Data aggregators are getting picked on a great deal these days for their security lapses, but the data thefts from Choicepoint and Lexis are only two have a half-dozen or so recent thefts, resulting either from fraudulent data purchase, physical theft of records or computer database hacking. Of all these potential avenues for mass theft of personal data, computer system security is arguable the most pervasive problem facing American industry.

Not only is this a basic security issue, but as we've seen in recent weeks, it is becoming a serious liability issue as well.

John Oltsik, the author of a January 2005 report on data security from the Enterprise Strategy Group. has summarized his findings in an article for ZDnet.com. Oltsik's report report includes data from a survey of security professionals at 229 U.S. firms and found that almost a quarter of these firms had experienced an internal security breach in the last year. An even larger number of respondants couldn't say one way or the other whether they had been breached or not.

From ZDnet.com:

Black Eye for Privacy

By Jon Oltsik, Special to ZDNet
Published on ZDNet News: April 4, 2005, 10:48 AM PT

First it was a security breach that left ChoicePoint's treasure chest of personal information (145,000 accounts) vulnerable to prying eyes. Less than a fortnight later, Bank of America backup tapes containing data on 1.2 million accounts went missing. More recently, someone hacked into a confidential database containing as many as 32,000 records at Seisint, a company owned by LexisNexis.

Bad guys are targeting corporate databases because, obviously, that's where the money is. But the bigger concern is that many of these confidential "bet the business" databases (and other critical systems) still remain woefully insecure.

The Enterprise Strategy Group recently surveyed 229 U.S.-based security professionals from organizations with more than 1,000 employees. The majority of respondents (52 percent) came from organizations with more than $1 billion in annual revenue. Our goal was to get an objective metric of just how bad the internal security threat really is.

The results paint a frightening picture. For example, 23 percent of respondents reported their organization had suffered an internal security breach in the past 12 months, while 27 percent didn't know if it had or not. Note to self: Make sure the people you do business with know whether they've been hacked or not.

Read the rest of the article.

Also an executive summary of the ESG research report can be found here.

-- MDT

Labels: data breech, database, identity theft