Upload
anna-hampton
View
219
Download
0
Embed Size (px)
DESCRIPTION
PRIVACY, IN GENERAL Privacy and Data Privacy are becoming topics du jour The word “privacy” does not appear in either the US Constitution or the Bill of Rights So, What is “privacy”, especially in the electronic era?
Citation preview
PII AWARENESS TRAININGDON’T BE TOMORROW’S HEADLINES…
JASON DUPUY, DIRECTOR OF IT, MAINEHOUSING
AGENDA
• What does PII actually mean?• Current Issues where PII is threatened.• Guidelines: Federal and State• How can we comply? Strategies and
Practices• How can PII Leak out?• Some Pragmatic Defenses.
PRIVACY, IN GENERAL• Privacy and Data Privacy are
becoming topics du jour
• The word “privacy” does not appear in either the US Constitution or the Bill of Rights
So, What is “privacy”, especially in the electronic era?
MULTIPLE NAMES AND ACRONYMS• PII – Personally Identifiable Information• NPPI – Non Public Personal Information• NPPFI – Non Public Personal Financial Information• IIF – Information in Identifiable Form• PHI – Protected Health Information (HIPAA)• IIHI – Individually Identifiable Health Information
WHAT IS CERTAIN…Whenever the acronym PII crops up – particularly in the media, the connotation is badWHY?
PII LOSSIt usually occurs in connection with one of the following:• Breach of Security
• Most data breaches were due to malicious or criminal attacks
• Loss or unauthorized disclosure• Theft• Postal
COST OF DATA BREACHES• …rose by 10% from 2013 to 2014• US $201 per RECORD• Average total cost in 2014: $5.8
Million• Costs included• Notification
• Credit monitoring services• Engaging forensic experts• Audit Services• Lost Business
WHAT IS PERSONALLY IDENTIFIABLE INFORMATION?
IN GENERAL
Information (electronic or other) that can be used..• To uniquely identify, contact or locate a single person• Or which can be used with other sources to uniquely
identify a single individual
Official Sources• US Office of Management and Budget (OMB) – Government
Agencies• US National Institute of Standards (NIST) – IT Source• Maine State Attorney General – State Government
OMB EXAMPLES OF PII
• Full Name• Birth Date• Birthplace• National ID Numbers:
• SSN, Passport, taxpayer ID, driver’s license
• Mother’s maiden name• Sex or Race
• Credit Card Numbers• IP addresses• Vehicle Registration
Numbers• Digital Identity• Biometrics• Genetic Information
NIST EXAMPLES OF PII
• Name: full name, maiden name, mother’s maiden name or alias• Personal ID Numbers: SSN, passport, driver’s license, taxpayer
ID, patient ID, credit or debit card numbers• Address Information: street or email address• Asset Information: IP or MAC address• Telephone Numbers: mobile, business and personal numbers• Personal Characteristics: photographic image, X-Rays,
fingerprints or other biometric• Personally Owned Property: Vehicle registration or title number
“”
PII IS ANY INFORMATION ABOUT AN INDIVIDUAL THAT CAN BE USED TO DISTINGUISH OR TRACE AN INDIVIDUAL’S IDENTITY. PII IS ALSO ANY OTHER INFORMATION THAT IS LINKED (OR LINKABLE) TO AN INDIVIDUAL, SUCH AS MEDICAL OR FINANCIAL INFORMATION
MaineHousing Authority definition of PII – MaineHousing Acceptable Use Policy, June 2011
MAINEHOUSING EXAMPLES OF PII• Any information provided by applicants or participants in
MaineHousing programs (includes information provided by third parties working on behalf of an applicant/participant)• Personal Identification Numbers, such as social security
number (SSN), passport number, driver’s license number• Financial account or credit card information, including
account numbers, card numbers, expiration dates, cardholder name or service codes
MAINEHOUSING EXAMPLES OF PII• Healthcare / Medical information disclosed to
MaineHousing• Names and addresses of clients participating in
MaineHousing programs or on waiting lists• The address of a shelter or other living
accommodations for victims of domestic violence.
• THE FORMAT DOES NOT MATTER (Electronic or Paper)
CONFUSED YET?
FUN TIME – BREACH EXAMPLES!
MIT LEAKS PII• Personal records, including SSN of
approximately 800 members of the MIT community were emailed to an MIT mailing list – 150 people received this list!
• SSN of 11K MIT employees posted in a publicly accessible file• Six months before system administrators
became aware of the problem!
UNIVERSITY OF MARYLAND• 300K personal records for faculty, staff
and students were compromised• Information breached included Names,
SSN, DOB and university identification numbers
-Millions of $$$ in credit protection service for 5 years*one of the only universities in the US offering a PHD in… Information/Network Security!
TARGET• Had installed network monitoring software• Alerted admins to suspicious activity after
hackers infiltrated• Due to “workload” the warnings were
ignored• 40M credit card numbers, 70M addresses
and phone numbers• Cost 60 Million in Q1 alone• CEO and CIO were fired
HOME DEPOT• Identified the same attack vector as
Target• Commissioned a project to “batten down
the hatches”• Took 6 months to find, select, test and
deploy system• Hackers were in and out…
• 56M debit and credit cards• 53M email addresses• Cost 60M (excluding lawsuits ongoing)
JP MORGAN• One of the world’s largest banks: 96B in
revenues (2013)• Cyber attack compromised 76M
households and 7M business accounts• Names, addresses, phone numbers,
email addresses• Internal JP Morgan information about
users• Hacker’s gained “the highest level of
admin privilege on more than 90 of the bank’s servers
HOW PRIVATE IS PII?Attribute Combination Uniqueness
DOB and 9-Digit Zip 97%DOB and 5-Digit Zip 69%
DOB, Sex and place (City, town, municipality
53%
1. MIT Study showed that 69% of the individuals on a voting list were identifiable using only 5-digit zip code and DOB, while 97% were identifiable using 9-digit zip code and DOB.
2. This information could be linked with medical data to discern medical diagnosis, procedures and medications to an individual
MIT STUDYDe-identified Medical Insurance List• 135K State of Massachusetts
Employees• Included the Governor Weld
(who lived in Cambridge, MA)• Medical Data linked with Voter
Registration List• Only 6 people in Cambridge
with his DOB• Only 3 were men• Only one had his 5-digit ZIP!!
MOBILE PHONE• In 2010, computer
scientists studied more than 2 dozen smart phone apps
• Half of these apps transmit the SIM card ID, the IMEI number and the GEOLOC coordinates real-time back to the remote servers of the app vendor
• Duke built an app that can track this behavior
WEBCAM ABUSEWelcome to being watched!!
Hackers can remotely turn on cameras and capture activity
• Cyprus – man arrested for taking illicit pictures of teenagers
• Spain – man stole thousands of banking passwords, worldwide
• Robbins vs. Lower Merion School District – class action lawsuit involving 2 high school students using school provided laptops to spy on others; both during school and at home: settled for $160K
QUESTIONWould the following be classified as PII and Why?-an organization publishes a phone directory of employees’ names and work phone numbers on the web, so members of the public can contact them?Answer: NoReason: the organization has authority to release that information publicly
ARE YOU SCARED?
“”
ONCE MORE UNTO THE BREACH, DEAR FRIENDS
Henry V, ACT III
RECENT GOVERNMENT LOSSES
• Farm Services Agency: inadvertently releases CDs containing SSN and tax IDs from US tobacco producers• US Marine Corps: Loses a thumb drive with names, SSN,
and other PII for Marines on active duty, 2001-2005• HHS: Contractor loses a laptop with names, phone #s,
medical records and DOB – 49K Medicare beneficiaries• VA: computer stolen from employee’s home exposing
26.5M active duty records
RECENT PRIVATE ENTERPRISE LOSSES• Sony: 100M accounts lost including credit and debit
card data• Heartland Payment Systems: 130M credit cards stolen• Epsilon: World’s largest email marketing service
provider is hacked, losing PII from hundreds of corporate customers:• TiVo, JP Morgan, Ritz-Carlton, Marriot, Walgreens, LL
Bean!
AND ON, AND ON…
SAFEGUARDS – PROTECTING PII
• Physical Safeguards• Technical Safeguards• Administrative
Safeguards
PHYSICAL SAFEGUARDS• Paper records should be stored in
locked file cabinets• Areas where PII is referenced
should be monitored and access limited
• Never leave files, storage media, or computers unattended, or in vehicles
• Records should be disposed of properly
TECHNICAL SAFEGUARDSENCRYPTION!!!!
• Ensure ALL email containing PII are encrypted
• Ensure PII records are access controlled – Need to know only
• Ensure SSN, including the last 4 are not posted on public facing websites
• Install Data Leak Prevention software and tools
ADMINISTRATIVE SAFEGUARDS• Create policies concerning the
handling of PII• Require annual security awareness
training with an emphasis on PII• Follow applicable federal and state
compliance rules and guidance• Perform a Privacy Impact Assessment• Review reports, scripts and
spreadsheets to determine if PII is required
MAINEHOUSING’S SAFEGUARDS• Physical files are locked every
night• Access to interior building
areas controlled• All physical medium
destroyed/shredded on-site• Outgoing emails scanned for
unencrypted PII – BLOCKED• All portable hardware is
encrypted
• Data Leak Prevention system blocks USB drives and CDRom Access
• Limited “Cloud” Access• Privacy policy in place• Annual Security Awareness
Training mandatory for all employees
• Review of access controls in all applications
WEAKEST LINK
Do not be the weakest link…• Maintain awareness…• Think twice about
sending that PII• Ask for help!
QUESTIONS?