Data breach issues can’t be solved by IT departments alone

Dave Jevans, chairman of IronKey and the Anti Phishing Working Group, looks at why locking down internal systems is not enough to combat sophisticated cyber criminals.

Although the threat from cyber criminals has existed for decades, the sheer volume of successful attacks on high profile brands during the last six months has highlighted an urgent need to protect against data breaches.

Having read a recent Gartner blog which stated that many of the of the IT security improvements they’ve seen over the past five years are fast becoming obsolete in the face of more sophisticated cyber attacks, turning the tables on the bad guys won’t be easy.

Free Webinar: Tips for Making Office Managers’ Job Easier

We are happy to invite you to our next Free Webinar on September 15

Join our next free webinar on Thursday and learn how to make the best decisions for managing your company’s information. Get answers to the following questions:

1. Should I scan or should I store my files? 
2. Where should I store, on-site or off-site? 
3. How to prevent data loss? 

This webinar will last 15 min and will be hosted by Steven Goodacre from Datasafe Storage Ltd.
Title: Tips for making Office Managers’ job easier
Date: Thursday, September 15, 2011
Time: 11:00 AM – 11:15 AM BST

After registering you will receive a confirmation email containing information about joining the Webinar.
System Requirements
PC-based attendees
Required: Windows® 7, Vista, XP or 2003 Server

Macintosh®-based attendees
Required: Mac OS® X 10.5 or newer

Space is limited.
Reserve your Webinar seat now at:
https://www3.gotomeeting.com/register/465997726

Data breaches – to prepare or not to prepare? The answer is simple.

All data breaches have two things in common: the need for prompt resolution and the need for a robust preparedness plan. Healthcare institutions especially should heed the call for an incident response plan because it provides the best preventive medicine to minimize financial and reputational risks.  So PLAN, keeping in mind:  People, the Law, and Action, with No time to waste.

People – Define the responsibilities of a coordinated incident response team. Don’t act alone. A good response team should include key internal players (In-house Counsel, IT, Compliance/Security, HR and Public Relations), as well as outside experts who confront data breaches on a regular basis (trusted Attorneys, Forensic Analysts and Fraud Monitors). These external experts can help restore key business functions, preserve crucial forensic evidence, strengthen data security, address victims’ needs, and communicate effectively with regulators and the public.

Digital Agenda: Commission consults on practical rules for notifying personal data breaches

Brussels – The views of telecoms operators, Internet service providers, Member States, national data protection authorities consumer organisations and other interested parties are being sought by the European Commission on whether additional practical rules are needed to make sure that personal data breaches are notified in a consistent way across the EU. The revised ePrivacy Directive (2009/136/EC), which entered into force on 25 May 2011 as part of a package of new EU telecoms rules, requires operators and Internet service providers to inform, without undue delay, national authorities and their customers about breaches of personal data that they hold (see IP/11/622 and MEMO/11/320). The Commission wants to gather input based on existing practice and initial experience with the new telecoms rules and may then propose additional practical rules to make clear when breaches should be reported, the procedures for doing so, and the formats that should be used. Contributions to the consultation are welcome until 9th September 2011.

EU ready to fight Microsoft on access to cloud data

European Parliament members are up in arms after a recent admission by Microsoft that they may be required by the Patriot Act to secretly give U.S. authorities access to European data stored in Microsoft’s cloud.  The controversy stems from the EU’s Data Protection Directive, which dictates that companies must notify users if/when their data is handed over to another party.  If Microsoft is forced to follow Patriot Act guidelines, then that would mean the U.S. law would trump European law.  Some parliamentarians have taken up the cause to prevent that from happening.

Nine out of 10 businesses breached in the last year

Ninety percent of organizations have sustained at least one data breach in the past year, according to a survey released Wednesday by the Ponemon Institute and Juniper Networks.

Even worse, the survey of 583 U.S. IT and IT security practitioners found that a majority of organizations have experienced multiple successful attacks against their networks.

Data Breach Threat to Businesses Rises to Statistical Certainty: Survey

The latest Ponemon Institute study called the chances of an organization being hacked in a 12-month period a “statistical certainty.”

Cyber-attacks are becoming more frequent and severe with the vast majority of businesses suffering as least one data breach in the past year, according to a new Ponemon Institute survey.

Data Breaches Bring Back Failed Legislation From the Dead

Sen. Leahy and Rep. Bono Mack are pushing separate bills that would punish slow disclosure of data breaches. Versions of both bills failed earlier.

By John Adams

Public fallout from the data breaches that have affected Citigroup and other large enterprises in and out of finance in recent weeks has reached the political push back stage, with both Sen. Patrick Leahy (D-Vt.) and Rep. Mary Bono Mack (R-Calif.) hoping the events will breathe new life into data protection legislation that’s failed in the past.

What will new EU data breach rules mean for business?

Posted by Cath Everett

What can businesses expect from the European Commission’s much tougher data breach rules?

It has been announced that the European Union is planning to make it mandatory for all businesses in the region to notify customers should the security of their personal information be breached.

As part of plans to update EU data protection legislation that was first introduced in 1995, European Union justice commissioner Viviane Reding said that she was also considering whether to include an “accountability principle” to protect the privacy of cloud computing users as well as a “right to be forgotten”. Reding told the British Bankers’ Association’s Data Protection and Privacy Conference in London on Monday that the aim in streamlining existing data breach rules across different member states was to simplify the current regulatory environment and reduce the admin burden on companies.

Sega says 1.3 million affected by data breach

by Mark Raby

The hack that took down Sega’s online gaming service late last week has affected 1.3 million customers.

That was one of the details confirmed by the publisher on Sunday.

As TG Daily reported on Friday, a cyber attack on the publisher’s Sega Pass service – a subscription-based feature that allows gamers to play unlimited Sega games online – forced the service to be shut down.

“We have identified that a subset of SEGA Pass members emails addresses, dates of birth and encrypted passwords were obtained. To stress, none of the passwords obtained were stored in plain text. Please note that no personal payment information was stored by SEGA as we use external payment providers, meaning your payment details were not at risk from this intrusion,” Sega wrote in an e-mail to its customers.