Tag Archives: customer data protection

Good customer service is key to good customer security

My friend Nissan Ratzlav-Katz starting blogging about customer service in Israel and how tolerant many of us have become to sub-standard and even really crappy customer service.

An objection I’ve heard frequently to Google Apps is that they don’t give customer service – although I would argue that great products delivered that work on a global scale for free definitely qualify as great customer service.

How do startups make customer service scale into awesomeness? touches on many good points including a I Love/I Hate Ratio (Virgin Atlantic scores at the bottom – Microsoft is about even and Amazon, Google score at around 8 – meaning that 8x as many people love Google as hate them. Which is pretty impressive I thought.

Still – one thing we miss is the synergy between love/hate and suppliers and customers. If you give great service, customers will love you and if you’re a great customer and pay on time – suppliers will love you.

The only counter-example I know is Israeli corporate customers that will pay the best supplier in the world Net 180 days and take a 20% discount just because they felt like it.

Bottom line – Israel may be a country with a poor service ethic but it’s also a country with a poor payment on time ethic and poor data security, customer privacy ethic

In my book – not an accident.  If you treat your customers and suppliers well, you will tend to treat the issues of data security and customer privacy accordingly.

Tell your friends and colleagues about us. Thanks!
Share this

Ten steps to protecting your organization’s data

Here are 10 steps  to protecting your organization’s privacy data and intellectual property.

As a preface, begin with the understanding that you already have all the resources you need.

Discussions with colleagues in a large forensics accounting firm that specialize in anti-fraud investigations, money laundering and anti-terror funding (ATF), confirm what I’ve suspected for a long time. Armies of junior analysts working for the large accounting firms who have never seen or experienced a fraudulent event and are unfamiliar with the your business operation are not a reasonable replacement for careful risk analysis by the business done by people who are familiar with the business.

Step # 1- Do not do an expensive business process mapping project.

Many consultants tell organizations that they must perform a detailed business process analysis and build data flow diagrams of data and users who process data. This is an expensive task to execute and extremely difficult to maintain that can require large quantity of billable hours. That’s why they tell you to map data flows. The added value of knowing data flows inside your organization between people doing their job is arguable. There are much better ways to protect your data without writing out a 7 digit check. Here is the first one you should try out. Select the 10 most valuable data assets that your company owns. For example – proprietary mechanical designs of machines, detailed financials of a private company being acquired, and details of competitive contracts with large accounts. In a few interviews with finance, operations, IT, sales and engineering, you can nail down those key assets. After you’ve done that, schedule a 1 hour meeting with the CFO and ask her how much each asset is worth in dollars. In general, the value of a digital, reputational, physical or operational asset to a business can be established fairly quickly by the CFO in dollar terms – in terms of replacement cost, impact on sales and operational costs.

Step #2 – Do not develop a regulatory compliance grid.

There is no point in taking a non-value-added process and spend money making it more effective.

My maternal grandmother, who spoke fluent Yiddish would yell at us – ” grosse augen” when we would pile too much food on our plates. ” Grosse augen” ( or as my folks put it); is having eyes that are bigger than your capacity. Yes, US publicly traded companies are subject to multiple regulations – if the company sells to customers and stores and processes PII (personally identifiable data) they will have to deal with PCI DSS 1.1, California State Privacy Law, Sarbanes-Oxley PCI DSS 1.1 protects one asset – payment card numer and magnetic stripe, while Sarbanes-Oxley is about accounting records. Yes, there are a few commercial software products that map business processes, databases and data elements to multiple regulations; their goal is to help streamline the work involved in multiple regulatory compliance projects – eliminating redundancy where possibility using commonality.
Looking at all the corporate governance and compliance violations; cases such as Hannaford supermarkets and AOL – it’s clear government regulation has not made America more competitive nor better managed.

Step #3 – Identify the top 5 data assets in your business and valuate them

I saw an article recently that linked regulatory compliance mandate and asset cost. Definitely not true – the value of an asset for a company is whatever operational management/CFO say it is. Asset value has nothing to do with compliance but it has everything to do with a cost effective risk control plan. For example – a company might think that whole disk encryption on all company notebook computers is a good idea – but if only 20 people have sensitive data – why spend 1 million dollars on mobile device data encryption when you can solve the problem for less than 5k?

Step #4 – Do not store PII

The absolutely worst thing you can do is a project to analyse data retention and protection regulations that govern each of the sensitive data elements that need protecting, and working with legal and compliance consultants who know the relevant regulations. VISA has it right. Don’t store credit cards and magnetic strip data. It will not help the marketing guys sell more anyway – and you can give the money you save on some fancy database encryption software to the earthquake victims in Myanmar and China.

Step #5 – Monitor your outsourcing vendors

Despite the hype on trusted insiders, most data loss is from business partners. You can write a non-disclosure agreement with an outsourcing vendor and trust them, but you must verify their compliance and prevent unauthorized data leaks.

The best story I had in years was in a meeting with the VP internal audit at a medium sized bank in Israel. He took a sales call with me and I pitched our extrusion prevention technology from Fidelis Security Systems as a way to protect their customer data. He said – look Danny, we don’t need technology – we’ve outsourced everything to a very large bank and their data center security is world-class. Two weeks later, the big bank had a serious data breach event (a high school student hacked into the internal network of the bank from a public Windows-based kiosk and helped himself to some customer lists. Two months later, the small bank was reported to be looking to get out of their outsourcing contract. Don’t rely on contracts alone – use people and DLP technology to detect data leakage.

Step #6 – Do annual security awareness training but keep it short and sweet

Awareness is great but like Andy Grove said – “A little fear in the workplace is not necassarily a bad thing”. Have everyone read, understand and sign a 1 page procedure for information security. Forget interview projects and expensive self-assessment systems – what salesman in his right mind will take time to fill out one of those forms – if he doesn’t update his accounts on salesforce.com? Install an extrusion detection system at the network perimeter. Prosecute violators in real time. Do random spot checks on the read-and-understand procedure. Give demerits to the supervisors and managers if their employees don’t pass the spot check.

Step #7 – Calculate valuate at risk of your top 5 data assets

ISO 27001 and PCI DSS 1.1 checklists are great starting points but they focus on whether a particular technology, policy or control has been implemented, and not whether these controls are cost-effective security countermeasures against internal and external attackers. Use Practical Threat Analysis with a PTA risk library for ISO 27001 or PCI DSS 1.1 and you will be able to build a cost-effective risk mitigation plan based on asset values, threat probabilities and estimated damage levels.

Step #8 – Ask your vendors and colleagues difficult questions

After you’ve done a practical threat analysis of your risk exposure to attacks on sensitive customer data and IP you will be in better position than ever to know what policies, procedures and technologies are the most effective security controlss. You’ll be in an excellent position to ask difficult questions and negotiate terms with your favorite vendor. While the attitude of many companies is to hold data protection protections close to their chests, it is valuable to talk to your colleagues at other companies in the same market and get a sense of what they have done and how well the controls perform.

Step #9 – Resist the temptation to do a customer data integration (CDI) project.

Customer data is often stored in many applications and locations in a large organization. The knee-jerk reaction of IT is to do a big data integration project and get all the digital assets under one roof. There are three reasons why this is a terrible idea. (a) Most of these projects fail, overrun and never deliver promised value (b) If you do suceed in getting all the data in one place, it’s like waving a huge red flag to attackers – heah , come over here – we have a lot of sensitive data that is nicely documented and easily accessible. Companies with enterprise software systems such as SAP and Oracle Applications are three times more likely to be attacked. (c) Ask yourself – would Google have succeeded if with global data integration strategy?

Step #10 – Prepare a business care for data loss prevention before evaluating products

Despite claims that protecting data assets is strategic to an enterprise, and IT governance talk about busines alignment and adding value – my experience is that most organizations will not do anything until they’ve had a fraud or data security event. The first step to protecting customer data and IP in any sized business from a individual proprietership to a 10,000 person global enterprise is laying the case at the door of the company’s management. This is where executives need to take a leadership position – starting with a clear position on which data assets are important and how much they’re worth to the company.

Practical threat analysis is a great way to identify and assess threats to your business and evaluate the potential business impact in dollars and cents to your operation using best-practice risk models provided by the PTA Professional threat modeling tool.

In summary

Software Associates specializes in helping medical device and healthcare software vendors achieve HIPAA compliance and protect customer assets and provides a full range of risk management services, from stopping fraud to ensuring regulatory compliance and enhancing your ability to serve your customers.

There are resources that help you turn information into insight such as   Risk Management from LexisNexis, Identity Fraud TrueID solutions from LexisNexis that help significantly reduce fraud losses and Background Checks from LexisNexis that deliver valuable insights that lead to smarter, more informed decisions and greater security for consumers, businesses and government agencies.For consumers, its an easy way to verify personal data, screen potential renters, nannies, doctors and other professionals, and discover any negative background information that could impact your employment eligibility. For businesses and government agencies, it is the foundation of due diligence. It provides the insight you need to reduce risk and improve profitability by helping you safeguard transactions, identify trustworthy customers and partners, hire qualified employees, or locate individuals for debt collections, law enforcement or other needs.


Tell your friends and colleagues about us. Thanks!
Share this

Customer convenience or customer privacy

This is a presentation I gave at the UPU (Universal Postal Union) EPSG (Electronic Products and Services working Group) working meeting in Bern on Feb 20, 2007. About 25 people from 20 countries were present and it was a great experience for me to hear how Postal operations see themselves and what they do in the B2C e-commerce space.
Click here to download the presentation

Tell your friends and colleagues about us. Thanks!
Share this

Credit card shims

Using shims that fit into the ATM machine and read your mag stripe data has been around for a while.  It’s a good way to get the track 2 data but it won’t get your PIN (which if you are in Europe and the Middle East is part of the VISA chip and pin security for credit cards – the PIN is not stored on the card, so it can’t be read by skimming with a slot reader or shimming with a piece of plastic inside the ATM slot).     Now, it seems there is fairly low tech way to capture your PIN by using a flexible keypad overlay on top of the regular ATM keypad as you can see here – this ATM keyboard will steal your PIN

To these rather technical attacks on credit card data, we also have a kind of side attack as recently reported in Paris – where two women waited next to a man on line and waited until he entered his PIN number at the ATM and then dropped their shirts and flashed their boobs – as you can see in this post – stealing money with their boobs

Not bad.

Tell your friends and colleagues about us. Thanks!
Share this

Speed is everything

Jeżeli wydaje ci się, że wszystko jest pod kontrolą, to na pewno nie jedziesz wystarczająco szybko.

If you think everything is under control, it certainly is not going fast enough. Cry

Mario Andretti,Formula 1 Driver

I saw this quote today and I was reminded of a takeaway  from Andy Grove’s book – “Only the paranoid succeed”. A central theme in decision making is  that it’s much better to take a decision earlier rather than later – bad decisions can be fixed but no decision and inaction cannot be fixed.

This is one of the most frustrating things in the world of  data security in a down market, customers not taking decisions and getting a beating from trusted insider attacks. After a major RIF, a firm may say that it doesnt have money nor resources for data loss prevention yet – literally in broad daylight – intellectual property, customer records and confidential company documents are being leaked by employees.  In order to get past this energy barrier of indifference ask yourself these 5 questions:

  1. What is your most valuable data?
  2. Where is the data located?
  3. Who uses it, what do they do with it?
  4. What is the biggest threat?
  5. What security controls are you looking for?
Tell your friends and colleagues about us. Thanks!
Share this

Great achievements involve great risk

Is it possible to have good kharma in information security – when you’re trying to keep the bad guys off your network (firewall, IPS) and keep the good suff inside (data loss prevention) and maintain good internal security (network surveillance)?

I got a Powerpoint slide show in the email this morning from my friend Jeff Green, who plays baritone sax, and sits next to me in the JP Big Band. It’s one of those chain letters that suggest that if you forward it to 15 people or more,  your life will improve drastically and everything you ever dreamed of will begin to take shape. OK – I am against chain letters in principle in the Internet since it is a form of spam but  I am not opposed to words of wisdom from the Dalai Lama – especially if it applies to the kind of work I do – customer data security:

  • Learn the rules so you know how to break them properly. ( This is relevant for protecting digital assets – a client of mine once told me that he doesn’t mind if they steal his business plans, since he’s already 2 years ahead of the competition in a blue ocean of his own)
  • When you realize you’ve made a mistake, take immediate steps to correct it. (Good idea for an network security manager – if you find a bug in the firewall, or a user sending the entire employee contact list to a private gmail account – best to take immediate corrective action)
  • Spend some time alone every day. (My solution is getting on my bike and riding – I wish I could do it every day…)

If you still want the Powerpoint slide show – you can download it here: Good Kharma

Tell your friends and colleagues about us. Thanks!
Share this