Any business that routinely handles personal data can draw a number of important lessons from the recent rash of thefts involving personal data, plaguing both industry and government.

The scenario is depressingly familiar: A laptop computer or associated storage media, such as a disk, is stolen from an employee's home, car or office. Although the thief was probably after the hardware, the device contained thousands of records with individually identifiable data, possibly names, Social Security numbers and other personal information. Now at large, the data could be used for identity theft.

What could have been done to prevent this in the first place, and what should be done after the fact to limit potential liability and protect a company's reputation?

Here are a few suggestions drawn from experience handling this type of situation and many similar ones:

For years, corporate security programs have focused on risks posed by computer hackers, viruses and other Internet-related threats. Risks associated with laptop computers and portable storage media, on the other hand, have been widely underappreciated.

As every IT professional knows, however, laptops and their paraphernalia "walk off" from homes, offices, conference rooms and cars with alarming frequency. Given the risks, every company needs to have reasonable safeguards in place for the use of these devices.

For example, companies should review controls on employees' ability to download and store data on portable devices.

They also may want to require that portable drives and other portable storage media be encrypted. Aside from obvious security advantages, encryption can help to avoid triggering security breach notification laws now in effect in many states. Many notification laws do not apply to encrypted data.

Companies should review their security incident response plans to be certain they are adequate and being observed in the field.

Proper reporting and escalation of security incidents, for example, is critical to an effective response plan. The response of the Veteran's Administration, whose laptop, taken home by an employee, was stolen in April, was slow. This led to political embarrassment and potential liability, because employees failed to report the theft of data in a timely manner to officials responsible for investigating security incidents.

A good security program is worthless if it is ignored by members of the workforce.

Periodic training and regular security awareness activities are the only way to maintain the critical "human element" in a security program.

Training and security awareness also are necessary to fulfill legal obligations to maintain an adequate security program. In fact, the duty to conduct training and security awareness is explicit in the HIPAA Security Rule.

The same duty is couched as a guideline in state and federal laws implementing the Gramm-Leach-Bliley Act, but the duty is no less real for being presented this way.

When data is compromised, it often takes time to ascertain precisely what happened and whose data was involved. The time it takes to determine which records may have been compromised can slow a response.

This makes it all the more important to speed other response activities, such as conducting a legal review, briefing management and making preparations for responding to customer inquiries.

It's important to check any applicable security breach notification laws for deadlines on sending out notices to individuals whose information was involved. Florida, for example, imposes such deadlines.

Laws governing information security could allow for more options than you might think. By design, the laws pertaining to a security program--including an incident response plan--are flexible and risk-based. This should allow for a response based on the risk to customers as presented by a situation.

Many states now have laws requiring that companies give notice of a security breach involving personal data to individuals affected by the incident. Although these laws are more prescriptive than the regulations that generally apply to information security, they contain significant ambiguities regarding what triggers a duty to notify.

For example, say a contractor accidentally gained unauthorized access to certain personal records stored on a company's computer server. Although the access was unauthorized, the incident might not be considered a security "breach" that would trigger a duty to give notice under the laws of many states. This is especially true if the contractor is subject to security controls under a contract for services.

Any decision made in response to a security breach will have consequences for future incidents. Once a response to an incident is made, a record of what the company believes to be a reasonable and adequate response has been created.

A response to a security incident needs to start with a determination of what must be done. Once this is settled, the more important matter of what will be done to protect customers and preserve the company's reputation can be examined.

In the long run, it's important to demonstrate to customers that security of their personal information will outweigh any legal concerns.

In other words, get the legal issues right, know the lay of the land, and then decide what actions to take based on what's best for the organization.

Special Reports /

Keeping Secure Information Safe

Related Stories

Recommended For You