November 30, 2009
The Importance Of Information Security
Posted by: Admin : Category: information security
Andy Eliason asked:
We’ve all heard it over and over again: protect your personal information because identity theft is one of the most pervasive crimes in the current online and digital environment. A criminal can do a lot with your personal information, which includes destroying your credit history and your credibility.
Is it any wonder, then, that consumers are becoming more and more weary about giving out their sensitive information?
But, I hear you saying, surely the big companies can be trusted. Surely the big, national chains have their priorities set on information security.
This seems a valid assumption, until something like the TJX incident happens. Beginning sometime around July of 2005 some hackers spent nearly 18 months taking advantage of weaknesses in their wireless network security. Recent company estimates say that the breaches cost the company in excess of 118 million dollars. Other outside sources have placed the estimates in the range of 1.35 billion dollars when you throw in all the other fines, legal fees, and extra costs.
Lack of information security clearly hurts both customer and merchant. A security breach isn’t good for anyone. However, plain old theft is just the beginning of the problems.
Right now, the trust and belief that companies are dedicated to providing information security is the only thing that keeps digital commerce running. But what happens when enough stories about security problems come to the forefront of public knowledge? How much trust did TJX lose over their incident? What would happen if other huge online stores suffered such a breach? How long would it take to rebuild that trust? Will consumers ever believe that you have a priority on information security and trust you with their sensitive information again?
Believe it or not, information security is for the greater good.
And that could very likely be the reason why some some companies have problems with implementing proper security. Companies are not used to dealing with the greater good. On any given day a business can have countless, immediate problems that demand their attention. The basic mechanics of buying and selling alone are enough to keep a company overly busy. When are they supposed to make time for the “greater good”?
And even if they are only thinking of their own company, it is still sometimes difficult to prioritize information security on the basis of a possible breach. There just always seems like there’s too much to do in the here-and-now to worry about possibilities.
For that reason the major credit card companies came together and developed the PCI DSS (or Payment Card Industry Data Security Standard). PCI compliance is now mandated by the Payment Card Industry so that companies will start to realize how important information security, and how they can benefit by implementing security measures sooner rather than later.
Any company that transmits, processes, or stores sensitive credit card information is required to be PCI compliant. And to help encourage companies to work toward compliance, the PCI Security Standards Council has provided a number of incentives. These can come in the form of punishments or privileges, depending on how quick you are to become compliant.
The punishments can be harsh, but sometimes that’s the only way to emphasize the importance of information security. If a merchant is not PCI compliant when they suffer a security breach, they could be subject to fines from $90 to $305 dollars per breached record.
The TJX incident resulted in nearly 100 million lost credit card numbers. It doesn’t require a lot of mathematical knowhow to realize the implications here.
PCI compliance means that you have taken all the required steps to ensure information security. Though if you should still happen to suffer a breach, you can expect protection from those fines in the form of something they call a Safe Harbor.
Information security is absolutely essential as we delve deeper and deeper into the digital age, and a merchant has a couple of choices. One, to start implementing strong security now and start experiencing the benefits of a secure site and trusting consumer base. Two, wait until later, and risk acquiring a reputation that no business should want, and only a few can survive.
We’ve all heard it over and over again: protect your personal information because identity theft is one of the most pervasive crimes in the current online and digital environment. A criminal can do a lot with your personal information, which includes destroying your credit history and your credibility.
Is it any wonder, then, that consumers are becoming more and more weary about giving out their sensitive information?
But, I hear you saying, surely the big companies can be trusted. Surely the big, national chains have their priorities set on information security.
This seems a valid assumption, until something like the TJX incident happens. Beginning sometime around July of 2005 some hackers spent nearly 18 months taking advantage of weaknesses in their wireless network security. Recent company estimates say that the breaches cost the company in excess of 118 million dollars. Other outside sources have placed the estimates in the range of 1.35 billion dollars when you throw in all the other fines, legal fees, and extra costs.
Lack of information security clearly hurts both customer and merchant. A security breach isn’t good for anyone. However, plain old theft is just the beginning of the problems.
Right now, the trust and belief that companies are dedicated to providing information security is the only thing that keeps digital commerce running. But what happens when enough stories about security problems come to the forefront of public knowledge? How much trust did TJX lose over their incident? What would happen if other huge online stores suffered such a breach? How long would it take to rebuild that trust? Will consumers ever believe that you have a priority on information security and trust you with their sensitive information again?
Believe it or not, information security is for the greater good.
And that could very likely be the reason why some some companies have problems with implementing proper security. Companies are not used to dealing with the greater good. On any given day a business can have countless, immediate problems that demand their attention. The basic mechanics of buying and selling alone are enough to keep a company overly busy. When are they supposed to make time for the “greater good”?
And even if they are only thinking of their own company, it is still sometimes difficult to prioritize information security on the basis of a possible breach. There just always seems like there’s too much to do in the here-and-now to worry about possibilities.
For that reason the major credit card companies came together and developed the PCI DSS (or Payment Card Industry Data Security Standard). PCI compliance is now mandated by the Payment Card Industry so that companies will start to realize how important information security, and how they can benefit by implementing security measures sooner rather than later.
Any company that transmits, processes, or stores sensitive credit card information is required to be PCI compliant. And to help encourage companies to work toward compliance, the PCI Security Standards Council has provided a number of incentives. These can come in the form of punishments or privileges, depending on how quick you are to become compliant.
The punishments can be harsh, but sometimes that’s the only way to emphasize the importance of information security. If a merchant is not PCI compliant when they suffer a security breach, they could be subject to fines from $90 to $305 dollars per breached record.
The TJX incident resulted in nearly 100 million lost credit card numbers. It doesn’t require a lot of mathematical knowhow to realize the implications here.
PCI compliance means that you have taken all the required steps to ensure information security. Though if you should still happen to suffer a breach, you can expect protection from those fines in the form of something they call a Safe Harbor.
Information security is absolutely essential as we delve deeper and deeper into the digital age, and a merchant has a couple of choices. One, to start implementing strong security now and start experiencing the benefits of a secure site and trusting consumer base. Two, wait until later, and risk acquiring a reputation that no business should want, and only a few can survive.
