Data Breach

Data Breach

Credit Card Security for Small Business (Pt. 1)

Business, Data Breach, PCI DSS, Prevention, Privacy, Security, Uncategorized 3 comments

Staples recently suffered a data breach that resulted from malware infecting its point-of-sale (“POS”) systems at several stores.  This should not be surprising, since a recent study by Verizon showed that a significant portion of data breaches are the result of POS system intrusions. So what’s a business to do?

Many small businesses avoid this problem by refusing to accept credit cards and only accepting cash or checks.  But that’s not a solution for businesses that wants to accept credit cards.  For these merchants, the only realistic solution is to comply with the Payment Card Industry Data Security Standards (“PCI DSS”).

PCI DSS is administered and managed by the Payment Card Security Standards Council (PCI SSC) that was created by the major payment card brands (Visa, MasterCard, American Express, Discover and JCB).  PCI DSS is a rigorous set of security requirements (“Requirements”) designed to ensure that all companies that process, store or transmit credit card information maintains a secure environment in order to protect cardholder data.  “Cardholder data” is any personally identifiable data associated with a cardholder, such as an account number, expiration date, name, address, social security number, etc.

Every merchant that accepts credit cards agreed to abide by the PCI DSS as part of their merchant account processing agreement. See e.g., NPC Merchant Processing Agreement at § 12.B.ii, 14.O. Failure to adhere to these requirements can lead to stiff penalties, an exorbitant PCI DSS non-compliance fee, and/or increased transaction fees or a termination of the right to accept credit cards.

If a security incident, such as a data breach, occurs, a business is potentially liable for the following charges:

  • Data Security Fine– Up to $500,000 fine per security incident.
  • PCI Non-Compliance Fines– Up to $50,000 per day for non-compliance with published standards.
  • Card Replacement Fees– $3 – $10 per card x total number of cards compromised.
  • Refund Fees– Potentially held liable for all fraud losses incurred from compromised account holders.

These penalties are assessed by credit card brands, acquiring bank, and the merchant’s credit card processor, and are in addition to other losses, such as harm to business reputation, that can result from a data breach, as I discussed in an earlier blog post.

To avoid this parade of horribles and decrease the likelihood that cardholder data will be lost, small to mid-sized businesses need to regularly comply with PCI DSS requirements.

Compliance with PCI DSS is an ongoing process and typically involves the following four steps:

  1. PCI DSS Scoping– Determines what organization system components and computer networks are in scope for PCI DSS assessment.
  2. Assessing– Exam and assess the compliance of system component and computer networks in scope following the testing procedures for each PCI DSS Requirement.
  3. ReportingPCI DSS Qualified Security Assessor (QSA) and/or business submits required documentation to validate compliance with PCI DSS (e.g., Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC)), including documentation of all compensating controls.
  4. Clarifications– QSA and/or business clarifies ROC and/or SAQ, if need at the request of the acquiring bank, processor or payment card brand.

The first two steps will be discussed in this week’s blog post and the last two will be discussed next week.

I.   SCOPE OF PCI DSS REQUIREMENTS

The first step of PCI DSS is to accurately determine the scope and breadth of the environment in your business regarding credit cardholder data.  The Cardholder Data Environment (CDE) is composed of all people, processes and technology that handle or have access to cardholder data or sensitive authentication data.  The scoping process includes identifying all system components that are located within or connected to the CDE and can include the following:

  • Network devices (wired and wireless)
  • Servers
  • Applications
  • Virtualization components, such as virtual machines, virtual switchers/routers, virtual appliances, virtual applications/desktops, and hypervisors.

Scoping needs to occur at least annually and prior to the annual assessment for PCI compliance validation. An organization must identify all locations and flows of cardholder data to ensure that all applicable parts of the CDE are included in the scope of PCI DSS assessment.

Network Segmentation

One helpful way to reduce the scope of PCI DSS assessment is to use segmentation, which isolates cardholder data environment from the remainder of your organization’s network.  Reducing the scope of PCI DSS assessment can lower the cost and difficulty of maintaining PCI DSS controls and reduce the risk for you business.

To be outside the scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that the security of cardholder data would not be compromised if the security of the out-of-scope component was compromised. More details on segmentation are contained in the Requirements at p. 11 and in Appendix D.

Use of Third Party Service Providers/Outsourcing

Another helpful way to reduce the scope of your PCI DSS assessment is by using a third-party to store, process or transmit cardholder data on your behalf or to manage CDE components. If you use third party service providers, however, you must clearly identify the specific roles and responsibilities of the service provider with respect to cardholder data and PCI DSS. PCI DSS specifically calls for developing and maintaining a responsibilities matrix for each service providers. See id. at Requirement 2.2.1.

Many service providers have these matrices available to describe their standard service to PCI merchants. To obtain one, simply ask for the “PCI Responsibilities Matrix.” If your service provider does not have any idea what you are talking about, it’s time to find a new service provider. PCI DSS allows you to outsource much of the handling of cardholder data to third-parties, but you cannot avoid responsibility for ensuring that the data is kept secure and complying with PCI DSS.

II.  PCI DSS ASSESSMENT

The second step is to assess whether your business’s CDE complies with the 12 PCI DSS Requirements and the accompanying procedures contained in the Requirements. There are two main ways to fulfill your assessment obligations:

  1. Hire a PCI DSS QSA
  2. Do-It-Yourself

Hiring a PCI DSS QSA

PSI DSS QSA’s are organizations that have been certified by the PCI Security Standards Council to assess compliance with PCI DSS standards. QSA’s perform data security assessments, make recommendations, and certify compliance. Hiring a QSA will save you the time it would take to perform your own PCI DSS assessment and provide you with the peace of mind that the job was done properly.

The big downside to hiring a QSA is cost. QSA fees are generally quite expensive. One quote charged a base $5,000 fee plus $200 for every hour. Additional costs may include the equipment/software to fix whatever problems the QSA finds, which is also costly.

If you’re interested in hiring a QSA, here is a list of PCI DSS certified QSA companies.

Do-It-Yourself

Another way to assess your CDE for PCI DSS compliance is to do-it-yourself.  This may seem like a daunting task but it can be done and may not be that difficult depending on the complexity of your organization and how you process cardholder data.  The PCI SSC website provides a helpful section here that is geared towards helping small merchants comply with the Requirements.

The website also provides a helpful Quick Reference Guide that summarizes the Requirements.  It is a must-read for any business that accepts credit cards and is considering conducting their own PCI DSS assessment.  The Guide is a fairly readable 40 pages with helpful tips and explanations.

Here’s a brief overview of the Requirements and some tips for assessing in order to give you an idea of about whether self-assessment is feasible. This overview is not sufficient to assess whether your organization’s CDE complies with the Requirements. To conduct your assessment, you need to review the Requirements and follow the procedures for assessment.

Requirement 1:  Install and Maintain a Firewall Configuration to Protect Cardholder Data

This Requirement is fairly straightforward and easy to implement.  A firewall should be installed on any network, computer or device that is part of your CDE and contains or accesses cardholder data.  For most small businesses, this means ensuring that your PC’s and network have a firewall.  Most operating systems come with some sort of security package that includes a firewall.  Just make sure that you regularly check to see that the firewall is working, and update it as necessary.  If you don’t have a firewall, look into a commercial firewall, such as Symantec, to install on your computer and protect your network.

Requirement 2:  Do Not Use Vendor Supplied Default Passwords

This Requirement is also fairly straightforward and easy to implement.  The easiest way for a hacker to access your internal network is to try vendor default passwords or default system software settings in your payment card infrastructure.  Far too often, merchants do not change default passwords or settings when hardware or software is deployed.

 Don’t let this happen to you! Change your vendor supplied passwords and system settings immediately.  Follow these Microsoft Tips for Creating a Password when choosing a new password or use this password generator.

Requirement 3:  Protect Stored Cardholder Data

As a general rule, cardholder data should not be stored unless it is absolutely necessary to meet the needs of your business. Sensitive data on the magnetic stripe or chip must never be stored.

If your business stores the primary account number associated with a credit card, it must be made unreadable through encryption or other technological measures. This can get very expensive and risky, so consult with a QSA to ensure compliance with PCI DSS. Best practice, however, is not to store any cardholder data.

Requirement 4: Encrypt Transmission of Cardholder Data across Open Public Networks

Cybercriminals may be able to intercept transmissions of cardholder data over open public networks, so it is essential to prevent their ability to view this data.  Encryption renders transmitted data unreadable by an unauthorized person.

If you accept credit card data on your website, then you should obtain an SSL Certificate.  A SSL certificate ensures than any sensitive data transmitted through your website is encrypted. One place to use a SSL is on a payment page during checkout.  There are plenty of SSL Certificate vendors out there, so choose one that’s reputable.

If credit card data is transmitted over a wireless network, your wireless router should be password-protected and encrypted.  This is fairly easy to do and your wireless router should have instructions about how to password protect and encrypt your router.  Encrypt your  wireless router with the industry standard IEEE 802.11i (WPA2) and not WEP, which is no longer accepted as a security control by PCI DSS.

Requirement 5: Protect systems against malware and regularly update anti-virus software

This is also a no-brainer and easy to do.  Use anti-virus software on all systems, such as PCs and servers, commonly affected by malicious software.  This anti-virus software should be kept current, perform periodic scans, and generate audit logs that need to be retained according to PCI DSS Requirement 10.7.  Make sure that the anti-virus mechanisms are continuously running and cannot be disabled or altered by users.

Requirement 6:  Develop and Maintain Secure Systems and Applications

Security vulnerabilities in systems and applications allow criminals to access cardholder data. Some of these vulnerabilities are eliminated by using PCI approved PIN transaction security devices (i.e. PIN pads and credit card terminals) and PCI validated POS (Point-of-Sale) & payment gateway software.  Check the links above to make sure your current security device is compliant and your current software is validated.  If not, both should be upgraded.  Regularly install all vendor-provided updates, software and security patches to maintain compliance.

Requirement 7: Restrict Access to Cardholder Data

Cardholder data should only be accessed by authorized personnel and not by everyone in your company. Put systems and processes in place to limit access based on need to know and according to job responsibilities. Janitorial staff that cleans your offices should not be permitted to have access to cardholder data!

Requirement 8:  Identify and Authenticate Access to System Components

Assign a unique identification (ID) to each person with access to cardholder data and don’t allow sharing of ID’s. You want to be able to trace all activities relating to cardholder data on your system to known and authorized users. If there is a problem, you will be able to determine and isolate the source in order to prevent additional difficulties. If an employee with authorized access gets terminated, lock out their ID and prevent them for continuing to access cardholder data.

Requirement 9: Restrict Physical Access to Cardholder Data

Any physical access to data or systems that house cardholder data provides an opportunity for a person to access or remove devices, data, systems or hardcopies. To minimize this risk, restrict access to appropriate personnel and develop procedures to ensure that only appropriate personnel have access to cardholder data.

One way to do this is through the use of ID cards that only allow certain employees to have access to certain areas. Visitors should only be allowed access to certain locations, such as the front of a cash register, and not be allowed to view cardholder data. Furthermore, all media containing cardholder data should be locked in a secure location that only authorized personnel can access.

Requirement 10:  Track and Monitor All Access to Network Resources and Cardholder Data

Organizations must also track and monitor all access to cardholder data and related network resources. Logging mechanisms and the ability to track user activity are critical for effective forensics and vulnerability management, and a merchant must ensure the presence of logs that allows thorough tracking and analysis in the event something goes wrong and cardholder data is improperly accessed.

Requirement 11:  Regularly Test Systems

An organization must also have their system scanned for internal and security vulnerabilities by an Approved Scanning Vendors (ASVs).  ASVs are organizations that validate adherence to certain PCI DSS requirements by performing vulnerability scans of merchants and service providers.

Internal and external vulnerability scans are conducted in a similar fashion.  Both scans are automatically administered via a computer program and an Internet connection, but one program usually cannot simultaneously conduct both scans.  An external vulnerability scan looks for holes in your network firewall(s), where malicious outsiders can break in and attack your network.  By contrast, an internal vulnerability scan operates inside your business’s firewall(s) to identify real and potential vulnerabilities inside your business network.  Internal scans may be performed by internal staff, but all external scans must be performed by ASVs for PCI DSS compliance.  Scans must be performed as needed, until passing scans are obtained.

To comply with PCI DSS, your business needs to pass an initial internal and external scan, and then pass 4 consecutive quarterly scans in subsequent years.  As part of these scans, regularly check PIN entry devices and PCs to make sure no one has installed rogue software or “skimming” devices.  Talk to your ASV to make sure that they are checking for this and for tips about how to monitor yourself.

Requirement 12:  Maintain a Policy that Addresses Information Security for all Personnel

Your organization must also develop and maintain an information security policy that informs employees of their expected duties related to security.  All employees should be aware of the sensitivity of cardholder data and their responsibilities for protecting it.  This policy should be reviewed annually and updated when the environment changes.

That’s it for this week.  Thanks for reading and please let me know if you have any questions. Check back next week for the last two steps that need to be taken in the process of complying with PCI DSS.

How to Prepare for A Data Breach (Part 2)

Tags: , , Business, Data Breach, Preparation, Small Business, Uncategorized 1 comment

In addition to the steps discussed last week, a business should take the following steps to prepare for a data breach:

Step 5: Arrange Possible Remedies for Customers

A recent study shows that 25% of individuals notified of a data breach go on to suffer identity theft.  To combat this, most companies now offer – and consumers expect – some form of credit monitoring services for affected individuals.

Credit monitoring services are directed at fraud in connection with new financial accounts.  This fraud occurs when a criminal uses a victim’s personal information to open a new credit card or other financial account.  Credit monitoring does not prevent the opening of new accounts, but notifies an individual when a new account is opened, so that the individual can determine whether it is fraudulent.

Although credit monitoring service is nice, it is not that effective at actually preventing identity theft and is often a waste of money.  See Brian Krebs “Are Credit Monitoring Services Worth It?”  Notably, there are at least five types of identity theft fraud not covered by credit monitoring services:

Existing account fraud:  Occurs when a criminal uses an individual’s current financial account, such as a credit card account or bank account, to make a purchase from a vendor or withdraw money from the individual’s bank account.

Social Security number and tax refund fraud:  Occurs when a criminal uses an individual’s SSN to obtain employment, for tax reporting purposes, or for other illegal transactions.  Tax refund fraud is a rapidly growing problem and the IRS is attempting to combat it.

Criminal identity theft:  Occurs when an imposter provides another person’s name and personal information to a police officer during an arrest.  The imposter often fraudulently obtained a driver’s license in the victim’s name and provides the identification document to law enforcement.

Medical Identity Theft:  Occurs when a crook uses an individual’s name and/or other information, such as insurance information, to obtain or make false claims for medical goods or services.  Medical identity theft may result in false entries being entered into a medical record, or the creation of fictitious records in the victim’s name.

See Privacy Rights Clearinghouse, Fact Sheet 33: Identity Theft Monitoring Services.

To try and combat some of these other types of identity theft, many vendors now offer expanded identity theft monitoring services that provide additional monitoring services, such as monitoring commercial and public databases and online chat rooms.  These services vary widely, so you’ll need to investigate carefully to determine what service is best for your customers in the event of a data breach.  The Consumer Federation of America provides some helpful guidance about selecting an identity theft service provider and some assessments of the services offered.  See Consumer Federation of America: Best Practices for Identity Theft Services: How Are Services Measuring Up? Things may have changed since 2012, so make sure to update the information and look for additional identity theft monitoring service providers.

By looking into remedies now, you will be able to evaluate and assess the complete range of available remedies, and select the one that makes the most sense for your customers and business in the event of a data breach. You may also be able negotiate the best price and gain service concessions. None of this could be done in the middle of a data breach crisis.

Step 6: Draft Incidence Response Plan

You can now be begin drafting your Incident Response plan (the “Plan”). As a word of warning, this document can get very long and detailed, depending on the size and complexity of your organization. There are a lot of available on-line guides that can give provide guidance, such as the guides at the SANS Information Security Resources, However, to ensure the Plan is done properly, you may want to consult with a privacy and data security attorney or some other third-party vendor.

The basic elements to include in the Plan are:

Overview:  The Plan should have an overview section that outlines the goals, scope, purpose and assumptions of the Plan.

Roles and Responsibilities of Incident Response Team members:  The Plan should identify each incident response team (the “Team”) member, their contact information, and his/her role or responsibility.  It is better to have this information in writing so each Team member knows exactly what he/she is responsible for when a data breach occurs.  This information should be continuously updated, especially if one member leaves the organization.

Incident Definition and Classification:  The Plan should create an event classification system that defines what constitutes an incident, when an incident is serious, and the specific types of incidents that will set the plan in motion.  For example, port scans are not usually particularly serious, and it is doubtful that these events will set the Plan in motion. But a web security breach or a malware infection should warrant a more urgent response and the Team may need to be notified and the Plan set in motion.

Notification:  The Plan should identify the specific triggers to notify and procedures to follow when notifying the following:  the Team, insurers, law enforcement, outside attorneys, third-parties and customers.  Depending on the type and severity of the event, these groups will be notified at different times, and there will be specific procedures that need to be followed.  Include all statutory and contract breach notification requirements in the Plan.  Also include all insurance notification requirements.  If you choose to use a third-party vendor to notify customers, include all relevant contact information and details of any negotiated deal in the Plan.

Current Network Infrastructure & Payment Processing Systems:  The Plan should also identify, diagram, and include all supporting documentation regarding your organization’s web system architectures, network infrastructure, information flows, payment processing systems, and any other applicable system that contains or processes sensitive personal information.

Existing Security Safeguards:  The Plan should identify all currently operating safeguards that can assist with detection and prevention, including an intrusion-prevention system (IPS), firewall, web-application firewall (WAF), and endpoint security controls for the web, applications, and database servers.

Detection, Investigation and Containment:  The Plan should outline the procedures for detecting, investigating and containing the incident.  Keep in mind that these procedures should vary by the type of incident, the system involved, and may involve contacting third-parties such as law enforcement and forensic investigators.  Identify the circumstances when these third-parties will be brought in and include all potentially relevant information in the Plan.

Customer Remedies:  If your organization chooses to offer remedies to customers, such as identity protection service, then your Plan should identify the specific circumstances when the remedies will be offered. It should include the contact information of the third-party service provider and the terms of any deal that was negotiated.

Eradication, Cleanup and Recovery:   The Plan should also contain the procedures to follow to get the infected system back up and running.  The cleanup will vary depending on the type of system and the type of attack, but you want policies and procedures in place about how to handle it.  In order to preserve other parts of your IT system, you also want to have procedures about the steps to take before putting the infected system back into production.

Post-Incident Review and Follow-up:  Your Plan needs to include the date for a mandatory follow-up meeting with the Team in order to learn from the incident.  The purpose is to process all of the information that was learned from the incident and figure out if your security posture needs modification to prevent future attacks.  There are likely several questions that will need to be addressed, but try to avoid spending the meeting finding someone to blame. It will be a waste of time and energy and will not improve the security of your organization.

Step 7: Employee Awareness and Readiness Training

As part of your organization’s privacy program, your employees are probably already trained on privacy fundamentals like data collection, retention, use and disclosure.  Your organization should also train every employee about basic breach response procedures and protocols, like what constitutes a data breach and whom to call if a data breach is suspected.  You should also require third-party vendors to do the same.  Team members should receive regular in-depth training about how to investigate a data breach, report findings, and communicate with media and regulatory authorities.  Any completion of required training should be documented and reported to management for internal policy compliance.

Step 8: Crisis Simulation & Revision

It is important to know how your organization will fare during a breach crisis and identify and correct any gaps.  The best way to assess your organization is by running two types of breach crisis simulations: a table-top exercise and a “live” simulation.

A tabletop exercise is a simple way to practice executing your Plan without the expense or interruption of a full scale drill.  In a tabletop exercise, Team members talk through a breach crisis scenario in a “war room” type of setting.  These exercises should involve everyone on the Team so that every member has an opportunity to think through their role during a breach event.

“Live” simulations are more elaborate and tend to mimic real-world conditions more closely than tabletop exercises.  “Live” simulations are usually impromptu events that can occur at any time, including the evening or a holiday, like a real breach.  The most effective simulations involve breach response vendors that your organization has contracted with, as well as your internal Team.  In a “live” simulation, systems are actually compromised and even social media uproars can be created. Talk with your service providers to develop simulation exercise that includes everyone.

After conducting simulations, evaluate the effectiveness of your Plan to identify any gaps in your organization’s response.  Revise your Plan to fill these gaps and ensure that your organization improves.

If you follow all eight of these steps, your organization will be better prepared for the inevitable data breach.  Thanks for reading.  Please let me know if you have any questions or wish to offer suggestions based on your experience.

How to Prepare for a Data Breach (Part I)

Tags: , , Business, Data Breach, Preparation 1 comment

In the last blog post, I discussed ways that a business can try to prevent a data breach. The sad and unfortunate reality, however, is that no matter what you do, most privacy and security experts agree that your business is going to suffer a data breach.  See J.F Rice, “Are Breaches Inevitable?” Computerworld, Sept. 3, 2014. The Ponemon Institute, a leading research center, puts the probability of suffering a material data breach of more than 10,000 records in the next two years at 19%.  See Ponemon Institute, 2014 Cost of Data Breach at 1-3.

So what should a business do? Start planning NOW for a data breach by creating an Incident Response Plan that your organization will follow in the event of a data breach.  Doing so can reduce the cost of a data breach by, on average, $18 per record. Id. There are eight steps involved in preparing for a data breach and creating and implementing an adequate Incident Response Plan. The first four steps on how to prepare for a data breach will be discussed today, and the next four steps will be discussed next week.

Step 1: Assemble an Internal Incidence Response Team

Data breaches are multi-faceted events that require coordinated strategies and responses across the organization. To deal with one, you need an incidence response team with representatives from all of your company’s functional groups.  At the very least, your incidence response team should include representatives from the following groups who are available 24/7 in the event of an after-hours emergency:

Executive Management: Ideally, your team should have a management level executive with broad decision-making authority to insure that the breach management process moves quickly. A quick response time and effective implementation are critical factors when trying to minimize the financial and reputational harm that can occur from a data breach.

If an upper management executive can’t be spared, some companies appoint a lead on the incident response team with delegated authority to take certain actions and make certain decisions. This approach is a great alternative, but it will be inefficient when an action exceeds the lead’s delegated authority and requires approval from the executive management team. But this inefficiency will have to be tolerated in the absence of an upper level executive.

IT and Security: IT and security team member play a critical role by identifying the problem with your computer system as they are the most familiar with the network systems and security controls in your organization. Usually, however, the internal IT and security team does not conduct the forensic investigation that is needed to track down the breach and how it occurred.  Instead, you will need an outside forensic group that possesses specialized skills and training to perform digital forensic identification and mitigation of the breach. Your internal team will be the liaison with this outside forensic group and work with them to explain your network and its security controls.  Don’t try to cut down costs by avoiding the outside forensic group.  Although your internal IT staff might be outstanding, it will cost you more time and money over the long run by having them try to identify the breach. Remember that time is critical and you want to identify the problem and fix it as soon as possible. Better to use reputable forensic specialists for this task.

Legal and Compliance: You need someone from legal and/or compliance to identify the notification, legal and regulatory requirements of the breach response. This includes determining if there is an obligation by law or contact to notify internal organization clients or business partners of the breach and what the content of the notice should be. Breach notification requirements vary by state and contract, so you will need someone from legal and/or compliance to make sure you fulfill your legal obligations with respect to the data breach. This will be discussed more fully below at Step 4. If your organization does not have a legal department, hire an outside attorney who specializes in privacy and data security to help you understand your notification obligations in the event of a data breach.

Public Relations/Communications: You should also have someone who is responsible for disseminating information about the breach to your internal organization and coordinating the response to external public. With respect to the internal organization, your internal communications team will make sure that all your employees have talking points about the breach if they are approached.  For external communications to the public, you should hire a PR firm that specializes in crisis communication, and have this PR firm take directions and work closely with your internal communications team to coordinate the response.  Don’t skimp by trying to have your internal communications team handle the media and public communications. Your reputation and business could be irreparably harmed if public communications are done poorly or improperly.

Customer Service: After a data breach, customers have lots of questions, especially ones who are worried about identify theft and fraud. Your organization’s customer service department plays an important role in rebuilding your customers’ trust and ensuring that they understand what happened and how your organization is responding.  If your organization cannot handle the anticipated call volume, many organizations engage a call center and set up a dedicated hot-line that consumers can call to get information about the breach.  Websites have also proven to be useful, so that is another option to be considered. No matter what method used, you will need your customer service department to help you understand the best way to regain your customers trust.

For small organizations, it may not be possible to have different people serve these different functions, since there may not be a separate communications or a legal department. That doesn’t matter. The important point to recognize is that these roles are needed if a data breach occurs, and the business needs to identify who is going to fill them – even if it’s the same person!

Step 2: Establish Relationships with Breach Response Vendors and Law Enforcement

The second step is to establish relationships with breach response vendors, regulators and law enforcement before having a data breach.

With respect to regulators and law enforcement, reach out to the relevant Attorney Generals, Secret Service, FBI, and any other relevant regulator to introduce your business and discuss data privacy issues as soon as possible. It shows that your organization is serious about data protection and privacy and might earn your regulators’ trust and respect. You don’t want your first introduction to be when you report a data breach! A prior personal relationship may aid you when it comes time to report a data breach, and the regulators may be more inclined to offer advice, listen to your side of the story, and give you the benefit of the doubt about the steps you have taken.

With respect to vendors,  several types of third-party vendors perform critical functions and are needed during a data breach.  The most relevant to investigate provide the following services: Computer forensics, public relations, notification activities, consumer remedies (credit monitoring and identity theft), call centers, and legal services.

By contacting vendors before a breach occurs, you can explore the different options available and determine the best option for your organization. It is much more difficult to assess options while in the middle of a crisis, and you are more likely to purchase services that you don’t need. Also, if you are reaching out to a vendor for the first time in the middle of crisis, you are much more likely to be charged a higher rate for emergency services. By preparing in advance, you can negotiate on price and services and get the best available deal.

Step 3: Cyber-Liability Insurance

As part of your incident response plan, consider whether your organization needs cyber-liability insurance. Effective May 1, 2014, the Insurance Services Office (ISO) revised its Commercial General Liability (CGL) Policy form to exclude losses associated with a data breach.  See Insurance Journal, ISO Comments on CGL Endorsements for Data Breach Liability Exclusions, July 18, 2014.  Since the vast majority of U.S. CGL polices are partially or completely written on ISO’s standard form, your organization’s future CGL policies will likely exclude data breaches, if they don’t already.

To correct this insurance gap, consider purchasing cyber-liability insurance, which provides coverage two categories: first-party or third-party losses. First-party losses are the expenses incurred as a direct result of responding to the breach, such as computer forensics, public relations, notification costs, and others. Third-party losses are the losses incurred from claims for damage brought by customers, consumers, and others. Depending on your organization’s needs, it may be wise to purchase insurance for one or both types of losses. Given the exorbitant costs of a data breach, it may be well worth it.

Step 4: Determine Breach Notification Requirements

Organizations should be familiar with the data breach notification requirements that govern their company in the event of a data breach. These requirements come from two sources: contracts with third parties and the states where you conduct business and/or have customers.
Nearly all of the states (47 states plus the District of Columbia, Puerto Rico, and the Virgin Islands) have passed some form of a data breach notification law. These laws contain the following general categories of information:

•  The definition of “personal information” identifying specific data elements that trigger reporting requirements;
•  The definition of what entities are covered;
•  The definition of a “security breach” or “breach” of a security of a system”
•  The level of harm requiring notification;
•  Whom to notify;
•  When to notify;
•  What to include in the notification letter;
•  How to notify
•  Exceptions that may exist to the obligation to notify (or when notification may be delayed);
•  Penalties and rights of action.

Although all breach notification laws contain the same general categories of information, the details often differ drastically and you need to know what specific states apply to your organization and what is required by the state’s breach notification law. For example, Massachusetts differs substantially from many other states about who needs to be notified and the content of the data breach notification letter. See M.G.L. c. 93H. Consult with an attorney and/or a data breach notification vendor to help you assess your current situation and determine what breach notification statutes are applicable.

After determining the requirements from the relevant breach notification statutes and contracts, create a chart or spreadsheet that identifies the critical details for each state, when these requirements are triggered, and the steps that need to be taken in the event of a data breach. This chart will become part of your incident response plan, so update it regularly so that it remains current. All of this may become moot if a national breach notification statute is ever passed, but I’m not going to hold my breath.

This completes the first four steps about how to prepare for a data breach and develop an incidence response plan.  Thanks for reading. Check back next week for Part II.

Basic Steps to Prevent Small Business Data Breach

Tags: , , , Data Breach, Prevention, Small Business 1 comment

It seems like every day in the news; another data breach is reported where millions of records are lost. In the past year alone, the following major data breaches occurred:

Target – Lost 40 million credit and debit cards, along with 70 million customer records, including name, address, email address and phone number.

Home Depot – 56 million debit and credit cards stolen and 53 million email addresses.

eBay – 145 million active users’ data at risk.

JP Morgan Chase – 76 million households and 7 million small businesses.

Community Health Systems – 4.5 million patients.

Goodwill/ C&K Systems– 868,000 cards at 300 stores.

Although large companies make the headlines and grab our attention, small businesses are also targets for cyber-attacks.  In 2013, Symantec reported that 31% of all targeted attacks were directed at businesses with less than 250 employees.  See Symantec 2013 Internet Security Threat Report.  This finding was echoed by a study conducted by the Ponemon Institute, which found that 55% of small businesses in the U.S. have had a data breach.

Despite this, a majority of small businesses do little to protect themselves from a cyber-attack or protect the sensitive information of their customers and employees.  This inattentiveness is extraordinarily risky.  The average cost for a data breach in 2014 is $201 per record and the probability of a business having a data breach over the next 2 years with more than 10,000 records is nearly 19%See Ponemon Institute, 2014 Cost of Data Breach Study, at 1-3.

These numbers should terrify every small business owner. But there are 7 cost-effective basic steps that a small business can take to decrease the likelihood of a data breach:

1) Identify:  The business should first identify all types of personal and confidential information (“Personal Information”) collected, possessed and used by the business.  Personal Information can include: names & addresses, financial account numbers, social security numbers, e-mail addresses, license numbers, health care information, video rental records, and anything else that can allow the business to identify a specific individual or company.

2) Locate:  Next, the business should determine where the Personal Information is located and stored and where it comes from. Locations can include workplace files, computers, mobile devices, websites, networks, and many other places.  Employees and owners should be questioned about all of the places where they store Personal Information, since they might have data on their home computers and personal mobile devices.

3) Evaluate Risks: The business should then identify and evaluate all potential risks to the security, confidentiality and integrity of the Personal Information in the business.  Risks come in all shapes and sizes and can include natural disasters, cyber-attacks, theft, use of mobile devices & laptops, negligent employees, accepting credit cards, and many, many others.

4) Implement safeguards: After evaluating the potential risks, the business needs to implement reasonable safeguards to mitigate these risks. Safeguards come in three different forms: Physical, Administrative, & Technical.

Physical Safeguards: These are the physical protections, rules, and procedures a business takes to secure Personal Information from physical threats such as natural disasters and unauthorized intrusions. Depending on the business, these safeguards can include: Offsite secure storage, Locked doors and file cabinets, fences, security guards, cameras, passwords, ID cards and other authentication measures for computer/facility access, regular automated backups, and many other possible preventative measures that can be taken.

Administrative Safeguards: These are the management measures, policies, and procedures that an organization puts in place to protect Personal Information. These measures should include:

• Written Information security policy
• Incident response plan
• Internet usage policy
• Social media policy
• Mobile phone policy
• Bring your own device policy
• Specific limitations on employees’ access to information
• Rigorous protections and oversights in third-party vendor contracts
• Employee background checks
• Employment contracts with confidentiality clauses and restrictive covenants, and
• Others depending on the nature of the business.

Technical Safeguards: These are technological measures implemented by an organization to manage and protect Personal Information. These measures should include:

• Keeping hardware, operating system software and apps up to date;
• Using and updating antivirus and antispyware on all computers and devices;
• Using firewalls and virtual private networks to secure sensitive information; and
• Requiring strong passwords with quarterly changes.

Depending on the size and complexity of the organization, and the size of the information security budget, there are many more advanced protections that can be implemented. But the foregoing is the bare minimum that should be done by every business to help protect the organization.

5) Train Employees:  This point cannot be emphasized enough.  Businesses should regularly train employees on the proper way to collect, use and store personal information.  Employees also need to be trained about the nature of today’s cyber-attacks and the best way to protect themselves and the organization.  Cyber-attacks usually begin when an individual opens a “phishing” email message with an attachment that contains malware that infiltrates your network. To stop this, a business should employ a spam filter that will try to catch phishing e-mails and other junk.  But even the best spam filters are not always successful. Employees need to be vigilant and trained not to open anything that seems even remotely unusual.  One isolated training session is not enough, and a business should regularly hold training sessions to emphasize the importance of privacy and information security.

6) Destroy:  Any personal information that is no longer being used by the business should be destroyed.  Paper documents and paper files should be shredded, pulverized, macerated, or burned.  If you hire a company to do this, make sure that the vendor has a good reputation, there are sufficient contractual protections to safeguard the data, and that you understand the vendor’s destruction and disposal practices.  Do not just throw your unshredded sensitive paper documents in the dumpster near your business.

Computers and other electronic storage devices and the information stored on them are a little more difficult to destroy. Merely deleting the information is not enough, and steps need to be taken to overwrite or physically destroy the electronic device and computer. Different electronic devices need to be wiped clean in different ways. If you want to do it yourself, there is plenty of information on the internet about this process.  See, e.g. https://www.us-cert.gov/security-publications/Disposing-Devices-Safely; http://it.med.miami.edu/x677.xml; https://www.privacyrights.org/personal-data-retention-and-destruction-plan#destruction.  If you want to hire a vendor, make sure that they have a good reputation, there are sufficient contractual protections to safeguard the privacy of the data, and that you understand how the device is going to be wiped or destroyed.

7) Monitor and Repeat: After completing the prior steps, you should continuously monitor your systems, networks, and business to make sure that the safeguards are working.  If the there are problems, or your business needs change, you may need to revise or implement the security practices that were put in place.  This is an ongoing process and cyber-threats are continuously evolving.  You need to be vigilant in order to have the best chance of preventing a data breach.

Following these steps will not guarantee that your small business won’t have a data breach.  But they are cost-effective and should decrease the likelihood of a data breach.  Your business will also be in a better position to determine whether more expensive protections are needed.

Thanks for reading! I would love to hear if you have other suggestions or there is something else your business is doing to protect itself from a data breach.