Cleaning up the mess
Some have said “Data is the new oil”. The analogy does work for certain aspects and characteristics, namely it is valuable and creates a huge mess when you have a leak (data breach). Oil spills can persist and return after many decades.
The images of wildlife coated in sticky, black-stuff is bad for CSR (Corporate Social Responsibility). The same applies to data breaches, especially when people are more aware of the sort of damage it causes them directly, from credential stuffing, leading to financial loss or even identity theft.
In a nutshell, the authorities get tetchy, clean-up costs are significant, people get annoyed and your share price drops.
Persistence of Data
Data can be even more persistent, in terms of longevity, it is on a par with plutonium 238 with a half-life of 88 years. Once a data spill happens in the public environs, it’ll spread naturally on the internet, it'll seep through little gaps and soak through inadequate controls; porosity is high. Some may be in intermittent stores such as caches, others will persist in backups. If it’s data of interest or of value, it’ll be actively copied and distributed, perhaps sold on or exchanged for other information or indeed money.
Try a little experiment, this will work if you’ve ever participated in online fora (forums?), the natural successor to BBS or bulletin boards of the modem dial-up variety, a more innocent age perhaps. Do an internet search of something unique to you that you may have shared, say 20, 30 years ago. There’s a very good chance your favourite search engine will find it.
Oil Spills – The Exxon Valdez
The Economist said "In 1989, the Exxon Valdez supertanker ran aground in Prince William Sound, Alaska, losing a quarter of a million barrels of oil into the surrounding waters. The firm paid $3bn to clean up the area and settle legal claims, and to improve safety the American government ordered the phasing out of single-hull ships such as Exxon Valdez. All vessels used worldwide by Exxon’s corporate descendant, ExxonMobil, are now double-hulled. But that is not all. The disaster gave rise to a cult like culture of discipline within ExxonMobil that helped turn it into the profitable behemoth it is today."*
Data Spills
"Three decades later, as a result of a relentless surge in cybercrime, digital firms are floundering towards their own Exxon Valdez moment. The latest is Capital One, a big American bank with a market capitalisation of $42bn, which on July 29th revealed that a hacker had stolen personal and financial details of 106m credit-card customers and applicants. Prosecutors allege that over four months Paige Thompson, a 33-year-old software developer, infiltrated a Capital One server hosted on Amazon’s cloud-computing platform through a misconfigured firewall. Bizarrely, the bank did not notice even after the hacker pseudonymously boasted about the heist on social media—until it was tipped off. For a company hitherto seen as one of the most technologically adept in finance, this is a blow." *
What about in the world of (big) data spills?
Global data controllers, the likes of the Marriot Hotel group, Yahoo! Experian and Facebook have experienced major spills. What has their clean-up campaign achieved? In fact have they done anything at all beyond token efforts, such as offering free credit score monitoring?
What has been happening?
Industries haven’t really been taking risk of data spills seriously that can only be fixed by enacting serious structural and cultural changes that other industries such as oil has done to change the way their people think and thereby changing the approach of doing things and re-calibrating their risk models. The tougher regulatory landscape for data protection, in the form of the GDPR et al has meant firms with a less than rigorous attitude to data and information security have had to reconsider.
Overall the fines to date have been higher than the ones issued under preceding legislation and enough to encourage data processors to sit up and take notice.
What can be done?
Myself and others have championed a holistic approach to data governance, so it taken beyond a box-ticking-compliance-only exercise, but something which adds value to the business and can be relied upon to give assurance to the board, shareholders and regulators.
It’s a combination of influencing the culture, executive-level adoption of the new culture, organisational wide-educational and awareness, the right supporting detection and enforcement tools to deliver an efficient and effective data governance management.
#Data breach, #big fines, #GDPR, #Capital One, #culture change, #governance
*(Paragraphs 3 & 4 from Schumpeter, The Economist 08/08/2019)
Further reading
I maintain a security themed web log which you can find here:
http://www.securitynotes.co.uk
GDPR One year on and the Big Fines have started
How to ruin the reputation your 118 year old company and lose your job
The World's most valuable resource
The Exxon Valdez of cyberspace
Here's why data is not the new oil
I don’t agree with all these, but they do give an interesting viewpoint and counterpoint.
Personal commentary. Views are the author’s own.