It’s Like Déjà Vu All Over Again: Yogi Berra On Information Security



 It is Spring again, and the national pastime is in full swing. This year Spring also brought knowledge of the Heartbleed Bug – another threat to the security of information stored and transmitted online.  And just as baseball is a fixture of the American landscape, so too unfortunately are data breaches and other information security threats.

As of April 29, 2014, the Identify Theft Resource Center (ITRC) has identified 260 breaches (affecting over 8 million records) that have taken place in 2014 alone. Likewise, the ITRC recorded 614 breaches in 2013, a 30% increase over the 470 breaches it reported in 2012.  Each new major data breach (think Target) is reminiscent of those that have come before it (Citibank, Sony, Heartland, Countrywide, etc.). 

MLB Hall of Fame catcher Yogi Berra, during his more than 50 years as a Major League player, manager and coach, offered (unwittingly or otherwise) baseball and its reading and listening public a great deal of wit and wisdom. In the spirit of the season, several of Berra’s “Yogi-isms” also offer guidance for businesses facing the challenges of protecting information.

“You can observe a lot by watching.” (Know Your Information and How and Where You Store It and Send It)


Information is an asset. You cannot protect information or use it effectively until you can locate and identify it, categorize it (determine its value), and track it:
  • Where is information stored in your organization, and where does it go within the company and beyond?
  • What information do you collect and store that is considered sensitive (at risk) and worthy of protection?
  • Who has access to sensitive information?
  • How is information currently being protected?
Mapping and assessing current information practices is a necessary step in creating an effective information security program.

“If you don’t know where you are going, you might end up somewhere else.” (Take Responsibility and Plan for Information Risks)


Every business needs to be prepared to respond to an event that could compromise its information or information systems (computers and computer networks):

  • Recognize that information security touches every part of the organization;
  • Designate one or more individuals with authority, responsibility, and accountability for managing and securing information;
  • Create, implement, and update policies and procedures to manage information risk, including but not limited to:

  • An incident response plan;
  • Business continuity arrangements;
  • Information retention and destruction policies consistent with corporate needs, legal responsibilities, and business risk.
  • Consider insurance policies particular to information risk; and
  • Deploy appropriate computer technology to prevent, detect, and manage threats.

“Never answer an anonymous letter.” (Train Your Employees to Detect Phishing Emails and Other Security Threats)


The threat to computer networks caused by “phishing” -- attempts to acquire sensitive information by pretending to be a reputable entity in an email -- is significant.  According to the latest Verizon Business Data Breach Report, over 95% of targeted attacks start with a phishing email.  The same Verizon Report makes a more startling observation: a phishing campaign that sends 20 emails has almost a 100% probability of getting at least one click.

All organizations must train their employees to be skeptical of suspicious emails, and to report suspected phishing messages. Employee training and awareness is a necessary component of an information security program, as are “layered security” or “defense-in-depth” mechanisms that may prevent or limit a system compromise brought about by clicking on a phishing email.

“If people don’t want to come to the ballpark, nobody’s going to stop them.” (Protecting Information is Good Business)


The damage that results when sensitive information is disclosed without authorization can take several forms. In addition to the financial and regulatory losses and burdens a company faces in the wake of a breach, the damage to its reputation may be the most significant and lasting. Losing a customer’s information compromises trust, a very valuable asset in a competitive market. Protecting information assets protects the value of the company.

Conclusion: “The future ain’t what it used to be.”

 
Effective information security is a moving target and an ongoing process that requires a combination of people, processes, and technology.  As the last several years have demonstrated over and over again, hackers and other threat actors continue to become more sophisticated and pervasive. As a result, standing still is not an option, and instead an organization must evaluate and update its security policies, training, and technology on a regular basis.

Popular posts from this blog

Legalized, But Regulated: Commercial Hemp in South Carolina

Image
On December 20, 2018 the Agricultural Improvement Act of 2018  (the "2018 Farm Bill") became law.  Following closely on the heels of the 2018 Farm Bill, on March 28, 2019 the South Carolina Hemp Farming Act  ("S.C. Hemp Farming Act") was signed into law.  The following is a brief overview of the status of hemp (also called "commercial hemp" or "industrial hemp") farming and regulation in South Carolina in the wake of the 2018 Farm Bill and the S.C. Hemp Farming Act. Background The terms "hemp" (which has non-drug connotations and uses) and "marijuana" (no further explanation necessary) describe the same plant genus: cannabis. The difference between the two is generally based on the relative amount of tetrahydrocannabinol (THC) contained in the plant. Hemp plants are cultivated to produce fiber and seeds and very little if any THC. Marijuana plants, on the other hand, are cultivated to produce more THC. THC
Read more

What Authority the Principal Chose: Arredondo, POAs, and Arbitrability

Image
It was only a matter of time before arbitrability (the enforceability of an agreement to arbitrate) put a South Carolina courts in the position to construe the language in a power of attorney ("POA"). And this opinion did.  I try to view these decisions through the lens of how an attorney practicing in South Carolina might learn from them. And this decision, like some others involving the FAA and arbitrability, (for example, Grant v. Kuhn Chevrolet  or Herron v. Century BMW  , had the litigator and the drafter in me scratching my head.  Or at least I was confused until I learned about what had happened legislatively in the time since the POAs at issue in Arredondo were scrutinized by three (3) South Carolina courts. This decision, involving a POA executed before January 1, 2017, is likely an anomaly or a one-off, as going forward the S.C. Uniform Power of Attorney Act (SCUPOA) provides a guide for the creation of POAs that may avoid the necessity for so much judicial scruti
Read more

The SC Insurance Data Security Act: Ask Some Questions to Evaluate Your Security Program

Image
The  South Carolina Insurance Data Security Act  (“Act”), fashioned after the  NAIC Insurance Data Security Model Law  (Model Law), went into effect on January 1, 2019. South Carolina was the first state in the nation to pass this legislation, and others (Ohio, Mississippi), have followed suit. The Act requires that each South Carolina person licensed or authorized by the South Carolina Department of Insurance (DOI) a “Licensee” must implement, no later than July 1, 2019, a “comprehensive written information security program” (“Program”) designed to protect nonpublic information (NPI) and the security of the Licensee’s information system. In addition, the Act requires a Licensee to report to the Director of the DOI within 72 hours following an actual or potential “cybersecurity event.” S.C. Code Section 38-99-40(A) (Section 6(A) of the Model Act). While South Carolina Licensees (hopefully) are well down the path to meeting the Act’s requirements, the following may be u
Read more