Category Archives: Data Protection

cybersecurity, Data Loss, Data Protection, Information Security, insidertrading

How to ruin the reputation of your (118 year old) company, lose your job and your liberty

4 July, 2019 Chun Wong

Unfortunately there are so many cases I can use to illustrate this. Most topical at this time at the start of autumn (fall) 2017 is Equifax.

They provide credit scoring services to the public and businesses in 14 countries, including Canada, UK and USA. Many financial organisations use them to assess the credit-worthiness of individuals and companies.

This company has been around for more than 100 years, they have an operating revenue of over 3 billion USD and over 9000 employees.

Their bread and butter is information. Personal information. Including name, addresses, social security number, income and loans amongst others. Stuff classed as sensitive PII by most if not all data protection agencies.

They hold data on more than 820 million individuals and 91 million businesses.

In May 2017, they lost the details of which 145 million people in the USA, at least 400000 in the UK and 100000 in Canada.

Heads Roll

Within Equifax, the chief information officer Susan Mauldin and chief security officer David Webb were retiring and within two weeks Richard Smith, the CEO said he was stepping down after having to explain the breach to a US Congress committee in October.

The market is not impressed

Their share price was trading around 140 USD, then plunged to a low of 94 USD a few days after the disclosure, which is comparable to Talktalk’s share price drop.

The actual financial impact to Equifax is unknown at this time, as it’s still so recent.

It gets worse

During a congressional hearing, it transpired that the CIO, Jun Ying had sold 950k USD of company shares. June 2019, he was found

guilty of insider trading and sentenced to 4 months in prison

and ordered to pay restitution amounting to 120M USD, as well as a 55K USD fine.

As of 13/05/19: This incident has cost the firm 1.4 B USD so far

IT Pro article

Moneysavingexpert article

Data Protection, GDPR

GDPR – How do we go about it ?

8 October, 2017 Chun Wong

Think I’m on a roll, this is my 5th GDPR themed post.

Here’s a more practical article that’ll help you towards alignment with GDPR.

Content for this web log.

Essentials for success.
Information Security Management Systems
What to do with old or archived PII

Essentials for GDPR Success

Educate

The C suite, the board and your employees must be made aware of the organisation’s obligations and their obligations.

Design

Ensure that your on-boarding, training, strategy, policy and procedures take into account the data protection demands of GDPR.

Accountability

Be clear on who is accountable for the data you hold and process. That you can prove that PII is correctly collected, processed, used and treated for the whole Data Life Cycle.

Red Herrings and dead-ends

GDPR is not a technology problem

You can not solve with tools alone, though they may make life easier for some tasks.

Don’t make the mistake of assigning the whole task of GDPR compliance to IT.

IT apply the controls, they’ll tell you where your data is and where it’s going.

It is not solely an InfoSec problem either, though it plays a significant role.

GDPR belongs right at the top, with the head honcho.

The CEO no less.

A significant structure like GDPR, isn’t self-supporting, it relies on good information security and well implemented information technology.

(Unless you totally paper based and you don’t use any IT systems, for processing of PII, but information security part still applies)

Unfortunately unless your process and IT maturity is realistically rated as managed or above, there is work and improvement required on the underlying technology, so that it is properly designed and operated too.

For this, a good route to take is an already established information security management system (ISMS) such as ISO27001.

Isn’t it a monster ? We can’t afford it ? It’s too disruptive!

I hear you say. No, it is designed as a framework, it is scalable. Not all of it will apply to your organisation. You don’t have to go for accreditation immediately, but it’s extra kudos if you do, something to aim for in continual improvement.

Be clear I’m not saying ISO27001, COBIT, Cyber Essentials etc are mandatory. You may be doing your own thing which is just as good or better. Although it is another level of control you may need to prove and justify.

Prioritise and Segment

Determine where your data or operations impact on the data subjects most. Deal with that first.

Old / Archived PII

Do you need to keep it for legal or regulatory reasons ?
Is there a clear and lawful reason for you to retain this information ?Do you have explicit consent to use the PII for your intended use ?

No ? delete it (properly).

If you want to keep it or re-purpose it, strip out the PII elements, so that you end up with anonymised data.

Otherwise anonymise it

Proportionality

You are not expected to spend a dis-proportionate of effort to achieve 100% data sanitisation. If the archives are properly secured it doesn’t mean you have to pull out every archive since year dot to scan for PII.

However, if it is recalled for any reason, you’ll need to ensure that the data on there is properly treated by removing the PII where necessary, for example removing people who have requested the right to be forgotten.

See Articles 35, 36 and 83 and Recitals 84, 89-96

Any other business ?

There will be more follow-ons from this one that’ll build upon what’s been said above. Examples of other things you should know and should be doing are :

What do you have in your software estate ? Shadow IT has the means of scuppering your GDPR efforts. Seek out the old MS Access databases ….
Vulnerability management
What does your network look like ?
How does your data flow ?
Are all those rules necessary on your firewall ?
When was the last time the firewall rules were audited ?
Can you show why that rule is in place and trace it back to the change request and associated approval ….?

Plenty to mull over and discuss, but that’s enough for today.

Data Protection, GDPR

UK GDPR – Flies in the ointment and devils in the detail

28 June, 2017 Chun Wong

This is the third article on GDPR, the first dealt with Brexit and GDPR, the second confirmation that UK will be implementing stronger Data Protection.

Complications

There may be some “gotchas”, possible “flies-in-the-ointment”; the question of adequacy due to differences in equivalence and the effects of divergence.

Equivalence – EU GDPR

Overtime, you get divergence in any system if there isn’t a common control factor. Which is likely to test compatibility in the future, but for now, more importantly, what will 2019 bring us ?

The Supervisory Authority enforces the GDPR (and DPA98), the European Court of Justice (CJEU) has the final say. Post-Brexit, this is unlikely to be the case and will likely be the UK’s Supreme Court.

There are other UK laws, such a Regulation of Investigatory Powers Act (RIPA) 2000 which are not compatible with the current EU directive, so are not going to work in harmony with GDPR. GDPR allows investigations for crimes, RIPA’s definition are looser.

There is also a political element too, will the other 27 EU member countries be generous in their assessment of UK Data Protection 2019 and grant her equivalence with a few choice derogations ?

So what’s going to happen?

No one knows for sure – this is my take on it :

UK (and globally others) will have to comply with EU GDPR, by May 2018 (it’s actually in force now, but not enforced till May 2018, EU 95/46/EC was repealed in April 2016).

Post-Brexit UK businesses will have to comply with UK GDPR and EU GDPR.

What happens to the contentious bits of UK law or UK interpretation / implementation ?

UK will have to negotiate acceptance of her derogations or compromise on some aspects of internal laws.

Without this, we will not have equivalence, which may lead to data processed in another more compliant EEA member state instead, which is something we’d all prefer to avoid.

… next article

More practical aspect of GDRP – How to approach GDPR and towards the goal of compliance

GDPR – Nothing to do with us; UK is leaving the European Union, so we don’t need to do anything.

13 September, 2016 Chun Wong

(GDPR – General Data Protection Regulations 2016)

Bit of history to put things into perspective, in 1950, the Council of Europe created an international treaty to protect human rights and fundamental freedoms in Europe. Article 8 provides a right to respect for one’s “private and family life, his home and his correspondence”. The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data was published in 1980, this defined the data controller and personal information. A year later EU Treaty 108 was drafted which which espouses the Eight principles for protecting personal data. There are many other notable Acts of Parliament, including the Data Protection Act 1984 and Computer Misuse Act 1990. Let’s get to the present day.

GDPR is the culmination of efforts to update the EU Data Protection Directive, 95/46/EC that was ratified in 1995.

There are 99 articles and hundreds of recitals in the GDPR. I’ll present that in a GAP analysis in the future.

Bottomline

The Good news

The underlying reasons for having the GDPR hasn’t changed from the EU Data Protection Directive of 1995, the tenets are broadly the same.
Lawful processing, accuracy, appropriate technical controls etc still form the core of the GDPR.

However, as always, the devil’s in the details.

What has changed ..?

The reach of the new regulation is significantly extended.

The potential penalties are designed to be “effective, proportionate and dissuasive”. Based on a two-tier basis of 2%/4% of global turnover or 10m/20m Euros, whichever is greater.

Data Protection breaches will be taken more seriously.

Transparency. Accountability. Consent. Portability.
Breach notification. Certification. Data Protection Officer. Privacy by design.

Using tricks to opt people in will regarded in a negative light and is not in line with transparency.

The C suite will be accountable for Data Protection, not something which is loosely delegated to someone in IT.

Personal Data Breaches, the ICO must be notified within 72 hours.

Data Controllers must implement data portability in a commonly used format.

A Simple Checklist

Does your business collect, store or process personal data (anything that identifies an individual of the EU) ?
(That includes customer lists, membership details, medical records, delivery addresses, cookies and other identifying markers)
Does your business have customers in any EU state ?
Does your business intend to retain or gain new customers in any EU state after Brexit ?
Does your business intend to partner with EU entities that serve EU customers between now and Brexit ?
Does your business intend to partner with EU entities that serve EU customers after Brexit ?

A “Yes” or may be means that your organisation will be better placed if it aligns it’s governance and policies soon, as it is likely to take time to adopt and implement.

This is not an IT exercise – this needs to be owned at C or board level and this must be demonstrable.

Also, don’t forget that the UK is still in the EU and it will take a minimum of 2 years for Brexit to complete, which takes us into 2019, a year after GDPR is in effect.

For non-UK readers (and companies), there are no geo-boundaries to this. Your company may be based in South Africa, but if you have EU customers (non-company), you need to comply.

Some questions that need to be addressed
Will the UK retain the GDPR after Brexit ? If it doesn’t, the UK will need introduce something broadly similar if she intends to trade with the remaining EU members. Which requires time and money.

My money is on the UK adopting the GDPR and applying some judicious derogations, enough to gain some flexibility, but retain compatibility.

On a similar vein, keep any eye on how the issue with US Safe Harbor/ Privacy Shield and Ireland Data Protection challenge of model contract clauses plays out in the near future.

Passwords – Not fit-for-purpose, misused and Ugly

15 January, 2016 Chun Wong

It’s a perennial subject, but one worth reiterating, as old habits die hard. “Popular Passwords”, from the numerous loss and publication of unencrypted password lists, a league table has been created. The data is from 2014, but I very much doubt much has changed, so the message goes out again. Please avoid using regular names, sport teams and standard mis-spelling of dictionary words, such as P455word1, it’s better than 12354567 or qwertyuiop, but no way is it secure.

Is your password below ?

Source : www.informationisbeautiful.net

There are password guessers which substitutes 5,$ etc for S. The dictionary used covers the main languages used for commerce, English, French, Spanish, German and more commonly now Korean, Japanese and Chinese.

The safest password is one which is randomly generated or at least not a dictionary word. Using password managers is one strategy that people and organisations use, but that means putting your trust in that product and relying on you remembering your password to unlock that, but it is a better solution than many others.

Guidelines

Use 10 characters or more
Avoid dictionary words
Don’t reuse passwords across different services (for sensitive or high value services)
Don’t just rely on common substitutions
Write them down (keep the book/paper safe)

I know the last one is contentious. Better to write it down than to forget it or rely on another piece of software of technology that can be compromised. Your smartphone can be hacked anywhere in the world, your paper notebook is much, much harder to access.

Rank	Password	Change from 2013
1	123456	No Change
2	password	No Change
3	12345	Up 17
4	12345678	Down 1
5	qwerty	Down 1
6	123456789	No Change
7	1234	Up 9
8	baseball	New
9	dragon	New
10	football	New
11	1234567	Down 4
12	monkey	Up 5
13	letmein	Up 1
14	abc123	Down 9
15	111111	Down 8
16	mustang	New
17	access	New
18	shadow	Unchanged
19	master	New
20	michael	New
21	superman	New
22	696969	New
23	123123	Down 12
24	batman	New
25	trustno1	Down 1

Source : splashdata.com

Data Loss, Data Protection, Hacked, Personal Information

Another day, another Data Breach – OPM – US government’s Office of Personnel Management

14 July, 2015 Chun Wong

I’m sure you’ve seen this one in the news already. I have resisted commenting immediately, so that we can all take a step back and avoid knee-jerk, reactive comments.

21.5m USA federal employees and associates PI lost

Breach occurred over 12 months

In a nutshell, the personal data of 21.5m US government personnel was pilfered for more than 12 months. This included names, addresses, social security number (similar to the UK National Insurance number), position in the government and biometric data. Foreign contacts were also in the data haul. Background checks for the last 15 years, of friends, associates and information required for security clearance roles were lost. This information may potentially expose federal employee’s to unfavourable actions.

There were either no or insufficient controls in place to protect the data, control access, detect data leakage or detect malware. Apparently it was only due to a security tool demonstration that the breach was discovered at all.

Source : http://www.prweb.com/releases/2015/06/prweb12787823.htm

The fallout has been severe; Katherine Archuleta, The Director of the US Office of Personnel Management has resigned in the wake of further revelations about the scale of the hacking attack on the agency. She had been in the role for two years. The insecurity of OPM services was already known and documented in an earlier audit by the US Inspector General as unsafe, some as far back as 2007. The Director accepted the risk and kept the servers running without sufficient mitigation. Other findings included using servers that were unable to employ encryption and inadequate authentication.

Audit recommendations not properly mitigated

Although there was an upgrade plan underway, her mitigation strategy was not-fit-for-purpose and did not reflect the risk and vulnerabilities at the OPM.

This has echoes of the 2014 Target Breach, where management were aware of serious issues, but under-played and ignored advice. This neatly highlights the fact that you can have independent audit, but if the risk is not owned by the board, properly interpreted and mitigated, you are leaving your organisation (or indeed country) open to threats.

I have also deliberately avoided the more political aspects of this breach; It is the duty of all countries to spy on another, for gain, for war and for peace. Blaming one country or another for your own failings is disingenuous at best and totally blinkered to the realities of our world.

Further reading

https://www.opm.gov/cybersecurity/

http://www.nytimes.com/2015/07/10/us/office-of-personnel-management-hackers-got-data-of-millions.html?_r=0

http://www.cio.com/article/2947453/data-breach/how-opm-data-breach-could-have-been-prevented.html

http://www.cio.com/article/2945425/data-breach/the-opm-lawsuit-will-only-make-the-lawyers-rich.html

Data Loss, Data Protection, Personal Information

Ponemon Institute – 2015 Cost of Data Breach Study: United States

29 May, 2015 Chun Wong

US study at a glance

$6.5 million is the average total cost of data breach 11% increase in total cost of data breach

$217 is the average cost per lost or stolen record

8% increase in cost per lost or stolen record

Highlights from the report

As in the ICO (UK) Data Breach report, healthcare comes number 1 in the charts, this time for the cost of each breach.

The report is definitely worth spending time reading. It highlights the following points for minimising the cost and impact of security breaches :

Board-level engagement and CISO leadership
Employee training
A relevant and up-to-date incident response plan and team
Targeted use of encryption
BCM integration
Insurance protection

These are the fundamental building blocks of an ISMS (information Security Management System), found in ISO27001, COBIT5 and others.

The Ponemon Institute report

Data Loss, Data Protection, Personal Information

UK Healthcare sector accounted for 40% of data breaches

29 May, 2015 Chun Wong

2014 Q4 figures released by the ICO (Information Commissioner’s Office) reveals that of the data breaches reported to them, over 40% originated from the healthcare sector. Local government and education are a distant 2nd and 3rd respectively.

Source : ICO Q4 2014 Data Breach figures

The vast majority of these were attributed to human error, broken down into detail in the next chart.

Source : ICO Q4 2014 Data Breach figures

Principle 7 failure originates from inadequate technical controls.

The ICO states :

Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Chun’s View

The raw figures indicate that the healthcare sector is prone to unintended personal information exposure (bear in mind these numbers haven’t been normalised), it could be that this sector’s threshold for reporting is lower, It does reinforce the point that the majority of data leaks are due to human error.

Mitigation

Board-level sponsorship of Data Protection and Information Security training, as part of a larger learning and development regime, is essential. It must be viewed by the organisational population as worthwhile.

This must be formalised into the training strategy and woven into the Employees Handbook and Security Policy of the organisation.

As well as regular training targeting people who handle personal data, the training quality assurance is provided by the tracking of training metrics, such as completion and pass rates. With a sufficient data set, this may be correlated against the number of incidents reported. Incident rates may actually increase, as more may be reported when people are more aware of their obligations.

Parting words

Whichever sector you’re in, guarding against unintentional exposure of personal information is essential to maintaining your organisation’s reputation and avoiding the attention of the ICO.

World Leader’s PI leaked

30 March, 2015 Chun Wong

The personal details of all 31 leaders at the recent G20 summit in Australia have been accidentally leaked by the Australian immigration department. Despite being notified of the high-profile breach four months ago, it neglected to inform anyone.

The details included passport numbers, visa details and other particulars of each leader at the summit.

Tony Abbott and Vladimir Putin cuddle koalas before the start of the first G20 meeting in November 2014. Photograph: Andrew Taylor/G20 Australia/Getty Images

In a letter obtained under Freedom of Information requests, it’s been revealed that a staffer at the G20 leaders summit staged in Australia last November mistakenly mailed a list of the leaders’ personal details to an official at the Asian Football Cup Local Organising Committee.

Although the information hasn’t been publicly exposed and is unlikely to be of use for nefarious purposes, not many people are likely to pretend to be Vladimir Putin or David Cameron. The damage is reputational and is certainly embarrassing for the Australian government. Ironically it had just recently passed controversial mandatory metadata retention laws.

Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2015

International Business Times article on the new Australian Bill and obligations of ISPs

The Guardian’s article on the new Australian Bill

Security Notes