In the aftermath of the killing in Ferguson, MO, three police officers – none of whom are from the Ferguson police department – were suspended after blatantly racist and extremist comments and unacceptable behavior. A Rock Island, IL sheriff recently pled guilty to cyberstalking and resigned.
Do you think that, given an opportunity, these local law enforcement officers and others of their ilk would use information gleaned from your cell phone in a responsible manner? Would they respect information privacy?
Local law enforcement does have the opportunity. In September, news broke that owners of encrypted cell phones had identified 19 fake cell phone towers in various parts of the United States; it wasn’t long before the towers were connected to the NSA, as well as local, regional and state law enforcement.
This enables something as simple as tracking a user’s location or as potentially sinister as so-called “Man in the Middle” attacks where calls and texts can be heard or read before being forwarded on to a legitimate cell tower and the intended recipient. Is this a violation of physical security or cybersecurity? Or both?
Do you trust your local law enforcement to protect your information privacy? How many police officers or sheriff’s deputies are trained to understand these limits? In Florida a local police department used cell phone location information to conduct a search without a warrant. What else can and will they do? What have they done?
And what does this do to our expectations of information privacy?
“Google Says Not to Worry About 5 Million ‘Gmail Passwords’ Leaked” So said a headline on forbes.com. If you have a gmail account, were you at all concerned that your email address and password was among the 5 million? Of course you were.
Continued data breaches are a cybersecurity headache. They’re also a major public relations nightmare. Telling your customers not to worry doesn’t sound like a good strategy.
So far no one is saying how the Russian Bitcoin security forum actually got the gmail addresses paired with the passwords. Some speculate that, instead of a gmail data breach, whoever was responsible grabbed them from other sites at which gmail customers used their emails and passwords to sign in.
It’s still a public relations problem for Google. Covering various parts of your body and telling everyone not to worry only serves to make people leery. They don’t believe you and suspect your ability to handle cybersecurity and even physical security.
So, whether it’s a data breach or some other problem, most PR professionals believe honesty is the best policy. Tell people their information privacy has been violated, whether via a cybersecurity or physical security breach. Give them directions for changing their passwords. Admit you don’t know what happened, but, by golly, you’re going to find out. And apologize. For goodness sakes, apologize.
People understand apologies, especially if they are followed by a vow to find and fix the problem.
Then tell them when it’s fixed.
I have a new client, a billion-dollar service company, whose CIO is going to test my skills. He is suspicious about security and risk management, and questions everything. I should be happy, but I’m not. I should be happy because his questions mean he’s engaged – antagonistic is better than apathetic I always say. He’s willing to hear my arguments about the value security brings to the business, but he’s stubborn. How am I going to win him over? READ my answer HERE.
Most organizations have struggled for years with just cleaning and prioritizing security alerts generated from numerous point products. The value proposition for SIEM products was couched in terms of correlation and prioritization, but SIEM has only succeeded in checking a compliance box without addressing the problem of advanced persistent threats. Stopping targeted attacks in the shortest time possible is now the top priority for advanced security solutions. Read the tips HERE
Every Chief Security Officer, CISO, and risk manager I know believes that their security and risk operation has strengths and weaknesses; in some areas best practices reign supreme, and in others the blunders threaten catastrophe. If managing risk were merely a matter of crafting great policies, we’d read about very few security failures indeed. Unfortunately, managing risk and security always plays a wildcard: the security personnel. How can we ensure that our security teams are putting their best efforts toward the objectives of the department and the business?
I am a guest blogger at a number of other sites. Here is a sampling a some of my recent posts.
The greatest threat to data is also the least studied
Physical loss of information was difficult to quantify, so said the editors of the 2014 Verizon Data Breach Investigations Report (DBIR2014) that came out this month. That imprecision is why your cyber security precautions mean squat against the gargantuan physical risk you face.
The report, anxiously awaited each Spring, this year included a summary of ten years of breach data. Among the findings is a section on Physical theft and loss. The editors described physical loss of information not sexy and “cyber-y,” and the numbers about this type of information leakage a little iffy. However, they rightly point out that physical loss is among the most common causes of data loss/exposure.
In short, they claim that one of the most common types of information loss is also the least measurable. Read it here
Balanced Scorecard for Security
Security executives who’ve used the Balanced Scorecard over the years, set their IT budgets by first determining the strategic role that security will play in the organization, then established a companywide funding level that enables security programs to fulfill that objective. Since the first step in implementing a Balanced Scorecard starts with strategy, it follows that this can be an effective method for aligning security with that strategy. Read it here.
Target named its new CISO today. Brad Maiorino will fill a newly created post called senior vice president and chief information security officer. When the Target search began, I shared the comment with several other security analysts wondering who would want that job. Apparently, Mr. Maiorino, who comes from General Motors and General Electric where he held similar positions, wants it. I imagine he feels excited about the opportunity to rebuild a security program with a substantial budget and likely a wide latitude. Plus, any breaches occuring in the first six months or so could easily be blamed on the previous administration. That gives him a year of smooth sailing and liberal spending. After that, the rubber hits the road and he will be on trial more than most CISOs.