Top 5 Data Breach Excuses Of 2011 (And What They Really Mean): Part 3

BLAME IT ON A THIRD PARTY/MALWARE/THE WEATHER - Frequently throughout the year.... With so much out-soucing today, it's easy to divert attention away from your role in allowing data to be breached, by focusing on slopping practices of third party suppliers and contractors (while not saying of course that it was you who hired them in the first place/were responsible for procurement policy). i.) Boston Hospital Reports Data Breach Affecting More Than 2K Patients - but it wasn't their fault. "Boston's Beth Israel Deaconess Medical Center reported a security breach that could have compromised the personal information of 2,021 radiology patients, Boston Business Journal reports (Moore, Boston Business Journal, 7/19)." Officials said the hospital's intrusion detection system identified the breach after a radiology workstation computer was found to be transmitting data to an unknown location via the Internet (Goedert, Health Data Management, 7/19). The hospital said a computer service vendor had failed to restore proper security settings after performing routine maintenance on the machine (Bray, Boston Globe, 7/19). The workstation later was found to be infected with malware that used a port on the workstation to encrypt and transmit data. ii.) Texas Comptroller Susan Combs sought to share some of the blame for a huge data breach by pointing the finger at other agencies for failing to encrypt the confidential data before sending it. But the agencies — the Workforce Commission and the retirement systems for teachers and state workers — all disputed that claim and said they had sent their data securely. For most of the 3.5 million Texans whose personal data was left exposed online for about a year, the technical issues probably don’t matter much as they wonder if their names, Social Security numbers and other personal information are being sold on the black market to the highest bidder. But for an elected official with political ambitions, such as Combs, finding a technical way to spread the blame for such a high-profile debacle could be paramount. Doug Holt, the state’s chief information security officer, undercut the comptroller’s search for cover in a letter to Combs’ chief technology officer this week. Asked for a interpretation of state law regarding the transfer of confidential data, Holt said that the agencies had a choice and that the secure method used by the three agencies was acceptable. “Once the transmitted data has been received, the originating agency’s responsibility to protect the transmitted confidential information ceases. It is then the responsibility of the receiving agency, as data custodian, to protect the confidential information by all appropriate means,” Holt writes. BeyondTrust says: If a third party is reponsible for data theft/leak it's still your responsibility. With so many potential points of entry to sensitive data and so many different attack surfaces from which infection or data theft can happen, a shift in perspective is required. At the very least it is your responsibility to verify the data leak protection of third parties handling sensitive data.