hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015Risks: Spotlight on privacyIn the enterprise, risk is a broad security concept—it is evaluated and then managed,remediated, reassigned, or simply accepted. But to many consumers and enterprises in 2014,risk could be narrowed down to one question and one response: Is my private information indanger of being exposed? Fix it!Though 2013 put high-level privacy issues in the spotlight with Edward Snowden’s surveillancedisclosures, it was 2014—The Year of the Data Breach, 104, 105 with shops from Neiman Marcusto Goodwill in the spotlight—that truly drew the attention, and ire, of business and consumeralike. A landmark decision further ensured that commercial enterprises must considerthe confidentiality, integrity, and availability of user information—the three core tenets ofinformation privacy—in their security equations.We’ll look more closely at the mechanics of data breaches, specifically point-of-sale breaches,later in this Report. For now, it’s worth noting that attackers tallied considerable data-breachtotals in 2014, with at least a dozen reported compromises affecting more than 10 millionrecords apiece and three—Home Depot, eBay, and a group of South Korean financial entities—reporting over 100 million affected records apiece. 106 These numbers ignore both Target’s 110million-record breach, which may be said to have kicked off the mayhem in December 2013, andthe highly publicized “CyberVor” incident, which likely overstated its claims to holding 1.2 billionrecords but raised privacy and data security yet again as a topic of wide concern.104http://www.techrepublic.com/article/prevent-2015-from-becoming-another-year-of-thedata-breach/.105http://www.darkreading.com/attacksbreaches/the-year-of-the-retailer-databreach/d/d-id/1317462.106http://www.breachlevelindex.com/#!breachdatabase.107http://www.ftc.gov/news-events/pressreleases/2012/06/ftc-files-complaint-againstwyndham-hotels-failure-protect.108http://ashkansoltani.files.wordpress.com/2014/04/ftc-v-wyndham-opinion.pdf.109https://privacyassociation.org/news/a/ftc-v.-wyndham-round-one/.110http://ashkansoltani.files.wordpress.com/2014/04/ftc-v-wyndham-opinion.pdf.111https://privacyassociation.org/news/a/thewyndham-decision-where-does-cybersecuirtylegislation-go-from-here/.112http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214-final.pdf.113http://www.executivegov.com/2014/01/reportgovcon-procurement-cybersecurity-could-seechanges-in-new-defense-policy-bill/.114https://www.congress.gov/bill/113th-congress/house-bill/5793?q={%22search%22%3A[%22cyber+security+chain+management%22]}.115http://docs.law.gwu.edu/facweb/dsolove/files/BNA%20FTC%20v%20Wyndham%20FINAL.pdf.Of course, a larger breach may not affect all or even most of the users whose records it touches,and a breach of just a few records can be disastrous if the right individuals’ information isobtained. The Wyndham Hotels and Resorts lodging chain, for instance, was breached threetimes in 2008 and 2009, with under a million records affected in total—hardly a blip onthe radar in 2014. However, a 2012 suit brought by the Federal Trade Commission againstthe company alleged that the chain made multiple false claims in its privacy policy aboutsecurity measures in place to protect consumer data, and that its failure to actually safeguardconsumers’ information caused substantial injury in violation of Section 5 of the FTC Act,which governs unfair or deceptive practices. 107 That case became Federal Trade Commission v.Wyndham Worldwide Corp. 108Wyndham argued that the FTC didn’t have the authority to set unfairness standards forcybersecurity—and that it was the businesses (specifically banks and credit-card issuers) whopay to cover breach costs, not the consumers whose private information is affected, who areactually harmed by such breaches. 109 It also argued that the FTC must issue regulations aboutcyber security before making any claims about its fairness or lack thereof. 110The ruling came back at the District level in April, and the FTC won on all three counts—aremarkable judicial affirmation of the FTC’s role in enforcing data-security standards in supportof consumer privacy. 111 (The ruling is under appeal at the Circuit level.) As other governmentagencies and legislative bodies struggle to address cyber security—whether throughframeworks (NIST) 112 or procurement rules-making (Department of Defense) 113 or proposedlegislation (HR 5793) 114 —the FTC’s case puts privacy firmly in the cyber security conversation. Inthe words of legal scholars Woodrow Hartzog and Daniel Solove, “the implications of this casecould not be more important for data security as well as for privacy.” 11540