s SSN benefits when needed later in life. A recent article called Two Lives, One Social Security Number recounts the struggle of one victim’s experience when discovering while opening her new 401(k) statement that there was another name on it.

The consensus of most companies that fail to protect identifiable information is that they will be exempt from prosecution and will not have to account for their negligence unless the victims can prove they suffered loss or harm from the breach. But recently, the FTC has declared that common sense will prevail over technical legal arguments when it comes to governmental sanctions, as they did with the ValueClick settlement ruling. They concluded “that enterprises could be found negligent for promising to protect user data but subsequently failing to implement the security precautions required to meet those

In essence, more companies are being sued and can be held liable for “things their IT departments didn’t do, alleging that the IT security department’s negligence led to a hack” as indicated in Davidson Cos. Sued for Negligence in Data Breach. This article calls for security pros to take heed. “If you don’t do your job, you may not only be fired — you may end up in court.” It’s coming to the realization that either companies develop an ongoing security program including assessments, or the FTC may mandate they obtain independent third-party assessments of their programs for 20 years, as they did with ValueClick.

Breaches are personal and companies should not have a cavalier attitude that their information is secure when no assessment or security audit has been conducted for years. How do you know your systems are secure? One has to wonder if all the breaches we hear in the news had management who felt their business and infrastructure was secure. We say kudos to those companies who care about the personal information of their employees and customers by conducting security reviews and confirming their remediation efforts afterwards.

Don’t gamble with the security of your customer data. Call NCX Group now for a free consultation on how our experts can help you secure your data at a price that will fit your budget. Call us today at 888-448-5451 for an appointment or request a representative to call you.

NCX Group, Inc. is a leading information risk management firm specializing in the assessment and mitigation of risk associated with today’s technologies and business processes.