Responding to Privacy Breaches:
The Business Need for Information Security Incident Response Plans
By Rebecca Herold, CISSP, CISM, CISA, FLMI

Personally Identifiable Information (PII) Blowing In the Wind

On October 1, 2005, confidential health records originating from the Toronto Clinic dating back to 1992 were purposefully blown and scattered about the streets of Toronto, Ontario.  The Clinic had given the Paper Disposal Company, which provided their shredding services, boxes containing health records.  Reportedly due to a misunderstanding, the records were then given to a recycling company that subsequently sold the intact records to a film company that then used the records as props for a film about the immediate aftermath of the September 11, 2001, terrorist attacks on the World Trade Center.  On October 31, 2005 Ontario’s privacy commissioner found both the clinic and disposal company at fault and liable.

Who Has Access to Your PII?

Do you know who is peeking at the PII for which your organization is responsible? Do you know if that vendor to whom you’ve outsourced the processing of your PII has allowed your PII to get into the hands of a competitor or criminal without even knowing it?  Do you know if they may have donated your un-shredded confidential papers to the local public kindergarten to use as scrap paper?  Do you have alarms and processes in place to notify you when PII is inappropriately used or accessed?  Have you even thought about these issues?  Or, do you think someone else in your company is already taking care of all these pesky possibilities?  Or perhaps you think that such an incident is very unlikely and would have very little impact on your organization? 

You need to look into the protection capabilities of your PII and how your organization would be impacted by a privacy breach.  Or, perhaps your organization has already experienced one of the hundreds, perhaps thousands, of incidents that have already occurred and needs to re-examine…or create…your privacy breach preparedness plan. 

Information Security Incidents Continue to Grow

Privacy Rights Clearinghouse started keeping track of reported PII breaches within the United States a few months ago, and between February 15, 2005 starting with the ChoicePoint incident, and April 28, 2006 they logged 162 breaches that had been reported in the news.  These breaches cumulatively involved the information of at least 55 MILLION people.  The types of breaches varied greatly and included such incidents as:

• Stolen or lost computing devices, such as laptops, PDAs, and so on
• Insiders inappropriately using PII
• Hackers gaining unauthorized access to the information
• Fraud activities perpetrated by outsiders, insiders, and combinations of both
• Password compromise
• Lost backup tapes
• Paper documents not being shredded and given to people outside the organization
• Email messages with confidential information sent or forwarded inappropriately
• Information exposed online because of inadequate controls

Keep in mind these are just the reported incidents.  The author is aware of at least four other organizations that experienced and addressed significant breaches in 2005 that did not get publicized or included within these accumulated statistics.  And, yes, they contacted all their customers quickly.  Undoubtedly many more organizations have quietly addressed breach incidents while working diligently to keep the incident from being reported. 

Increasing Numbers of Breach Notification Laws

In 2005 breach notification legislation was introduced in at least 35 states.  As of April 7, 2006, at least 24 states had passed security breach notification laws.  All organizations must now effectively notify all affected U.S. residents for PII breaches.  Trying to notify only those within the states that have notification laws would not only be impossible to manage, it would also be a very bad business decision from a public relations perspective, not to mention the fact that the number of states with such laws is increasing rapidly, and that doing so would still leave you wide open for civil suits.

Privacy Breaches = Lost Customers

A Ponemon Lost Customer Information study released November 2005 sponsored by PGP Corporation revealed that businesses suffer greater breach incident impact from lost customer confidence and business than what the actual breach itself costs.  The survey revealed:

• Close to 12% of people had been notified about a data breach by companies with whom they did business.
• 20% of people said they immediately closed their accounts or stopped doing business with the company. 
• Companies reported the percentages of all customers lost following incidents ranged from 2.5% to 11%. There is clearly a disparity between what customers and companies report.

Another study released in December 2005, conducted in Canada by Leger Marketing and sponsored by Sun Microsystems of Canada, showed 58% of consumers said they would immediately stop doing business with a company that experienced a breach that put their personal information in jeopardy. 

The loss of customers will depend greatly on the type of breach, the service or product the company provides, how quickly the company contacts customers following a breach, the history the customer has had with the company, along with the general reputation.  The Leger Marketing survey reported 55% of companies indicate that the customer information for which they are responsible is not safe or secure.  The study also indicated 14% of Canadian consumers believe they have already been identity theft victims.

Privacy Breaches = Big $$ Losses

Another Ponemon PGP Corporation-sponsored Consumer Breach study, also released in November 2005, revealed the average impact to each of the 14 companies studied following a security breach was $14 million.  Actual costs included internal investigations, external legal fees, notification and call center costs, investor relations, promotions such as discounted services and products, lost personnel productivity, and the cost of the lost customers.  The costs to the organizations following a breach were more than the immediate costs of addressing a breach.

Breaches Have Significant Business Impact

In addition to the costs identified within the Ponemon report, there are additional costs involved with breaches, such as when an organization’s customers are other organizations.  For example, if you have customers who are companies that distribute your services or products to their employees or customers (such as if you provide group health insurance policies), then you will not only need to notify the individuals, but also demonstrate to the companies who are your customers what you are willing to do to keep their business.  This can be pricey.  You may need to fly representatives from the companies to your site to meet with your executives to discuss the situation, all on your dime. 

Additional breach response costs are also involved for notifications to individuals who are located outside your country, such as the costs for resources to work with the applicable country privacy commissioners, costs for translation services and call centers with multi-lingual capabilities, and so on.  And, depending upon your industry, locations, services and products, there could be many other areas a breach could financially impact.  It is worth taking an afternoon to brainstorm the possible impacts to help you better prepare to respond to a breach. 

The author created a privacy impact “calculator” that organizations have used to demonstrate to their business leaders just how much a breach could cost when considering multiple possibilities and factors.  (See an abbreviated version at http://www.informationshield.com/privacybreachcalc.html).  Such an exercise truly is an eye-opener and gets the attention of the leaders who can relate best to information presented as profits and losses.  It really helps to get the resources to do the activities necessary to create a breach response plan and implement the associated tools and procedures.

Do Not Delay Breach Notifications

The Ponemon Consumer Breach study highlights the importance of having an effective breach response plan in place to quickly notify customers.  Companies that took longer to notify customers of a breach were four times as likely to lose customers than if the customers were notified quickly and consistently.   A significant consideration determining customer retention was also the method of breach notification; the companies surveyed indicated they were three times more likely to lose customers if they notified them using a form letter or email instead of calling them on the phone or sending them a personalized letter.

One Of Many Potential Impacts is Identity Theft

Just one of the impacts to customers for privacy breaches is identity theft.  The likelihood for such fraud is dependent upon the type of breach.  Knowing how identity theft occurs will help organizations with implementing appropriate security, in addition to creating more effective breach response plans.

In December, 2005, ID Analytics released a study of identity theft resulting from four specific security breaches that occurred during the year.  While this certainly is a small number of incidents to examine, the findings are useful in considering security controls and breach response activities.  The findings included, among other things, that:

• The greatest potential for fraud and identity theft occurred when the breach incident targeted personal information, such as names, Social Security numbers, address, and birth dates.
• Notifying customers and consumers appeared to deter the perpetrators of the incident from fraudulently using the information.

So what steps should companies take to help stem the tide of PII breaches, and to be prepared in the event they still experience a breach?  Even if organizations were not required by law to report breaches, it is wise for organizations to be prepared for how to handle PII breaches; not only to protect the individuals involved, but also to demonstrate due diligence, meet legal requirements, and in turn help to protect the financial impact that a breach could have upon the organization.  At a very high level, organizations need to:

• Specifically define the information items that are considered as PII within the organization.  Currently there is no one existing list of what constitutes PII worldwide.  Consider all applicable laws in all locations where you have consumers, employees, and business partners.
• Define a breach, and the different levels of severity, as they apply to the organization.  You have likely heard the term “breach”, sometimes with “security” as a qualifier and sometimes with “privacy,” many times over the past few years.  Organizations need to define what constitutes a breach within their own organizations based upon the industry, services, products, geographic locations for not only your offices but also your customers, and applicable laws and regulations.
• Locate all the PII in the organization.  In the course of a business day, organizations collect PII in a many different ways.  Much of this information is in the form of unstructured data (generally data under the control of end-users, such as Word, Excel, email messages and so on).  Be comprehensive in your identification of PII storage locations.  Don’t forget about those often-overlooked and even unsuspecting storage areas where massive amounts of PII could be hiding.  Map out how the PII flows throughout the organization.
• Create the PII breach notification plan.  A 2005 Ponemon Institute survey of corporate privacy practices revealed only one third of companies had a formal process in place to monitor and report security breaches.
• Test the plan at least annually, and whenever major changes are made within the organization.  You need to ensure your plan is feasible before you put it to the test during a real incident.
• Implement a process to modify and update the breach identification and notification program and plan according to lessons learned and to incorporate industry developments and new legal and regulatory requirements.
• Define breach response team roles.  Effectively responding to a breach requires participation from and coordination throughout all areas of the organization.  Each role should have well documented responsibilities and backup personnel identified.  Make the responsibilities for each role very clear and make sure your team members know and understand these roles.
• Communicate the plan.  After investing all this work in creating a PII inventory and a breach identification and response plan, don’t drop the ball by not communicating the plan throughout the organization.  It is likely most, if not all, personnel handle or access some type of PII during the course of fulfilling their job responsibilities. 
• Regularly communicate information related to breaches and PII through a variety of awareness methods.  Cover not only incidents within the organization, but perhaps just as important for raising awareness, let personnel know what’s been happening within other organizations.  Include this information within yearly personnel information security and privacy training courses as well as your ongoing awareness messages.
• Provide training to the breach identification and notification team members.  Require the team members to participate in regular response drills, perhaps once or twice a year, to ensure they fully understand what they need to do when a breach occurs.

Be Prepared to Respond to Breaches, Or Be Prepared For Bad Business Impact

Preparing a breach response plan as part of a solid information security management and privacy assurance program is, of course, no guarantee of avoiding bad publicity or having a negative impact to your business following a breach.  However, being prepared for a beach response will certainly help to mitigate and lessen the impact of a breach if and when one occurs…and it could very possibly help prevent the organization from going out of business.  The more quickly, comprehensively and efficiently an organization can respond to and resolve a breach incident, the less financial, brand, and likely legal impact and damage it will have on the organization.  Remember, doing less following a breach will hurt an organization more in the long run.   

About the Author
Rebecca Herold, CISSP, CISM, CISA is an author, consultant and a Norwich MSIA professor.  She has 16+ years in information security, privacy and compliance experience and has authored 6 books.   For more information, contact Rebecca at (515) 491-1564 or by email at rebeccaherold@rebeccaherold.com