Evan Francen is president of FRSecure LLC, information security consulting. Recently, RDS asked him some questions about data security issues, including the types of data companies should protect and future predictions.

Q. What research/statistics do you leverage to support your business actions?

A. We constantly review information from a variety of sources. We hold daily briefings with FRSecure staff members to review current news, research, statistics, and regulatory changes. Some of the sources we use are:

Google news feeds – using key words such as “security,” “breach,” and “hack”

GovInfoSecurity.com – government information security and regulatory changes

CSOonline.com – private industry information security news and research

Ponemon Institute – information security research based on studies and surveys

Dataloss.com – breach reporting and research

U.S. Department of Health & Human Services, hhs.gov – HIPAA, HITECH, and health information privacy

Federal Financial Institutions Examination Council, ffiec.gov – GLBA and banking compliance

Whenever possible, we try to stay away from research that vendors and service providers have conducted. Objectivity in this research may be questioned.

In our information security assessments, we get a little more detailed in our risk justifications. We attempt to quantify risk by measuring the likelihood and impact of an adverse event in 1000s of controls.

Q. What industries do you see as having the greatest risk?

A. Probably utilities and medical. In general, both of these industries are critically lacking in basic information security protections.

Q. What optional compliance audits/certificates do you recommend a company have/conduct?

A. There is no single information security compliance certificate in the industry today. PCI is probably the closest thing we have, but even PCI is limited in who it applies to (merchants and processors involved in credit card transactions). Some people claim to be SAS70 or SSAE16 “compliant,” which is misleading because there is no such thing. In general, we recommend that every organization undergo a comprehensive information security assessment (or audit) every 12-24 months. The assessment should be based upon or mapped to a well-known industry standard such as the ISO 27000 series, NIST, or COBIT (not preferred because of its IT specificity).

Q. What do you see happening in the future?

A. If only we had a crystal ball! We wish we had better news to report for what we see in the future. We expect more regulation and government control, increased attacks on (and using) cloud services, more focused social engineering attacks, increased hacktivist activity (Anonymous, Lulz, etc.), and a significant state-sponsored attack or two.

I think in the medium to long term we’ll start to see real improvement in the industry. People will be more educated about information security risks and we’ll start to see unification between information security vendors and service providers. Eventually, people will all get on the same page.

Q. What percentage of small businesses have an end-of-life plan/policy?

A. As it relates to computing hardware (software and data), I would estimate that less than 5% of small businesses have an adequate plan.

Q. What is the best source of information on recycling and sources?

A. For standards and acceptable best practices, we rely on experience and an understanding of risk. For specific services, we rely on a trusted partner like RenovoData Services.

Q. In your opinion, what is the greatest data security threat?

A. People.

Q. What is the difference between securing hardware vs. software and mindset needed?

A. Usually the loss of hardware is not costly; it’s the cost of the data on the hardware that proves costly. There are three types of controls that we are concerned about: administrative, physical, and technical (also called logical). Securing hardware is a little more reliant upon administrative and physical control; whereas, software may be more reliant upon technical control.

Physically, building construction, door locks, asset inventory, camera surveillance, and other controls are required to mitigate the risk of physical hardware theft. These physical controls must be considered in combination with appropriate administrative controls such as property removal procedures, media reuse standards, media destruction standards, and adequate employee training.

Q. What would you tell someone starting a business to do to prevent data breaches?

A. Consider information security implications in all business decisions. Build appropriate information security controls during the design of your systems as opposed to trying to tack it on later.

Q. Existing business – what should you check first?

A. Where is ALL of my sensitive data and who has access to it (physically and technically)?

Q. Are there metrics that compare industries?

A. It depends on what specific comparisons you are looking for. In general, there are no good industry comparisons due to a lack of information sharing among companies. At FRSecure we provide our own industry comparisons to customers, based upon the information we have collected during our work.

Q. What are some examples of the kind of data companies should be trying to protect?

A. Generally, companies need to protect:

Personally identifiable data (PII) – Social Security numbers, account numbers, email addresses, passwords, etc.

Personal health information (PHI) – Medical records, insurance information, diagnoses, etc.

Financial information – business and customer financial information

Intellectual property

Q. Does being compliant save on business insurance?

A. It depends on the type of insurance and the insurance company. We recommend that customers check with their insurance agent.

Q. Is there any way to be 100% confident data is safe?

A. No. We cannot eliminate risk. We aim to assess and reduce risk to a level that our customer can accept.

The presence of the Health Insurance Portability and Accountability Act (HIPAA) in health care and its impact on associated industries are nothing new. But as hacks are increasing in frequency, the need for compliance is more important than ever in businesses whose user data is protected under HIPAA.

“Covered entities,” as these businesses are called, are required to comply with HIPAA regulations in safeguarding patient/customer personal information. But HIPAA’s security and privacy standards fail to provide specifics on maintaining compliance for paper or electronic patient health information (PHI). They do give some recommendations such as locking file cabinets and shredding paper, but when it comes to disposal of obsolete data, destruction is the only rule.

Taken from the hhs.gov site:

“In general, examples of proper disposal methods may include, but are not limited to:

• For PHI in paper records, shredding, burning, pulping, or pulverizing the records so that PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed.
• For PHI on electronic media, clearing (using software or hardware products to overwrite media with non-sensitive data), purging (degaussing or exposing the media to a strong magnetic field in order to disrupt the recorded magnetic domains), or destroying the media (disintegration, pulverization, melting, incinerating, or shredding).”

According to the regulations, computers and electronic media may be reused or disposed of, but the PHI must be cleared.

That’s a useful guideline that was current at the time of writing in 2009. But since then, at RDS we’ve researched data destruction methods for current media and accounted for the most recent means of cyberattack. We’ve found that degaussing (demagnetizing) is no longer as reliable for destroying data as shredding is, due to recent changes in the line density of hard drive devices to increase their recording capacity. With increased line density comes increased magnetism, but degaussing machines haven’t necessarily caught up. As a result, it’s more difficult to find degaussing machines that create a strong enough magnetic field to destroy the data on such drives.

So shred, and be compliant!

RenovoData Services knows the importance of protecting customer data, and caring for the environment. We also know that it is critical to the future of business that associates know they can trust each other with sensitive information and environmental accountability. Odds are if you’re reading this blog, you do too. We would like to help your business establish that understanding with your customers, your vendors and your partners.

So starting Monday, June 13, RenovoData Services is offering our commercial customers the RenovoVerified Badge to display on their website. For the businesses and individuals who work with you, it offers them peace of mind, knowing that their data and your technology are responsibly managed.

The badge isn’t for just anyone. We will only share it with companies that have used RDS’s 100% secure data destruction services, or our e-waste recycling services in keeping with our ZERO landfill policy.

In this way, it’s a clear sign to anyone coming to your website that you believe in security and environmental stewardship. But it doesn’t just mean that you believe in responsibility. It also means that you walk the walk, implementing business practices that make you a business to trust. Verified!

RenovoData Services is hosting DataShred Wednesdays starting June 15! On the first and third Wednesdays of every month between 11:30 a.m. and 1:30 p.m., bring in your retired hard drives (previously removed from the computer) for shredding at $5 each, and 25% off for orders of 5 drives or more!

We’ll also shred your data tapes for $5 per pound, and CDs, DVDs and Floppy Disks for $2.50 per pound. And as always, you’ll have the total peace of mind that comes with 100% secure data destruction.

In addition, we’ll be taking some recyclables for FREE. Some we’ll be taking at just 25 cents per pound.

Bring these in for FREE recycling:

• Phone Systems
• PCs
• Laptops
• Servers
• UPSs
• Switches, Hubs & Routers
• Cell Phones
• Electric Motors
• Batteries (Lead Acid & Gel Cell)
• Copper
• Wire
• Brass
• Aluminum

Bring these items in for recycling at 25 cents per pound:

• Monitors (CRT & LCD)
• Televisions
• Printers
• Copiers
• Fax Machines
• Office Electronics
• Keyboard/Mouse, Calculators
• Plastic
• DVD Players
• Batteries (Alkaline, Lithium, Nickel Cadmium, Nickel Metal Hydride)

Limitations:

• There are a small number of items we can’t accept. They are:
• Appliances
• Liquids
• Hazardous Materials
• Pressurized Gasses

We’ll see you Wednesday, June 15, at our location: 6887 Washington Avenue South, Edina, MN 55439. Find us on Google Maps

Lately, there’s been a great deal of media buzz around data security, running concurrent with today’s shifting work landscape. Telecommuting is increasingly common, cloud computing is on the rise and intercontinental work is easily accomplished, constrained only by differences in time zones, if even then. As a tech-dependent working public, we are networked and interconnected to a degree not dreamed of even 15 years ago.

If you are reading this, you are using a computer and the Internet. And you probably use them both for your work. Your employer probably knows what your computer does, and a consulting firm your employer hired probably has access to your customers’ personal data in order to perform the service for which they were hired. Another firm has their customers’ information for similar reasons. And so on and so on, and so on. Thought of as an image, each of us is connected to others in ever-expanding interlinked starbursts. It’s dizzying.

With all these technological and informational relationships, security for one means security for another, and many gaps must be closed. Given this, a thorough and planned approach to security will offer the greatest protection. Yet, some companies focus their security methods on the latest, biggest-news security compromises, acting in a perpetual stream of reaction to keep up with the latest greatest hacks. When we do this, what are we missing?

Plenty. The well-worn, old-news security threats are still highly relevant ones, and could mean the difference between a business succeeding, and being sunk by the costs associated from a data breach. Let’s take a look at the most commonly disregarded threats to cybersecurity.

1) Insiders

These are employees or consultants motivated to steal information.

2) Tool saturation backlash

Security tools are out there in droves. Companies may ask their employees to use them beyond their tolerance level, resulting in lax vigilance.

3) Mobile devices

Loss of a hand-held device such as a phone easily could lead to password discovery in the wrong hands.

4) Common, low-tech threats

A sandbox, for example, containing plans or other sensitive information is accidentally made public by an unwitting user.

5) Risk management

A website may be well-protected, but malware sneaks onto the software for operating one of the devices it markets to a given industry, such as health care.

6) SLA litigation

Expected service level is rising all the time. If a grand promise is made to a customer that can’t be delivered on, the customer may sue, exposing information to the general public.

7) Treacheries of scale

If a firm changes their system to a private cloud, everything is centralized. So, everyone on the system is affected when there are server problems.

8) End-of-life protocols for equipment

This is all too easily exploited by dumpster divers. Reformatting and drilling do not prevent data from being collected off a hard drive by a sufficiently motivated hacker. Hard drive shredding, a service RenovoData Services provides, is the most secure way to prevent data loss, short of smelting.

In the coming years, overall vigilance and dealing directly with issues that can be controlled will be the keys to data security.

127 tons of electronic junk… in just 2 months!!

“India’s Directorate of Revenue Intelligence (DRI) has intercepted five huge containers of old computer parts being dumped illegally in Chennai in just two months. Altogether it has found 127 tonnes of e-waste, much of which contains nickel, mercury and lead and could be linked to environmental damage as well as health concerns for”

read more…

Why are we dumping our old junk on China, India and Africa?  People in my neighborhood complain about a new water tower… Just imagine if someone dumped 127 tons of electronic scrap at the end of the block!!  This has got to stop!!

Source… 23 Aug 2010 14:23 | by a staff writer | posted in Business Read more: http://www.techeye.net/business/chennai-india-being-used-as-e-waste-dumping-ground#ixzz0xipo1mvT

RenovoData Services is partnering with The Eden Prairie Chamber of Commerce and the Edina Chamber of Commerce to provide Electronics Recycling and Free Hard Drive Shredding at the event.

• When – August 19th 10:00 am to 1:00 pm
• Where – Grace Church – 9301 Eden Prairie Road, Eden Prairie, MN 55347 (map)
• What :

1. Recycling of PC’s & Laptops, Cell Phones, Small Printers, Small Office Devices at no charge.
2. Recycling of Monitors, Large Printers, TV’s and small appliances at 35 cents per pound.

This recycling event will take place in support of the E-Shared Partnership Event – Progressive Networking Luncheon…. see details below..

Registration: Click here to Register | or call (952)-944-2830
Price: Members: $25, Non-Members: $40

1. A 60 second commercial about your business
2. A large stack of business card

RenovoData Services will host a one-day event on Saturday, November 14, to collect and dispose of electronic devices that hold private data. Data breaches don’t happen just to large companies. Think of all the tasks for which you use your computer or PDA—these devices contain a lot of personal data.

Please note, our event is not for all types of e-waste. For a small fee, RenovoData Services will collect only the following:
- Computers—$10, including its monitor, keyboard and/or mouse
- Printers or additional monitors—$10
- Computer hard drives—$10. Hard drives will be shredded on-site if removed from the case
- Personal digital assistants (PDAs) or cell phones—no charge
- Flash drives—no charge

Date: November 14, 2009

Hours: 8 a.m. to 2 p.m.

Location: Education Center, 8040 Mitchell Road, Eden Prairie, Minn., 55344 (enter off Technology Drive, west of Mitchell Road)
Bring us your old, unused cell phones and help the Quarter Million Phone Project!

Keep your cell phone out of the landfill and safeguard your personal data. We will repurpose or recycle your cell phone, and we guarantee it will not be incinerated or dumped into a landfill.

Help us reach our goal to collect a quarter of a million cell phones.

We have a 100% green solution for data security risks and e-waste recycling.

Why risk a breach of unsecured, sensitive information? Let us shred your hard drives and back-up tapes into unreadable bits.