Brace Yourself for a Data Breach

When the words “teen bikini” popped up during a routine inspection of the Oregon Department of Revenue’s firewalls, the trail led to a misused PC infected with a keylogger. As a result, the infected PC exposed 2,200 taxpayer IDs and other personal records.

“The most painful part of the process was trying to identify what data was sent out under the keylogger,” says Amy McLaughlin, who at the time of the June 2006 incident was IT security officer for the state’s Department of Revenue (DOR). “It took several days of six people pulling data, trying to identify what data entry was typed at the time and what was sent out.”

McLaughlin, who is now IT infrastructure manager for the Oregon Division of Administrative Services, has learned from the experience. She and other first responders hope other agencies can learn these lessons before they, too, find themselves embroiled in a public breach disclosure.

“Realistically, in the world we live in, every organization is going to have some type of data security incident. So know beforehand what you’re going to do when that day comes,” says Sol Bermann, chief privacy officer for Ohio’s Office of Information Technology.

Notify IT Leaders

Last June, Bermann was part of an investigation into a stolen backup tape belonging to the state’s Office of Management and Budget that contained personally identifiable information on 770,000 employees, benefits recipients and taxpayers. At the onset, OMB network operators investigating the scope of the breach took too long reporting the problem to managers, which became the most costly mistake in the process.

“Internal reporting is the biggest problem agencies have with reporting from the start,” advises Joanne McNabb, chief of the California Office of Privacy Protection in Sacramento. “Don’t hold up reporting while you’re trying to figure out what type of data is lost. Notify your information security officer the moment you suspect any type of breach and make that the central point for reporting internally and up the chain.”

In the Ohio case, a 22-year-old, $10.50-an-hour intern lost the tape when it was stolen from his car. Knowing the tape had a good amount of confidential data backed up, the intern described it on the Hilliard Police report simply as “a device worth $15.” By failing to report the existence of privacy- protected data on the tape to law enforcement until days later, the critical first hours to search for the tape were lost because law enforcement didn’t realize its value, according to the state Inspector General’s report.

“If the device had been found quickly, it’s quite possible we would not have had to report it out,” says Bermann, adding that often thieves don’t know the value of the device and toss it into a dumpster nearby.

If litigation is a possibility, investigative evidence must be certifiably forensically sound, which means having on hand these resources ahead of time, advises McLaughlin. In the Oregon case, forensic skills were particularly critical, as there was concern of finding illegal images, given the illicit sites the user visited in violation of policy after disabling Web-filtering software.

Go Public

Tap a team of responders — technical, legal, public relations, affected business units, executive offices, other state agencies and outside response agencies — to share and disseminate information.

To get started, borrow from your existing emergency response processes and contact lists, then conduct mock exercises on a regular basis, advises Dan Lohrmann, Michigan CISO, Office of Enterprise Security in Lansing, Mich.

Lohrmann’s office recently had a security scare. An offsite contractor lost — then later found dropped behind a rack — a backup tape, which forced his agency nearly to the point of going public with disclosure. The incident, he says, brought together representatives from legal, human resources, department directors, the attorney general, civil services and other operational silos.

“IT, communications and legal are all separate silos that, in the normal course of business, may not talk to each other. But they need to be prepared ahead of time that responding to a breach is an interdisciplinary endeavor [that requires they] very quickly work together,” Bermann advises.

Knowing when to publicly disclose the breach is another gray area organizations grapple with. You don’t want to disclose before you have all the information to determine what data was breached, but you must disclose quickly, experts say.

“You’re balancing the interest of giving people quick notice (so they can take protective action) against not wanting to frighten people unnecessarily,” California’s McNabb explains. “In the case of a law enforcement investigation, it might mean ordered delays in reporting.”

Improve Processes

Once the hubbub of the initial disclosure dies down, agencies must analyze what went wrong with the security and response processes and implement repairs where needed.

For example, the Ohio CIO’s office went on a systemwide re-engineering of security and reporting practices, starting with the long-overlooked bad practice of having state employees and interns take their backups home every night.

After its incident, the Oregon DOR implemented a no-surfing policy, among other things. Now, employees can only access the Internet for personal use during lunch and breaks using a wireless network owned and operated by the cafeteria management company.

“It seems like everyone has to have their particular lesson before they encrypt their laptops,” McNabb surmises. “In that sense, law has been the great educator.”