nuBLOG

What will DLP do when we live in a tokenized world? That’s today’s conundrum.

Gary Palgon
Vice President, Product Management
nuBridges

Data Loss Protection or Data Leak Prevention (DLP) applications are often used to discover credit card and other personally identifiable information in enterprises.  If you don’t know where sensitive data exists, how can you protect it?

Imagine this.  Your company has migrated to a security model where tokens, or surrogate values, are spread throughout the enterprise instead of the actual values, say for actual credit cards.  If the tokens are format-preserving and therefore resemble credit cards but are actually tokens, how will the DLP systems know that they are tokens and not sensitive data?

While the latest indications on the next PCI DSS standard will only have minor changes in it (see No major PCI DSS revision expected in 2010), Walt Conway pointed out in StorefrontBacktalk that there’s a real possibility that the PCI DSS standard may eventually will mandate automated cardholder data discovery.

We better get creative quickly to solve this one!  Any ideas?
Until next time,

Gary

Conundrum – My company wants me to share more data and at the same time secure more data!

Gary Palgon
Vice President, Product Management
nuBridges

CIOs everywhere are being told by the business that they need to share more data, both internally and with business partners.  And then they are being told to secure more data to limit its use to only authorized users. 

Retailers, like many other industries, have been battling this during the past few years as they strive to comply with the PCI Data Security Standard to protect credit card information but the battle is only getting more complex.  Key to many organizations is their customer information, often part of loyalty and/or credit programs which require them to store for future use information considered to be personally identifiable information or PII. 

In a recent article by Walt Conway about what he heard at last week’s National Retail Federation (NRF) conference, he noted “While in New York, I heard a lot of CIOs talk about balancing the pressure to open systems and databases to more internal users with the need to protect the data. This balancing act will get more interesting as the volume of customer data expands.”  This is exactly the dilemma I hear all of the time.

And while that’s from a retail perspective, it’s no different in Healthcare.  Look at the US Health Information Technology for Economic and Clinical Health Act (HITECH) which as part of the American Recovery and Reinvestment Act (ARRA) has a goal to implement electronic medical records (EMR), secure protected health information (PHI) and share patient data security through out the ‘medical supply chain’.  Once again, the theme mirrors that above, share the electronic data but also secure it.

There are no silver bullet answers here, but it is important to take a strategic look at how PCI, PII and PHI is created, used, shared, archived and destroyed in order to properly ensure it is only used by authorized individuals, secure at all times and destroyed when it is no longer needed. 

What are the challenges related to locking down data and sharing more data in your organization?

Until next time,

Gary

PS...Later this week, nuBridges is releasing a new White Paper, "The Power of Integrated Protection."    This White Paper explores the emerging issues that are driving enterprises to seek an enterprise-class encryption, tokenization, key management and compliance solution to protect sensitive PCI, PII and PHI data.   I am offering early access to my loyal blog readers.  Click here to download the new White Paper, "The Power of Integrated Protection."   

Will Federal Legislation Eliminate Complicated Data Breach Notification Legal Patchwork?

Gary Palgon
Vice President, Product Management
nuBridges

We’ve had a close eye on D.C., as two retooled data breach notification bills have been wending their way through Congress. While we had our eye off the ball recently (guess we were lulled into thinking this newest round of legislation would go the way of the past several bills), on December 9th the House of Representatives passed, for the first time ever, a data breach notification bill. While that’s great news, we’re wondering that if the bill makes it through the Senate and becomes the law of the land, will it replace the patchwork of state laws – 45 as of today – that exist? Right now, breach alert mandates are handled at the state level. Will this legislation rationalize data protection legislation across the US? Doubtful, but more realistically it will provide a consistent baseline from which states, and companies looking to comply with data protection notification laws, can use as a starting point.

The Data Accountability and Trust Act (DATA) will indeed standardize data protection across the US at a Federal level. It requires companies, defined as data brokers, that hold sensitive personal information – everything from Social Security numbers to driver’s license numbers to credit card information -- to secure that data and provide notice to affected consumers that their data has been compromised. What’s more, the bill allows consumers to have access to files about them and request that errors be corrected.

The bill directs the Federal Trade Commission (FTC) to create rules for destroying obsolete non-electronic data in addition to requiring data brokers to submit their security policies to the FTC in conjunction with a security breach notification or on FTC request. If a breach does occur, the FTC is ordered to conduct a security audit of the data broker.

As with many state laws, the DATA has a safe harbor provision. According to the legislation, data encryption establishes a presumption that no reasonable risk of identity theft, fraud or other unlawful conduct exists following a data breach. Here’s the actual language of the legislation relating to data encryption:

“…Encryption – The encryption of data in electronic form shall establish a presumption that no reasonable risk of identity theft, fraud, or other unlawful conduct exists following a breach of security of such data. Any such presumption may be rebutted by facts demonstrating that the encryption has been, or is reasonably likely to be compromised…”

It’s not great news that it takes Federal legislation to push companies along to protect consumer data in the first place, but I’m hopeful that a Federal law will lead to making data protection easier for all of us – what do you think?

Best wishes for a happy holiday,
Gary

PS...nuBridges can help you take advantage of “safe harbors” and minimize the risk of a breach. nuBridges Protect™ is an integrated encryption, tokenization, key management and audit logging solution that is already proven in business-critical production environments – for example, it encrypts billions of credit card numbers every day around the world.
 

Annual Atlanta ISSA Conference Update

First International ISSA Conference to be Held in Atlanta in 2010

Gary Palgon
Vice President, Product Management
nuBridges

The Metro Atlanta ISSA hosted its 5th annual information security conference on Veteran’s Day, November 11th, with the theme of "Magnify Your Security." It was great to see they took time out in the opening session to recognize the dozen or so Veterans among the attendees. Thanks to all of you have served and do serve our country!

It was formally announced that Atlanta will host the first international ISSA conference on September 15-17, 2010. This is great news for the ISSA community as well as for Atlanta, which has historically been the home for many security startups -- Internet Security Systems (now IBM ISS); SPIDynamics (now HP), PureWire (now Barracuda Networks), CipherTrust (now SecureComputing) and many more.

Also of interest at the annual Atlanta ISSA meeting was a presentation by Kevin Campbell of PriceWaterhouseCoopers, covering PWC’s Global State of Information Security Survey.  Lots of great and timely information about spending and security breaches.  Kevin summarized the executives’ views in the coming year as focused on looking at and placing their highest expectations on initiatives that:

• Protect data
• Address the big risks first
• Pull this portfolio of multi-year investments together (strategy)
• Reduce cost and increase efficiency
• Prepare for a wave of new regulations (e.g. State Breach Notification Laws)

To the last point, he noted that because of the effect of the economic downturn, regulations are on the rise – led perhaps by a new wave of privacy laws.

Until next time,
Gary

 

Report from the ISSA-UK Chapter Meeting

Gary Palgon
Vice President, Product Management
nuBridges

The ISSA-UK Chapter meeting was held last Thursday evening at the London offices of KPMG and attended by about 60 information security professionals.  There were three speakers covering an update from the Information Commissioner Office, the legal aspects of data security and how to reduce the scope of PCI DSS compliance using tokenization - the last one given by yours truly.

 

The topic was well received and much discussion with the group covered how tokenization applies to other data beyond credit card information and the industries that are a great fit for it – including health care, state and local government (e.g. law enforcement), hospitality, etc.

What was interesting about the other two talks is that the Information Commissioner’s Office noted that they have lots of laws and procedures to protect data but a limited ability to fine organizations for non-compliance, while the solicitor (lawyer for you and me) covered the power of both civil and criminal prosecution for breach of the very same laws.  The recommendation from both was to protect the data though!

I’m on vacation next week, spending my 13th year as a counselor to kids with cancer at Camp Sunshine.  Have a great week and go protect your data!

Gary

How much would you pay for your own company and consumer data?

Gary Palgon
Vice President, Product Management
nuBridges

Gone are the days when hackers broke into companies as a challenge to themselves to prove they can do it.  More fashionable in recent years has been to steal credit card and other personally identifiable information (PII) so that it could be resold on the black-market.  And now for the next wave, stealing the data so that it can be resold or ransomed back to the rightful owners!
As Dan Kaplan of SC Magazine reported on May 5th, “Hackers seek payment after break-in on state health care site.” Ccyber-thieves did just that demanding $10 million to return patient data to Virginia’s Department of Health.

This isn’t the first time it’s happened and surely it won’t be the last. 

I can think of a couple of solutions to solve it – take out insurance in case it happens (assuming someone’s willing to write you a policy) or follow the suggestion of the Payment Card Industry’s Data Security Standard (PCI DSS) and many regulatory laws like the State Breach Notification laws which suggest rendering the data useless if it ends up in the wrong hands.  In other words, get rid of it if you don’t need it, encrypt it if you do, or hash or tokenize it if you don’t need the original values all of the time but can work with “surrogate data.”

Do you have other suggestions?

“Aha” moments at COMMON 2009!

Kyle Parris
Director of Product Management
nuBridges

From time to time COMMON 2009 conference attendees swing by the nuBridges booth just to “get their passport stamped” or to grab a goodie.  They politely suffer through me probing them a little about their business, before I tell them what nuBridges has to offer.

I’d say around six times out of 10 they say “oh, we don’t need to protect our data,” or “we don’t store sensitive data,” or “we only have two people who can access the important stuff,” or (my favorite) “we handle access control and hashing ourselves.” 

The best part of user group conferences like COMMON is seeing people’s faces light up the moment they realize: “Wow. . . maybe I do need to protect my data with a product like this!” “I thought it was way too complicated – too costly.” Those “aha” moments are becoming more frequent. And that’s a good thing. Because the employees, customers and other stakeholders who entrust these companies with their personally identifiable information (social security numbers, credit card data, etc.) assume that data protection measures are in place. At all times, whether that sensitive data is being used for a transaction or stored for analysis at a later time.

What we’re finding at this year’s conference is that many of these COMMON patrons leave with a new appreciation for data protection, and hopefully have nuBridges on their mind when they raise these issues back at the office. Some even get excited about the “kudos” they’re expecting to receive by bringing this important topic to the attention of their superiors. 

Would love to hear about your “aha” moments at COMMON 2009!

Greetings from Reno,

Kyle

As I travel, so does all my personally identifiable information!

Gary Palgon

Vice President, Product Management

nuBridges

 

I check out of my hotel early this Friday morning and am now on an airplane headed home from the RSA Conference 2009.  It was nice that I could simply leave the hotel without checking out since they are going to simply just charge the bill to my credit card.  I’m hoping that my credit card number has been stored at the hotel in an encrypted state since I gave it to them on Monday.

When I checked in at the airport, I used a credit card at the airline kiosk to print my e-ticket.  They didn’t charge anything but they did use it to verify that I was who I said I was and compared my name on the ticket to my name on the credit card.  Do you suppose the airline is storing my name and credit card in an encrypted state?  I wonder how the airline verified that I’m not on the “no fly list” from the U.S. Federal government – did they send it clear ‘over the wire’ or do they have a secure pipe to transport my data?

As I was getting on the plane, they scanned my boarding card and I saw my seat number and name show up on the display screen – just great, the guy behind me knows not only where I’m sitting (no big deal) but also my name – which he doesn’t need to know.

Thinking ahead, I’m going to go through the same routine over the next couple of weeks – airlines, hotels, restaurants and stores on two continents.  I’m hopeful that everyone will take care in protecting not only my credit card data, but also my personal information.  Realistically though, the world has a long way to go before we get there!

Next stop London! Where I’ll be talking to you from Infosecurity Europe 2009.

Cheerio,

 Gary