| Preface |
|
xiv | |
| Acknowledgments |
|
xviii | |
| About the Editor |
|
xix | |
| About the Authors |
|
xx | |
|
PART I Crisis in Information Security |
|
|
1 | (54) |
|
Chapter 1 Cybercrime and Escalating Risks |
|
|
3 | (14) |
|
Expanding Global Cybersecurity Threats |
|
|
4 | (3) |
|
Advanced Persistent Threats |
|
|
4 | (1) |
|
|
|
4 | (1) |
|
|
|
5 | (1) |
|
|
|
6 | (1) |
|
Aurora Botnet and the Google Attack |
|
|
7 | (1) |
|
|
|
7 | (1) |
|
Aggregated Electronic Information at Risk |
|
|
8 | (5) |
|
Credit Card, Driver's License, Bank Account, and Social Security Numbers |
|
|
8 | (1) |
|
|
|
9 | (1) |
|
Tax and Financial Records |
|
|
10 | (1) |
|
|
|
10 | (1) |
|
Mortgages and Consumer Loans |
|
|
11 | (1) |
|
|
|
12 | (1) |
|
|
|
12 | (1) |
|
New Technologies, New Risks |
|
|
13 | (2) |
|
|
|
13 | (1) |
|
|
|
14 | (1) |
|
Peer-to-Peer File Sharing |
|
|
14 | (1) |
|
|
|
15 | (2) |
|
The State of Information Security in the 21st Century? |
|
|
15 | (2) |
|
Chapter 2 Despite the Alarming Trends, Data Breaches Are Preventable |
|
|
17 | (14) |
|
|
|
17 | (1) |
|
Data Breach Incidents by Industry |
|
|
18 | (4) |
|
Number of Records Breached by Industry |
|
|
20 | (1) |
|
Millions of Medical Records Breached |
|
|
20 | (2) |
|
|
|
22 | (5) |
|
Lost and Stolen Computers, Laptops, and Portable Devices |
|
|
23 | (1) |
|
Improper Disposal of Paper Documents |
|
|
23 | (2) |
|
|
|
25 | (1) |
|
|
|
25 | (2) |
|
|
|
27 | (1) |
|
What Information Has Been Compromised in Data Breaches? |
|
|
27 | (1) |
|
Data Breaches Can and Must Be Prevented |
|
|
28 | (1) |
|
Action Plan to Prevent Data Breaches---Encryption Considerations |
|
|
29 | (2) |
|
Chapter 3 The Aftermath of Data Breaches: Potential Liability and Damages |
|
|
31 | (18) |
|
|
|
31 | (3) |
|
Liability and Damages Resulting from Major Data Breaches |
|
|
34 | (12) |
|
|
|
34 | (4) |
|
Heartland Payment Systems |
|
|
38 | (2) |
|
|
|
40 | (1) |
|
|
|
40 | (3) |
|
Discount Shoe Warehouse (DSW) |
|
|
43 | (1) |
|
|
|
44 | (1) |
|
|
|
45 | (1) |
|
Role of Security Standards |
|
|
46 | (1) |
|
|
|
47 | (1) |
|
|
|
47 | (2) |
|
Chapter 4 The Underground World of Online Identity Theft: An Overview |
|
|
49 | (6) |
|
PART II Anatomy of the Major Data Breaches |
|
|
55 | (32) |
|
Chapter 5 Encrypted Records---Failed Security |
|
|
57 | (30) |
|
How a Hacker Attack Unfolds |
|
|
59 | (1) |
|
The Basics of Payment Card Processing |
|
|
60 | (1) |
|
Heartland: Transmission of Sensitive Data in the Clear |
|
|
61 | (3) |
|
What Sensitive Information Was Stolen? |
|
|
62 | (1) |
|
|
|
62 | (2) |
|
Hannaford: Security Failures at Critical Junctures |
|
|
64 | (2) |
|
What Sensitive Information Was Stolen? |
|
|
64 | (1) |
|
|
|
64 | (2) |
|
RBS WorldPay: Vulnerable Network |
|
|
66 | (3) |
|
What Sensitive Information Was Stolen? |
|
|
66 | (1) |
|
|
|
66 | (3) |
|
TJX: Sensitive Data in the Clear, Weak Encryption, Unprotected Encryption Key |
|
|
69 | (4) |
|
What Sensitive Information Was Stolen? |
|
|
70 | (1) |
|
|
|
70 | (3) |
|
DSW: Unsecured Network, Weak Passwords |
|
|
73 | (2) |
|
What Sensitive Information Was Stolen? |
|
|
73 | (1) |
|
|
|
74 | (1) |
|
Web Newsroom: Unprotected Encryption Key |
|
|
75 | (2) |
|
What Sensitive Information Was Stolen? |
|
|
76 | (1) |
|
|
|
76 | (1) |
|
Guidance Software: Unencrypted Database Records |
|
|
77 | (2) |
|
What Sensitive Information Was Stolen? |
|
|
77 | (1) |
|
|
|
77 | (2) |
|
CardSystems: Failure to Apply a Firewall, Maintain Virus Definitions, and Use Strong Passwords |
|
|
79 | (3) |
|
What Sensitive Information Was Stolen? |
|
|
80 | (1) |
|
|
|
80 | (2) |
|
|
|
82 | (1) |
|
Better Security Practices? |
|
|
83 | (4) |
|
|
|
83 | (1) |
|
Payment Processors Information Sharing Council |
|
|
84 | (1) |
|
"Military Industrial Strength" Security |
|
|
84 | (1) |
|
|
|
84 | (3) |
|
|
|
87 | (88) |
|
Chapter 6 Ambiguities in State Security Breach Notification Statutes |
|
|
89 | (14) |
|
|
|
90 | (2) |
|
What Is Covered Personal Data? |
|
|
92 | (1) |
|
What Is a Security Breach? |
|
|
93 | (1) |
|
|
|
94 | (3) |
|
When Does a Breach Trigger the Obligation to Notify? |
|
|
97 | (1) |
|
Who Is an Employee or Agent? |
|
|
98 | (2) |
|
What Assumptions Can/Should You Make? |
|
|
100 | (3) |
|
Chapter 7 State Data Breach Notification Laws and the Duty to Provide Information Security |
|
|
103 | (12) |
|
Nevada: Professionally Based Security Standards |
|
|
103 | (2) |
|
Massachusetts: Risk-Based Approach |
|
|
105 | (8) |
|
What Personal Information Is Covered? |
|
|
106 | (1) |
|
What Is a Security Breach? |
|
|
106 | (1) |
|
|
|
107 | (1) |
|
What Data Must Be Encrypted? |
|
|
108 | (1) |
|
What Is the Duty to Report a Known Security Breach or Unauthorized Use of Personal Information? |
|
|
108 | (1) |
|
What Are the Requirements for Security Breach Notifications? |
|
|
109 | (1) |
|
What Is a Comprehensive Information Security Program? |
|
|
109 | (1) |
|
Written Information Security Plan |
|
|
110 | (1) |
|
Computer Security System Requirements |
|
|
110 | (2) |
|
|
|
112 | (1) |
|
Verification of Third-Party Service Providers |
|
|
112 | (1) |
|
|
|
112 | (1) |
|
Maryland and New Jersey: Information Security Statutes |
|
|
113 | (1) |
|
Breach of Health Information |
|
|
113 | (1) |
|
Affirmative Security Measures |
|
|
113 | (2) |
|
Chapter 8 HITECH: The First Federal Data Breach Notification Law |
|
|
115 | (28) |
|
|
|
115 | (2) |
|
Breach of Protected Health Information |
|
|
116 | (1) |
|
Concept of a "Safe Harbor" |
|
|
116 | (1) |
|
|
|
117 | (1) |
|
Role of the Federal Trade Commission |
|
|
117 | (1) |
|
|
|
117 | (12) |
|
|
|
117 | (2) |
|
Rebuttable Presumption of Unauthorized Access |
|
|
119 | (1) |
|
Limiting PHI and Access to the "Minimum Necessary" |
|
|
120 | (1) |
|
The Concept of "Harm" and Risk Assessments |
|
|
121 | (2) |
|
|
|
123 | (1) |
|
"Risk Assessment" as a Tool for Determining Harm---A Critique |
|
|
124 | (1) |
|
Exceptions to the "Breach Rule" |
|
|
125 | (1) |
|
Limitations of Notification Requirements |
|
|
126 | (2) |
|
Heightened HIPAA Enforcement Under HITECH |
|
|
128 | (1) |
|
|
|
129 | (1) |
|
What Is Unsecured Protected Health Information? |
|
|
129 | (4) |
|
Encryption and Destruction |
|
|
129 | (2) |
|
|
|
131 | (2) |
|
When Does a Breach Trigger Notice Obligations? |
|
|
133 | (1) |
|
What Are the Requirements for Breach Notification? |
|
|
134 | (7) |
|
|
|
134 | (1) |
|
When Must Notice Be Provided? |
|
|
134 | (1) |
|
What Form of Notice Is Required? |
|
|
135 | (1) |
|
What Is the Content of the Notification? |
|
|
135 | (1) |
|
Who Is Covered by the Breach Notification Requirements? |
|
|
136 | (3) |
|
What Personal Information Is Covered? |
|
|
139 | (2) |
|
Health Care Breach Challenges Remain |
|
|
141 | (2) |
|
Chapter 9 Breach Notification and Encryption: A Global Perspective |
|
|
143 | (32) |
|
Notification Obligations: Overview |
|
|
143 | (3) |
|
Data Protection Requirements: Overview |
|
|
146 | (4) |
|
Notification and Encryption Requirements by Country |
|
|
150 | (1) |
|
|
|
150 | (1) |
|
|
|
151 | (1) |
|
|
|
152 | (1) |
|
|
|
152 | (3) |
|
|
|
155 | (1) |
|
|
|
155 | (2) |
|
|
|
157 | (1) |
|
|
|
157 | (1) |
|
|
|
157 | (1) |
|
|
|
158 | (1) |
|
|
|
159 | (1) |
|
|
|
159 | (1) |
|
|
|
160 | (1) |
|
|
|
161 | (1) |
|
|
|
162 | (1) |
|
|
|
162 | (1) |
|
|
|
162 | (1) |
|
|
|
163 | (1) |
|
|
|
164 | (1) |
|
|
|
165 | (1) |
|
|
|
166 | (1) |
|
|
|
167 | (1) |
|
|
|
167 | (1) |
|
|
|
168 | (1) |
|
|
|
168 | (1) |
|
|
|
169 | (1) |
|
|
|
170 | (1) |
|
|
|
171 | (1) |
|
|
|
171 | (1) |
|
|
|
171 | (1) |
|
|
|
172 | (1) |
|
|
|
173 | (2) |
|
|
|
175 | (64) |
|
Chapter 10 Encryption: The Basics |
|
|
177 | (14) |
|
|
|
177 | (4) |
|
|
|
178 | (1) |
|
|
|
179 | (2) |
|
|
|
181 | (3) |
|
In-Flight Versus At-Rest Encryption |
|
|
181 | (1) |
|
SNIA Position on Encryption |
|
|
181 | (1) |
|
|
|
182 | (1) |
|
|
|
183 | (1) |
|
Encryption and Key Management Guidance |
|
|
184 | (4) |
|
|
|
185 | (1) |
|
Guidance for Key Management |
|
|
186 | (2) |
|
An Approach to Implementing Encryption |
|
|
188 | (2) |
|
Step 1 Understand Confidentiality Drivers |
|
|
188 | (1) |
|
Step 2 Classify the Data Assets |
|
|
188 | (1) |
|
Step 3 Inventory Data Assets |
|
|
189 | (1) |
|
Step 4 Perform Data Flow Analysis |
|
|
189 | (1) |
|
Step 5 Determine the Appropriate Points of Encryption |
|
|
189 | (1) |
|
Step 6 Design the Encryption Solution |
|
|
189 | (1) |
|
Step 7 Begin Data Realignment |
|
|
189 | (1) |
|
Step 8 Implement Solution |
|
|
189 | (1) |
|
Step 9 Activate Encryption |
|
|
190 | (1) |
|
|
|
190 | (1) |
|
Chapter 11 Encryption Best Practices |
|
|
191 | (10) |
|
|
|
191 | (2) |
|
NIST and the AES Encryption Standard |
|
|
193 | (1) |
|
What Can Go Wrong with Encryption? |
|
|
194 | (2) |
|
Short Encryption Key Lengths |
|
|
194 | (1) |
|
The Key Itself Is Not a Completely Random Number |
|
|
194 | (1) |
|
The Encryption Key Is Compromised |
|
|
194 | (1) |
|
|
|
195 | (1) |
|
|
|
195 | (1) |
|
Hardware Encryption Protection |
|
|
195 | (1) |
|
Access to the Encryption Keys |
|
|
196 | (2) |
|
A Key Protects Other Keys |
|
|
196 | (1) |
|
Multi-Factor Authentication |
|
|
196 | (1) |
|
|
|
197 | (1) |
|
|
|
197 | (1) |
|
Critical Encryption Measures |
|
|
198 | (3) |
|
Chapter 12 Circumventing Data Encryption: Password Vulnerabilities |
|
|
201 | (6) |
|
Passwords and Data Encryption |
|
|
201 | (1) |
|
|
|
202 | (1) |
|
Biometrics, Two-Factor Authentication, and One-Time Passwords |
|
|
203 | (1) |
|
|
|
204 | (2) |
|
|
|
206 | (1) |
|
Chapter 13 Managing Cryptographic Keys |
|
|
207 | (10) |
|
Associated Standards and Standards Committees |
|
|
207 | (1) |
|
Introduction to Enterprise Key Management Infrastructure |
|
|
208 | (1) |
|
The Key Management Lifecycle |
|
|
209 | (4) |
|
|
|
209 | (1) |
|
|
|
210 | (1) |
|
|
|
211 | (1) |
|
|
|
211 | (1) |
|
|
|
211 | (1) |
|
|
|
212 | (1) |
|
|
|
213 | (1) |
|
|
|
213 | (1) |
|
|
|
213 | (3) |
|
Exercise Key Management Processes |
|
|
214 | (1) |
|
Dual Control and Separation of Duties |
|
|
214 | (1) |
|
|
|
214 | (1) |
|
|
|
214 | (1) |
|
|
|
215 | (1) |
|
Using Encryption for Virtual Shredding |
|
|
215 | (1) |
|
|
|
216 | (1) |
|
Chapter 14 The Self-Encrypting Drive |
|
|
217 | (10) |
|
|
|
219 | (3) |
|
Variations on the Basic Self-Encrypting Drive |
|
|
222 | (2) |
|
|
|
224 | (1) |
|
Future Capabilities Defined by the TCG Specifications |
|
|
224 | (1) |
|
What the Future of Encrypted Data May Hold |
|
|
224 | (3) |
|
Chapter 15 Encryption Technologies: A Practical Assessment |
|
|
227 | (12) |
|
Choices for Hiding Information |
|
|
227 | (1) |
|
Encryption Algorithms: An Historical Perspective |
|
|
228 | (1) |
|
Factors to Be Considered in Making Encryption Decisions |
|
|
229 | (1) |
|
Media That Can or Should Be Encrypted |
|
|
229 | (1) |
|
Advanced Encryption Standard |
|
|
230 | (1) |
|
Encryption with Web Browsers |
|
|
230 | (2) |
|
Hardware Versus Software Encryption |
|
|
232 | (4) |
|
|
|
232 | (1) |
|
|
|
232 | (1) |
|
Some Available Encryption and Decryption Software |
|
|
232 | (2) |
|
Examples of File Software Encryption |
|
|
234 | (2) |
|
|
|
236 | (3) |
|
|
|
239 | (46) |
|
Chapter 16 Security Best Practices: The Watchword Is Prioritize! |
|
|
241 | (14) |
|
21st Century Information Security Challenges |
|
|
241 | (2) |
|
|
|
243 | (1) |
|
Data Breaches Can and Must Be Prevented |
|
|
243 | (1) |
|
|
|
244 | (4) |
|
National Institute of Standards and Technology Guidelines |
|
|
244 | (1) |
|
ISO/IEC 27000-series Standards |
|
|
245 | (1) |
|
|
|
246 | (1) |
|
National Identity Management Strategy |
|
|
247 | (1) |
|
|
|
248 | (5) |
|
Twenty Critical Controls for Effective Cyberdefense: Consensus Audit |
|
|
248 | (1) |
|
Top 25 Most Dangerous Software Errors |
|
|
249 | (1) |
|
Insider Threats Must Be Countered |
|
|
250 | (1) |
|
Payment Card Industry Data Security Standard |
|
|
251 | (2) |
|
|
|
253 | (1) |
|
Now Is the Time to Become Serious About Information Security |
|
|
253 | (2) |
|
Chapter 17 Responding to Data Breaches |
|
|
255 | (10) |
|
Report Immediately to a Designated Internal Contact Any Discovered or Suspected Breach |
|
|
256 | (1) |
|
Investigate Any Reports Promptly and Thoroughly |
|
|
256 | (1) |
|
Stop the Source of the Breach and the Associated Harm |
|
|
257 | (1) |
|
Evaluate Your Legal Obligations Regarding the Incident |
|
|
257 | (2) |
|
Strategize Communications About the Incident |
|
|
259 | (1) |
|
|
|
259 | (1) |
|
Identify Internal Policies and Procedures That Should Be Immediately Changed |
|
|
260 | (1) |
|
Notify the Affected Data Subjects and Other Relevant Entities Where Warranted |
|
|
260 | (2) |
|
Evolve Practices and Procedures on an Ongoing Basis |
|
|
262 | (3) |
|
Chapter 18 Technology to Prevent Data Leaks |
|
|
265 | (6) |
|
Protection at the Data Level |
|
|
265 | (3) |
|
Rogue Devices and Software |
|
|
267 | (1) |
|
|
|
267 | (1) |
|
|
|
267 | (1) |
|
Tools for DLP Risk Mitigation |
|
|
268 | (2) |
|
Effective Data Security Is Required |
|
|
270 | (1) |
|
Chapter 19 Insurance Protection for Security Breaches |
|
|
271 | (14) |
|
Types of Insurance Potentially Applicable to Liability or Loss from a Security Breach |
|
|
271 | (9) |
|
|
|
271 | (1) |
|
First-Party Property Insurance |
|
|
272 | (1) |
|
Business-Interruption Insurance |
|
|
273 | (1) |
|
Fidelity Insurance and Bonds |
|
|
274 | (1) |
|
Electronic Funds Transfer Insurance |
|
|
274 | (1) |
|
Third-Party Liability Insurance |
|
|
275 | (1) |
|
General Liability Insurance |
|
|
275 | (2) |
|
Media Liability Insurance |
|
|
277 | (1) |
|
Directors and Officers and Fiduciary Liability Insurance |
|
|
277 | (2) |
|
Errors and Omissions Insurance |
|
|
279 | (1) |
|
Cyberrisk Insurance Coverage |
|
|
280 | (1) |
|
Types of Exposures Covered |
|
|
280 | (1) |
|
First-Party Versus Third-Party Coverage |
|
|
280 | (1) |
|
Role of Auditing and Loss Prevention |
|
|
281 | (1) |
|
|
|
281 | (1) |
|
Tips for Purchasing Insurance |
|
|
281 | (1) |
|
|
|
281 | (4) |
|
|
|
282 | (1) |
|
Claims Under Liability Insurance Policies |
|
|
282 | (1) |
|
Claims Under First-Party Insurance Policies |
|
|
282 | (3) |
| Appendix A Security Breach Notification Laws |
|
285 | (4) |
| Appendix B Summary of Data Breach Notification and Encryption Laws |
|
289 | (20) |
| Appendix C Resources |
|
309 | (8) |
| Index of Important Cases |
|
317 | (2) |
| Index |
|
319 | |
