BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

The US Government Wants to Secure Your Data. Well, Sort Of.

Posted September 14, 2011    Mike Puterbaugh

Earlier today, George Hulme reported on a recently-introduced piece of legislation, the Personal Data Protection and Breach Accountability Act of 2011 (or PDPBAA for short, which sounds like how my last is pronounced sometimes), geared toward protecting customer data from theft or loss. Senator Richard Blumenthal (D-CT) hopes that this new bill will “prevent and deter data breaches that put people at risk of identity theft and other serious harm both by helping protect consumers’ data before breaches occur”. That sounds good; I think we’d all like that. But as with any type of legislation, the devil is in the details.For example, the proposed bill is targeted towards customers with 10,000 customers or more. Are we customers of Twitter? I’m pretty sure I’m the product they’re selling, not their customer. What constitutes me being a “customer” of a company? I think I have flown once on Frontier Airlines, 3 years ago, but they undoubtedly have my information somewhere. Would that count?

“Data” is a pretty broad term as well.  Credit card numbers, social security numbers, birth dates, even Facebook photos?

(I’m sure there are most details in the bill that bear scrutiny, I was only able to make it through the first 30 pages.)

This isn’t the first, nor will it be the last time that regulations have been proposed to protect end users and their personal data. What I hope most typical consumers realize is, however, most of the companies that they trust with their personal information have extremely sophisticated security measures in place, including comprehensive vulnerability management programs to not only protect your data, but theirs as well.

At the end of the day, if the possibility of losing customers and their brand isn’t a strong enough call to action for your favorite companies to protect your data, then perhaps Senator Blumenthal’s bill and its penalties might be. But I doubt it.

You can check out Hulme’s solid reporting here, at CSO Online.

If you’re not following Hulme on Twitter, you should be, he provides great coverage on the security industry and is also known to share his stock picks from time time.  You can follow me on Twitter here.

Leave a Reply

Additional articles

Are Your Data Security Efforts Focused in the Right Area?

Posted January 28, 2015    Scott Lang

Vormetric Data Security recently released an insider threat report, with research conducted by HarrisPoll and analyzed by Ovum. Based on the survey responses, it is apparent that there is still a great deal of insecurity over data. However, the results also show that there may be misplaced investments to address those insecurities. I will explain…

Tags:
ghost

GHOST Vulnerability…Scary Indeed

Posted January 28, 2015    BeyondTrust Research Team

A vulnerability discovered by Qualys security researchers has surfaced within the GNU C Library that affects virtually all Linux operating systems. The vulnerability lies within the various gethostbyname*() functions and, as such, has been dubbed “GHOST.” GHOST is particularly nasty considering remote, arbitrary code execution can be achieved. In an effort to avoid taxing DNS lookups, glibc developers introduced…

Tags:
,
dave-shackleford-headshot

Your New Years Resolution: Controlling Privileged Users

Posted January 27, 2015    Dave Shackleford

Is 2015 the year you get a better handle on security? The news last year was grim – so much so, in fact, that many in the information security community despaired a bit. Really, the end-of-the-year infosec cocktail parties were a bit glum. OK, let’s be honest, infosec cocktail parties are usually not that wild…

Tags:
, , ,