Get Smart about Business Spending
Survey: Half of businesses don't secure personal data
The personal information you give to businesses may not be as secure as you hope, according to a new survey.
Around 55 percent of all businesses acknowledge that they secure credit card information but not Social Security numbers, bank account details, and other personal data, according to a survey of more than 500 companies released Wednesday by Imperva and Ponemon Institute.
The survey was conducted to determine how many companies are complying with PCI DSS, the Payment Card Industry's Data Security Standard. PCI DSS tries to ensure that businesses take specific measures to secure their Web sites, databases, and other systems that process and store credit card information.
Of the companies surveyed, 71 percent acknowledged not making data security a top initiative, despite the fact that 79 percent of them said they've been hit by one or more data breaches. In fact, Ponemon and Imperva noted that since the PCI DSS standard was enacted in 2005, the number of breaches and cases of credit card fraud has actually risen.
(Credit:
Imperva)
Cost and lack of resources were the biggest factors cited for not focusing on PCI DSS compliance. For those reasons, larger firms fared better than smaller ones. Only 28 percent of businesses with 501 to 1,000 employees were compliant as opposed to 70 percent of companies with 75,000 or more employees.
"Companies devote 35 percent of their IT security budgets to PCI compliance on average, making cost a significant obstacle, especially for smaller companies," Amichai Shulman, Imperva's chief technology officer, said in a statement. "This is why Imperva is recommending that the PCI DSS Council modify the requirements for larger and smaller companies to take into account different environments and security needs."
Another problem stems from the priorities of the organization itself. Of those questioned, 55 percent didn't feel their CEO strongly supports PCI DSS compliance, while 52 percent said their company is not proactive in managing privacy or security risks.
On the positive side, PCI DSS compliance has found a certain measure of success. Around 75 percent of those surveyed said their company has achieved some level of compliance, with 28 percent compliant for most of their applications and databases and 25 percent compliant for some apps and databases. Only 22 percent reported being fully compliant.
(Credit:
Imperva)
Conducted by Ponemon and sponsored by Imperva, the survey questioned 517 U.S. and multinational IT security professionals who work on PCI compliance efforts for their companies.
Over the past few years, data breaches at large organizations such as T.J. Maxx and Marshalls parent company TJX and Maine-based Hannaford Supermarkets have highlighted the need for better security for credit card and customer records.
Lance Whitney wears a few different technology hats--journalist, Web developer, and software trainer. He's a contributing editor for Microsoft TechNet Magazine and writes for other computer publications and Web sites. You can follow Lance on Twitter at @lancewhit. Lance is a member of the CNET Blog Network, and he is not an employee of CNET. 
In theory they don't... or perhaps the correct wording is, companies 'shouldn't' sell your credit card details... but there are many cases to the contrary. It is why banks introduced the extra security digits on the credit cards (on the back of most but on the front of AMEX but not raised text). It is a constant uphill battle to deal with this.
All that being said, there are very strong laws (as in laws with real teeth unlike the cruddy penalty points in most privacy legislation) relating to disclosure of banking details.
This is what makes me really mad about the RIAA and MPAA massive lawsuits. How can we justify these massively disproportionate penalties for sharing a couple songs while having no repercussions to acts like your boss where the very integrity of data as sensitive as social security numbers are not protected? It is very frustrating from a legal stand point.
http://www.pikewerks.com
It blows my mind that all these major corps seem to NOT encrypt credit card and other sensitive info. All a hacker needs to do is get access to the drive with the data and their mission is complete. It is astoundingly stupid. I have personally had money taken out of my bank account because my bank card was not encrypted by a major corp.
There needs to be regulation on how personal information is stored.
You'd think some people would be morally obligated to enforce some sort of security measure to ensure valuable info does not get leaked. I guess it just goes to show where some people's morals are fixated now-a-days. (Morals, what?.... I don't understand)
Not much to do for any administrator when the executives say: "Blah, we won't buy any professional data encryption software, we won't enforce any data protection mechanisms, we've got other things to spend the company's money on". It's simple - as long as there's no fear of compromising the internal data flow of the company, they don't care or attempt to look like they care for the customers' security. The way some of these companies handle personal data and sensitive information is just atrocious.
But that doesn't surprise me in the slightest - they'll slip on this security banana peel sooner or later.
- by Vegaman_Dan September 25, 2009 10:54 AM PDT
- Unfortunately a lot of people here are only thinking about electronic records online in databases. This isn't really where places like Marshall's and other retail box stores had issues. Instead it's the physical access to records that are the problem.
- Like this Reply to this comment
-
(18 Comments)An example- one company (nameless here for a very real reason) is a big box home improvement chain. They keep records of all the transactions done at the store in the store's server which syncs with corporate at different times of the day. The network jacks for this store are scattered throughout the store and not secured. Anyone can plug in, peruse the network without any issue. SSID"s for the wireless were broadcast and not secured. You had access to do whatever you wanted- including accessing that server.
Paper records for transactions, merchant accounts, etc- the backroom office was too small to hold that, so instead they get put on a pallet and stored wherever they can- in one case covered with a tarp, put out on the main sales floor and covered with sales merchandise. People buying flourescent lightbulbs on display may not be aware that customer records and personal information are simply in boxes underneath that tarp.
Another area of concern are the POS or point of sale systems. Most of these are running Windows or Linux and not secured. The backs of the machines are not secured and typically point right at the customer. It doesn't take long to insert a USB key into an open port and have it upload your payload of bots or whatever. There's apps out there that will yank data off the system's hard drive in key areas in just a minute or so if you have physical access.
Take a look at the cash register the next time you visit the grocery store. You'll probably see that it has USB ports on there exposed. Plug in your USB key, install the key logger or intercept bot and now you could have a bot installed on that system that keeps a record of every transaction made including your credit card number, PIN, etc, all then sent to a remote system without the owner ever knowing about it. Yes, those ports *should* be disabled, but we're talking about a retail environment here where staff aren't allowed to do anything to the machines and have to call a third party for tech support.
That's the sort of thing PCI compliance is really going for these days. Unfortunately, there's all sorts of ways to game the system. :/