How much is your data worth, do you know and how do you work it out?
One of the points I tried to make during my breach disclosure presentation at AthCon'12 was the need for some regulated standard for the value of personal data. I wanted to state the importance of setting a value for data so that the value can be used to help estimate how much protection it needs.
For example - if you are the proud owner of 1961 E-type Jag a quick shufti on autotrader will tell you that these are valued at around £129,000, and a '72 model around £100k less at £27,000.
Ok, where am I going with this little de-tour into classic cars? Within a few clicks of a mouse I've got a rough idea of what my asset is valued at. If I wanted to, I could fill out the forms on one of the many comparison sites and get a quote for car insurance, a few clicks later and I know how much a third party is going to charge me to accept the risk of damage/theft/fire etc...
If only information security was that simple, but it isn't. The threats we have to manage change daily, risk mitigation is complex and often a seemingly unachievable, endless battle. The risk focused CISO could easily be forgiven for finding themselves in a spin. Buzzwords are a plenty, opinions can vary, and technology is only half the battle!
To make things worse it is hard to value data. As is often said, you wouldn't spend a £100 to protect an asset valued at £1. But how do we know how much data is worth? The problem with data is its worth different things to different people. We can't just use a "market" valuation in the same way we can with the great e-type. Your customer data may be hugely valuable to you in some instances and of no value to you in others. However it is always of value to the customer in terms of their privacy. That is the regulators responsibility to uphold. Even if the customer doesn't care, the regulator is responsible to make sure that there are some principles that are adhered to. We know personal data is worth less than sensitive data in respect to the Data Protection Act and there is a maximum fine of £500,000 from the ICO. Sometimes it feels like that is about as much as we have to work with. No comparison sites, no defined minimum value. Confused?(.com)
One of the reasons I think the PCI DSS got traction in its early days was that the data was given a value, $25 per card if memory serves me correctly, based on the cost of re-issuing a card. Couple this with the cost of any fraud committed and then perhaps a fine for none compliance and value can be quantified. If you store 100,000 card numbers, that data (then) would be worth at least $2.5m+. From here the business case for a security standard is born.
Personal data on the other hand seems to be something of a quandary. If we review the monetary penalty notices by the ICO you will start to see what I mean.
Recently there was a fine issued to Brighton and Sussex University Hospitals for £325,000 for not controlling the destruction of highly sensitive data properly. Circa 70,000 records with highly sensitive medical data were lost. So this equates to £4.60 per record. Which seems very low for information related to an individuals sexual health and preference.
A £90,000 fine was issued to Central London Community Healthcare NHS Trust for the loss/inappropriate transmission of 59 faxes containing information relating to medical diagnosis and palliative care info (£1525 per fax).
Looking at the less sensitive data is even less helpful. When a gambling industry worker sold over 65,000 records from an online bingo company for in the region of £25,000 (according to the ICO) he received a conditional discharge and was ordered to pay £1,700 as well as £830.80 costs.
The case of the bingo-bandit highlights a significant problem. The organisation who had the data stolen couldn't/didn't determine the perpetrator and the punishment levied against the buyer wasn't really proportionate to the value the data had to him.
If the ICO were able to set a minimum value for a personal record and a minimum value for a sensitive record they could then set expectations of what reasonable controls are for that data. This could then be based on the data's minimum value. In the event of a loss of that data, the ICO could say X records multiplied by value A is my starting point. Then apply a distress factor, and perhaps a responsibility factor (how well controlled, etc etc) - this would then give people and indicator. These factors in the multiplier could be used to dictate behaviours. E.g. organisations that come forward openly, and demonstrate transparency should be rewarded (in my opinion) as this allows the situation to be dealt swiftly and with in the interests of the data subject at the centre.
No comments:
Post a Comment