Many executives feel that IT security is only an issue for the IT department. The problem is IT security is a bigger issue than just your IT department. Everyday your company faces viruses, lost devices, stolen data, and intellectual property walking away with recently dismissed or disgruntled employees. According to the DataLossDB project, 126,749,634 medical records, bank account numbers, names, and addresses were stolen or accidently leaked in 871 separate incidents in 2011. Costing companies an estimated $26 billion in 2011. Now you might say, “We aren’t in the business of IT or security. We make widgets. We maximize investor returns by buying, selling, and trading subsidiaries to create wealth.” The fact is currently, for an organization to ignore IT security is clearly risky. As reported in Forbes magazine on January 2, 2012 “If data loss continues on its current trends, it will cost the U.S. economy $290 billion by 2018”. As most cases go unreported, check out the cases that made headlines in 2011:
The security division of data storage firm EMC was hit by a hack that compromised their popular SecurIDcryptographic keys, forcing them to offer replacements to their clients. The stolen information was later used in an attack on defense giant Lockheed Martin. RSA has provided a useful working definition of the term advanced persistent threats, or APTs, as “military-grade cyber-attacks on commercial entities.” In the face of APTs, businesses need a new defense doctrine, which is under discussion by an increasing number of corporate chief information security officers.
- Texas Comptroller
A server mistakenly left open to the public contained the Social Security Numbers of 3.5 million teachers and other state employees. No hacking was necessary to access this server.
In nine different incidents, the conglomerate lost names, addresses, and credit card and bank account numbers as hackers pillaged its online game, music, and movie divisions. Hackers made off with 77 million names, e-mail addresses, and passwords after breaching Sony’s PlayStation network. The Sony breaches followed several similar data breaches by online service suppliers such as Play.com and Lush, so what effects are they likely to have on the online services industry?
- SK Communications
A complex attack on the Internet company netted the personal information of 35 million South Korean users. That’s in a country of 50 million people.
A few of the defense contractor’s backup tapes were stolen out of an employee’s car. The tapes contained the medical records of more than 5 million military patients.
- Sutter Medical Foundation
A stolen laptop from the health-care provider contained 3.3 million names and other identifying information, along with 943,000 patient diagnoses. This incident brought on a class action suit, alleging negligence in securing data.
Can you afford to have your company on this list? I did not think so. All of us have a role to play in a more secure internet and it is clear we have a problem and need to get on with fixing the issues as quickly as possible. If your company has customer information, takes credit cards or has computers that use passwords then IT security is in fact your business.