Breach Notification
,
Security Operations
‘The Security of Our Customers’ Data Is Our Top Priority’ – Really?
Does a day ever go by without a fresh set of data breach notifications? Some organizations’ breach notifications at least signal respect for the recipient. My preferred ones do victims the courtesy of channeling Detective Joe Friday from “Dragnet” – he of the “just the facts, ma’am” school of straight talking – and then telling victims precisely what risk they face and how to mitigate it.
See Also: Live Webinar | Securing the Cloud: Mitigating Vulnerabilities for Government
Others play it shadier. Imagine the police notifying an individual that one of their family members has died by starting with: “The security of our city’s residents is very important to us.”
Too many organizations that suffer a data breach resort to marketing spin, minimizing the blame, and in some cases, even indulging in corporate cheerleading in their breach notifications. Too often, they use weasel words and passive voice.
In the interest of calling a spade a spade, or calling out breached organizations that lack the courtesy to do so – here’s what every breached organization should avoid:
“The security of our customer’s data is important to us.”
Talk is cheap, especially because this is the standard opening line, meaning, “We had a data breach.” Why not just say so?
“Our customers are at the center of everything we do.”
Another common throwaway that came this week from Jeff Walsh, president of LoanDepot’s mortgage business, in a statement showing what the company didn’t do: prevent a hacker from stealing “sensitive personal information” for 16.6 million of its customers.
“We are investigating a cyber incident.”
Many organizations that suffer a hack attack or data breach – especially if it involves ransomware – bend over backwards to describe it as anything but. Some never officially state anything at all, except that they had an outage.
“We are giving individuals free identity theft protection.”
In the sweepstakes of life, is there ever a richer prize? If there was justice, organizations wouldn’t just “gift” affected individuals with a service too often trumpeted as being free, when individuals didn’t need the service until they were left to clean up the mess made by the breached organization.
“We have no evidence your stolen personal information has been maliciously used.”
Absence of evidence is not proof of the innocence. Until there’s a magical data breach fairy that can trace every piece of stolen data to its current or future nefarious use, this sentence means nothing.
“We have notified law enforcement and relevant regulatory authorities of this incident out of an abundance of caution.”
This regular refrain – uttered here by LastPass in 2022 – often seems to function as an attempt to say: “Look, we’re doing something now.” Of course, you’d never read: “We failed to notify regulators as required by law and are fleeing to a country that lacks an extradition treaty.” Notifying law enforcement is good practice, because the underlying intelligence might eventually help them track, disrupt or even catch the criminals.
“We have taken steps to secure the return of the data.”
This is code for “We paid our attackers a ransom” in return for a promise to delete stolen data. Security experts say never in the history of breaches has there ever been a confirmed case of data deletion. Regulatory authorities say paying for these empty promises will not lessen any sanctions they might impose.
“Rotate your secrets.”
Good breach notifications contain actionable information. Show of hands: Who knows what “rotate your secrets” means, as recommended by continuous integration and continuous delivery platform CircleCI after it suffered a breach? Likewise, just how bad was the breach of British outsourcing giant Capita? The firm said hackers had accessed “less than 0.1% of its server estate.” Of course, they didn’t clarify if that was the less important part.
“Everyone is falling victim to sophisticated cyberattacks.”
Who among us has not been breached? Or as LoanDepot said this week: “Unfortunately, we live in a world where these types of attacks are increasingly frequent and sophisticated, and our industry has not been spared.” This attempt to minimize responsibility sidesteps the question of culpability. Namely, did the breached organization underinvest in good defenses? Did it fail to have in place a thorough, well-rehearsed incident management program that immediately responded to suspicious activity and contained the intrusion?
“We are unable to ascertain what data attackers might have accessed.”
Organizations with good cybersecurity practices – and especially robust logging and monitoring – will typically be able to reconstruct what attackers may have accessed or not touched, and notify victims accordingly. Others get stuck staying they don’t know.
“I’m really proud of our team.”
Special mention again for LoanDepot, which after saying it had restored systems and notified 16.6 million customers that their “sensitive personal information” was stolen earlier this month, aims for a group hug. “I’m really proud of our team,” said Jeff Walsh, president of LoanDepot’s mortgage business, in a statement. “We’re glad to be back to doing what we do best: enabling our customers across the country to achieve their financial goals and dreams of homeownership.” Which of course begs the semi-obvious question: What is it that the company doesn’t do best?
In Closing: Who’s the Victim?
Is there any law or rule that penalizes organizations that subject data breach victims to notifications being stuffed with trite nonsense or unrestrained spin? Dear reader, there is not, unless businesses get their facts wrong (see: Blackbaud to Pay $3 Million Over ‘Erroneous’ Breach Details).
Even so, is it too much to ask more breached organizations to show some respect, by simply telling us straight what happened?