By Anthony M. Freed, Information-Security-Resources.com Managing Editor

Yesterday another story emerged that has created some buzz regarding the current threats to our nation’s information security,  leading off with a recent case of information and identity theft by a company insider at a major financial institution.  With the number of layoffs on the rise in the financial field, how safe is any one’s personal financial information anymore?

In this case, it was due to my own carelessness, but for many others the exposure is beyond their control, and are due to lapses in security protocols, inadequate third-party controls, and plain old human error.

Financial companies, banks, government and non-government organizations routinely lose data of the most sensitive nature, exposing hundreds-of-thousands of people to potential financial ruin and personal loss.

More shocking yet  is that the black-market value of personal data has produced a healthy trade in people’s personal information, and this is increasing the instances of data theft by employees and staff within these supposedly secure and trusted institutions.

The record unemployment levels in the financial industries, the threat of further bank closures, government sponsored take-overs, and outright buyouts by the competition create an environment rich in the temptation to misuse private information for personal gain.

Aside from the obvious damage to the folks whose data is sold and possibly used for illicit purposes, there is growing concern amongst the corporate executives, boards of directors, and legal departments of these organizations that they also may be exposed to tremendous risk and potential professional liability from these breaches of security.

The threat of criminal liability as well as civil and class-action litigation is greater than ever before.

Then there are also the losses borne by the equity stakeholders in these organizations, the devaluation of their portfolio holdings, the risk of diminished returns, and ultimately insolvency. The losses could begin to reach levels that exceed investors tolerance for risk, and the access to much needed capital may dry up.

I am pleased to announce our new website Information Security Resources, which will examine these issues from both a financial and a technical perspective, examining areas of lax governance and inadequate security protocols, and more importantly we will be offering solutions and best practices advice from some of the leading players in information security and financial analysis in the nation:

Our goal is to help financial industry stakeholders, government regulators, and the public better understand and address the mounting information security threats inherent in the current financial crisis.

Our concern is centered around the failure of organizations to adequately protect regulated systems and data.  Our current focus is on the exposure of private info and sensitive systems during the financial meltdown, including identity theft, privacy breach, info stolen, credit card fraud, and other enormous liabilities.

In addition to the obvious threat to market stability, the financial debacle has the added element of national and global security concerns. We believe we are among the very first working to highlight this national security problem.

We believe this is the next national security, shareholder derivative, D&O liability, regulatory, consumer product safety, and class-action issue.  We teach you how to find this problem, and fix it.

Our team lead is Kevin M. Nixon a Master Security Architect (MSA); Certified Information Systems Security Professional (CISSP); Certified Information Security Manager (CISM); Certified US Domestic and International Regulatory Professional; and Licensed Private Security Consultant.

Kevin has over 25 years of experience in MIS design and development, Information Security, Business Continuity and Disaster Recovery, US and European Regulatory Compliance, and has testified as an expert witness before the Congressional High Tech Task Force, the Chairman of the Senate Armed Services Committee, and the Chairman of the House Ways and Means Committee.

Kevin has served on infrastructure security boards and committees including:

♦ Disaster Recovery Work group for the Office of Homeland Security (which developed the National Strategy to Secure Cyberspace)

♦ Executive Board of Directors, Internet Security Alliance (ISA)

♦ Chairman, Best Practices Information Security Management Committee, ISA

♦ Executive Board Member of the Accredited Standards Committee, X9, Inc. (the not-for-profit that develops technical standards, certified by the American National Standards Institute, for the financial services industry)

♦ US Voting Delegate to the International Standards Organization (ISO), Financial Data Protection, Privacy and Security Standards TC68-SC2 & US TC68-SC6

♦ Consultant to the Federal Trade Commission (FTC), on the administration and roll out of the Fair and Accurate Credit Transactions Act of 2003 (FACTA) Web Portal, AnnualCreditReport.com.

Kevin’s other contributions include:

♦ Consultant to VISA in 2002 to develop the Cardholder Information Security Program (CISP), the basis for the Payment Card Industry Data Security Standards (PCI DSS).

♦ Co-Author of a 3-Part Series of “Common Sense Security Guides”, including THE COMMON SENSE GUIDE FOR SENIOR MANAGERS - Top Ten Recommended Information Security Practices, 1st Edition - July 2002, Internet Security Alliance, which is now used by the US Department of Homeland Security, National Association of Manufacturers, American Bankers Association, The National Federation of Independent Businesses, The National Cyber Security Alliance, Financial Services Coordinating Sector, TechNet, and US-India Business Council.

♦ The Cyber Security Guide for Executives & Senior Managers

♦ The Cyber Security Guide for Small Businesses

♦ The Cyber Security Guide for Virtual Employees & Mobile Executives

♦ Appeared as Cyber-terrorism Expert on CNBC’s Squawk Box with Mark Haines

♦ Appeared as Identity Privacy Protection Expert on KUCI Radio’s Privacy Piracy with Mari Frank

Kevin’s business experience includes serving as the Banking Security Officer of World Financial Network National Bank. Kevin has held positions of oversight of all regulatory compliance, data security, and data privacy issues, compliance with FFIEC Banking Regulations, and direction of OCC and SAS 70 Audits for his clients.

6 Comments on Losing Money? Watch Your Data Too…

Stocks and Bonds » Blog Archive » Worried About Losing Dollars? You Better Watch Your Data Too … on Wed, 10th Dec 2008 3:57 am


[...] Rebollo’s case isn’t as unique as banks would like to believe. If the wounded financial industry and its confused customers weren’t suffering enough, add another crisis to the list: Cybersecurity and privacy analysts say American banks …[Continue Reading] [...]

Odds ‘n Sods: | Islamic Alert - Islamic Alert: Islam and Terrorism In The Daily News. Islamic Jihad, Islamic Terrorism, Islamic Blogs, The True Nature of Islam. on Fri, 12th Dec 2008 6:12 pm


[...] From Sean M.: Money is not the only thing you can lose in a failing bank [...]

Harry Tran on Sun, 14th Dec 2008 12:21 am


I saw an episode of Manswers, and it might hold some truths, if you were to rob a person with a deadly weapon for $100 you’ll end up getting tossed into prison for a felony. But if you were to steal a few hundred credit card accounts from your companies database than you’ll lose your job and than get tossed into club med.

There is a large disconnect between white collared crimes and real crimes and their punishment even though the damage done to others is just as great.

Nick Maceus on Sun, 21st Dec 2008 5:45 am


Information security of business data and trade secrets makes encryption indespensable.

- Nick Maceus

maceus.com

Nick Maceus on Sun, 21st Dec 2008 5:48 am


PGP is standard for industry to encrypt the contents of business information database systems.

- Nick Maceus

maceus.com

Derek on Wed, 24th Dec 2008 10:59 am


Good article Anthony.. you are speaking plain ol common sense, amazing really how much common sense and basic controls over information are thrown out the window in many of our (supposedly) more trusted institutions. The problem of insider theft of information is definitely on the rise as a result of the huge layoffs going on.. and many of these companies are the same ones that have been saying all along that they did not need controls to monitor and audit insider access to data… guess they are seeing the light now eh? Too bad budgets are being slashed and the purchase and management of the needed controls are being postponed. I wonder how long we can afford to let that happen?