NEW RAF INTELLIGENCE AIRCRAFT ARRIVES IN UK SEVE... » As part of its Airseeker Programme, the second signals intelligence aircraft has been delivered to t... Tenkay invests six figure sum for the future » Tenkay has installed a new state-of-the-art M20 component handling machine that is expected to incre... Stop Warmongering to preserve a Fraudulent Constit... » Email: Introduction In September 2013, as public clamor intensified for a Sov... Tripwire announces Asset Discovery Solution » London, UK: Tripwire, Inc.announced the debut of Tripwire® Asset Discovery Appliances, a high-perfor... HP unveils data-centric security protection enhanc... » New enterprise data security offerings from HP Atalla and HP Security Voltage address collaboration,... Tripwire announces asset discovery solution » PORTLAND, Ore.: Tripwire, Inc., has announced the debut of Tripwire® Asset Discovery Appliances, a h... Master Locksmiths Association joins powered gate... » The Master Locksmiths Association (MLA), the UK's leading trade association for the locksmith indust... Collyer Bristow is Deploying Enterprise Resource P... » LONDON, U.K LexisNexis® Enterprise has announced that Collyer Bristow LLP, a London-based law firm s... gateprotect listed in the Magic Quadrant for UTM F... » Hamburg: gateprotect, a German IT security specialist within the Rohde & Schwarz company group, was ... Duo to raise money for Blesma as part of Deloitte’... » Mark Powell, 42, and Matthew Toye, 43, will be cycling nearly 1000 miles from Land’s End to John O’G...


Viewpoints Header

It seems that this disk drive may have belonged to an analyst processing loan applications. It is likely that there was no need for the analyst to have access to full live data to meet the business need. So why was live data lost so easily – especially given the Canadian PIPEDA regulations that have been in place for more than 10 years?

Encryption is a non-negotiable requirement for sensitive data such as personal information. PIPEDA requires “appropriate security measures” to be in place when handling it. There clearly wasn’t any here. Sadly, in data breaches like this the knee-jerk reaction is to encrypt all disk drives. That only solves a fraction of the risk challenge of handling sensitive data like loan application records. The real risk is the data, not the disk or server. Data goes everywhere – so protection has to be with the data itself. That said, where else is this information at risk? Why was such a significant trove of sensitive data on a portable disk drive in the first place? Why was someone able to copy unprotected data from an application or database without the appropriate protection? The industry has now agreed that traditional defenses – protecting infrastructure or storage, doesn’t do enough to protect data across the end-to-end data lifecycle. Fortunately, a new best practice called data-centric security has emerged as the leading method to mitigate breach risks. Data-centric security makes it easy to protect data wherever it goes to avoid the costly ramifications of data breaches accidental or malicious, yet enabling the data’s use in a data-rich process: a win-win for the CISO, privacy compliance and the line of business consuming the data.

Through powerful breakthroughs in data protection technology, it’s now possible to maximise data use without increasing risk without exposing the “live” data to low trust environments that are common in today’s information supply chain. Data-centric security techniques such as Format Preserving Encryption (FPE) – NIST FFX mode AES, are establishing the new standards for information protection. FPE enables data to stay protected from capture without the pain and friction of traditional data-encryption methods by allowing the protected data to preserve the look and feel of the original data. If anyone steals the FPE protected data or it’s lost, it’s useless to the attacker, removing the need for costly breach remediation. So in this case, the data in the records of 500,000 load applications could have been protected as it was captured and consumed across the business process without exposure. With a data-centric approach nobody would be footing the bill for $650,000 of unnecessary spend as in this case.