ISR News: The Open Security Foundation
Excerpts From BlogWired.com
For years, researchers with the nonprofit Open Security Foundation have been scouring press reports, bank websites and other sources for information on consumer data spills, tallying more than 394 million records lost or compromised in 1,700 incidents since 2000.
The foundation is accustomed to reading breach-disclosure tea leaves. The group is one of a handful of citizen and nonprofit groups that collect breach data from around the United States and serve as watchdogs to ensure that poor security practices are exposed and fixed. The group’s work, posted on its DataLossDB website, is used by the Government Accountability Office and other U.S. agencies, as well as by identity-theft organizations, consumer rights groups, security firms and academics. Last year alone DataLoss cataloged 551 separate breaches of consumer information.
Experts say this work is increasingly important. Despite laws in more than three dozen states requiring companies to disclose breaches, many still go unreported, and there is no government agency that compiles reliable statistics on breaches to help the public get a clear picture of the scope of the problem. That’s left to volunteer-managed databases like the foundation’s DataLoss.
“What’s really exciting to me about this database is it’s the first time we’ve actually had insight into what goes wrong on anything other than an anecdotal level,” says breach-expert Adam Shostack, a senior program manager in Microsoft’s Trustworthy Computing Division. “I’ve been working in security for nearly two decades, and stuff has been going wrong all that time. No one ever talked about it. No one ever wanted to give you any details. The value of DataLoss is that it gets us to understanding what’s going wrong for these organizations.”
“If we weren’t doing this sort of work, the breaches might still be in the headlines,” says Shettler. “But I don’t think it would be getting the same sort of attention as it does when organizations like us sit down and put it into perspective.”
Filed under: Breach, Financial, Government, ISR News, Insider Threat, Sarbanes-Oxley, Uncategorized, hackers, malware, national security, privacy
Comments
One Comment on ISR News: The Open Security Foundation
-
Privacy Rights Clearinghouse on
Mon, 23rd Feb 2009 5:04 pm
[...] ISR News: The Open Security Foundation : Information Security … (information-security-resources.com) - February 22, 2009The group’s work, posted on its DataLossDB website, is used by the Government Accountability Office and other U.S. agencies, as well as by identity-theft organizations, consumer rights groups, securit… [...]
Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!
