FileTalk - An Accellion Blog

Ouch.  That headline is just not good, anyway you look at it.  As reported in an SC Magazine article today “An email sent in error that contained details of General Motors’ upcoming flotation could have cost Swiss Bank UBS an estimated $10 million.”

This data security lapse appears to have resulted in UBS being dropped as an underwriter for the plan by GM’s owners to sell $10bn in common stock on November 18, to partially payback some of the $50bn US Government bail-out the company received during the financial crisis.

This mistake should never have been allowed to happen.  While humans do make mistakes, there are any number of IT security systems that could have prevented or reduced the risk of this mistake.  Let’s review some obvious ones:

•  Any communications on such a large financial deal should have been sent securely, requiring user authentication.
•  Content monitoring and filtering software could have flagged the email for sensitive information and quarantined the email until it had been approved for sending.
•  Sending sensitive financial information via secure file transfer would have allowed the download link to be deactivated once the error was detected.
•  Sending sensitive information via secure file transfer would also have resulted in a return receipt from any unintended recipients allowing earlier detection and reduction of further downloads.

It’s very hard to understand why at least one of these data security systems was not in place to mitigate the risk. With the size of financial transactions that are at stake, it seems a wise and prudent investment for financial institutions to put in place IT safeguards against human error.  While email is wonderfully accessible and easy to use for business users, it is far too easy to make an inadvertent mistake that unfortunately can have significant financial implications.

At Accellion we help a large number of financial institutions, including the Bank of Scotland, Houlihan Lokey Howard & Zukin and Deloitte & Touche, protect their confidential information with secure file transfer solutions that reduce the financial risk of business user mistakes.  We understand that to err is human.

The Digital Forensics Association just completed a fascinating new report ominously titled “The Leaking Vault – Five Years of Data Breaches”.  The report analyzes over 2,800 data loss incidents from publicly accessible sources and is the largest study of its kind.  It’s a great read if you have a strong stomach for forty two pages of data breach data.

One eye popping data point is that during 2005 – 2009, 148.6 million records have been reported lost due to use of portable media.  This source of data breach is second only to data hacks. Perhaps most alarming is that loss of data from portable media represents the fastest growing data breach sector.

The security risks from portable media is a topic we’ve covered several times in the past year in the Accellion Managed File Transfer Blog.  Just in case you missed the earlier posts here they are again.

• Health records found on USB stick in UK Car Park

• Top 3 File Transfer Mistakes

• Another reason why file transfer via a USB stick is not a good idea

In addition to sharing the unpleasant truths regarding data breaches the Leaking Vault report also offers some good recommendations on steps to take to increase data security.  Recommendations for securing Portable Data is one of their four focus topics.

Here’s Accellion’s recommendation for reducing the risk of data breach from portable media  - Don’t use USB memory sticks for file transfer, use a secure file transfer solution.

The recently introduced C29 amendment to the Canadian Personal Information Protection and Electronics Documents Act (PIPEDA) is a sign that the Canadian government is stepping up its efforts to raise the visibility of data breaches through expanded data notification requirements.  This week’s SC magazine article entitled “Canada’s newly introduced data breach is a start, but it lacks teeth” raises the question of whether this legislation goes far enough.  Under the C29 amendment, banks, retailers and other companies are required to report any “material breach of security safeguards involving personal information under their control.”  In the amendment, the focus is on notification not specifically prevention.

While it is some consolation to the individual to know that they will be informed if their personal information has been breached, it would be a lot more reassuring to hear that corporations are required by law to implement safeguards to protect their information. The recently introduced Massachusetts legislation CMR-17 is a good model for legislation that goes significantly further than setting regulations for notification and extends to requirements for data breach prevention.

While data breach notification regulations are a good step in the right direction, an ounce of prevention is worth more than a pound of notification.

A few weeks ago my daughter and I went to Las Vegas so I could attend a security conference. It just so happened that her school was having Spring Break the same week. Luckily I had a friend who was going there at the same time so they could play all day while I attended sessions on securing Enterprise data. Not sure who got the better deal

It turned out that the conference was really interesting. One of the sessions I attended had 4 CIOs from 4 different verticals (Healthcare, Law, Technology, and a major University) on a panel where attendees could ask questions regarding how they secured data within their Enterprise. They discussed many subjects including the difficulties of managing data leaving the Enterprise, managing a work force that is geographically dispersed and working more and more from home, and trying to keep up with the new generation of workers who expose themselves on social sites but get very upset if any part of their financial or personal data gets confiscated or used for purposes they did not approve.

The location of the conference was also interesting. It just so happens that Nevada was the first state to require businesses to secure personal data. Nevada State legislation Chapter 603-A was introduced in 2005 and an amendment was added late last year. This amendment added 2 significant changes: (1) a requirement to comply with the Payment Card Industry Data Security Standard (PCI); and (2) requirements to encrypt personal information in certain contexts.

This year Massachusetts followed suit with their own legislation, CMR-17. Part 3 of the Computer Systems Security Requirements requires:  (3)Encryption of all transmitted records and files containing personal information that will travel across public networks, and encryption of all data containing personal information to be transmitted wirelessly.

It is good to see State Government taking an interest in controlling the transmission of sensitive personal data. Accellion Secure File Transfer helps businesses in these States comply with these new laws. Not only does Accellion send files encrypted, but also stores these files encrypted.

Vegas and Security? I guess these guys are ahead of the pack! I wonder when the rest of the world will catch up?

Mary Nicknish, Accellion Product Manager