Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
Strict liability for data breaches?
Mark Rasch, 2006-02-20

A recent case involving a stolen laptop containing 550,000 people's full credit information sheds new night on what "reasonable" protections a company must make to secure its customer data - and what customers need to prove in order to sue for damages.

Comments Mode:
Strict liability for data breaches? 2006-02-21
Adam (1 replies)
Re: Strict liability for data breaches? 2006-02-22
Mark D. Rasch (1 replies)
Strict liability for data breaches? 2006-02-21
Jim (Sydney, Australia) (1 replies)
Strict liability for data breaches? 2006-02-21
Ron Jennings (2 replies)
Re: Strict liability for data breaches? 2006-02-23
Anonymous
Ron,
while it is commendable that you have taken that step, and it is certainly better than nothing, you should be aware that "safes" in the <$400 range are mainly to stop casual pilferage or a kid doing a "snatch and grab". Any actual burglary will only be slightly slowed; even a novice burglar will probably have a $60 strongbox open or uprooted in under 5 minutes if he's prepared to make a bit of noise. Check the UL security rating if it has one; on a proper safe it will either be "RSC" or something like "TL-15". RSC is the lowest "burglar resisting" rating and is considered adequate for home security if you also have a monitored alarm, or some other method of raising an alert (friendly neighbours, security patrols, etc). However even a small RSC rated safe will cost at least $800 new (and more like $2000 if also fire resistant, or $3000 if fire-resistance rated for computer media), unless it is an in-floor safe. Floor safes are around half the price because only the door needs to resist attack, however they are very inconvenient to install unless done whilst pouring a floor slab.

Fortunately for data protection purposes there exists a much cheaper and simpler alternatives: encrypted backups. With DVD-R burners standard in modern computers backups are no longer a big chore unless you have really enormous amounts of data. With free open source software like True Crypt, extremely strong transparent, "on the fly" encryption software costs nothing and is a snap to use. So, put all the stuff on your laptop in a True Crypt virtual disk, and back it up to DVDs; keep one at the office and one at home (no special security requirements, the encryption is very strong). Then your data will be practically invulnerable to fire and theft as well as hard drive failure and careless deletions. The laptop itself might get stolen but is much easier to replace than the data.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/387/33172#33172
Strict liability for data breaches? 2006-02-21
Stephen T (1 replies)
Re: Strict liability for data breaches? 2006-02-22
Anonymous (1 replies)
Shameful ruling 2006-02-22
Torquemada
Strict liability for data breaches? 2006-02-22
Frank, Hsv, AL
Strict liability for data breaches? 2006-02-23
Anonymous (2 replies)
Re: Strict liability for data breaches? 2006-02-23
Mark D. Rasch
Re: Strict liability for data breaches? 2006-02-23
Anonymous (1 replies)
Judge Made Law 2006-02-24
Mark D. Rasch (1 replies)
Re: Judge Made Law 2006-03-05
Anonymous (1 replies)
Re: Re: Judge Made Law 2006-03-15
Anonymous







 

Privacy Statement
Copyright 2009, SecurityFocus