In his book The Outliers, Malcolm Gladwell espoused the theory that to achieve excellence in any field, one needed to practice it for 10,000 hours. So…does the 10,000 hour rule apply also to doing something 10,000 times? It may not be a perfect application of the theory but, in light of a recent report, one wonders just how much more practice the Federal Government needs to properly manage Canada’s records.
The CBC reported this week that the National Security Sweep Program revealed more than 10,000 incidents of classified or secure information being improperly stored by federal government employees since last November. While some of these were sensitive paper document left out on desks or filing cabinets not locked, others involved digital information not being properly handled. Okay – we know that 10,000 hours is not the same as 10,000 times, but you get the point.
Of the departments that report (Revenue Canada and the Justice Department were not included in the report), Public Services and Procurement Canada, the Global Affairs Department and, believe it or not, CSIS, were the worst offenders, accounting for over 60% of the infractions.
The Federal government has been the target of hackers over the past couple of years. In 2011, it was revealed that Chinese hackers had gained access to three departments and stole classified information. During the Tax crunch in April of 2014, Revenue Canada’s tax return site was targeted and shut down for several days. And, in June 2015, the government’s websites and their primary email servers were shut down for a couple of hours. In response to those events, Public Safety Canada reported that it had spent $245 million to harden the government’s computer networks.
While most government ministers declined to explain the lapses in security, Ralph Goodale (Minister of Public Safety) did assure the public that, once a sensitive document that was left out in the open was identified, it was locked up. Sort of like closing the stable door after the horse has bolted.
The improper handling of sensitive information in government appears to be pervasive. Whether the cause is poor training or poor information management systems, the result is the same: sensitive information which is improperly secured is a gold-mine for cyber-criminals.
While Public Safety Canada’s solution to build stronger walls is an important part of cybersecurity strategy, strong walls are not enough – one also has to make sure that sensitive information is not left outside those walls. The Federal Government should take the lead in cybersecurity. Unfortunately, Canadians will now question whether that is presently the case.
At the annual eDiscovery Institute conference yesterday, Susan Wortzman spoke about eDiscovery and Information Governance issues in the news. The panel also featured Iris Fischer from Blakes and John Ratchford of Navigator Ltd. Mr. Ratchford mentioned a survey his firm conducted last year that asked Canadians about how well they believed their personal information was being protected by retailers, financial institutions, technology providers and government agencies. The findings were interesting.
Almost three-quarters of those asked were not only aware of recent cyber-attacks, but could name specific North American retailers and Canadian government agencies that had been subjected to a data breach. The fact that specific data breaches were recalled shows that cybersecurity is of major concern to the general public.
Retailers were clearly held accountable by consumers, In the case of stolen credit cards, for instance, while most people conceded that the criminal hackers were primarily responsible for the breaches, 65% also assigned blame to the retailers rather than the banks, payment systems or credit card issuers whose technology was actually compromised.
Although survey respondents are concerned about organizations that hold their more detailed private information, such as government agencies and banks, the vast majority of them were confident that these organizations had sufficient security processes in place to safeguard the data.
Almost two-thirds of the people said that the government should impose much stricter rules around the security of personal and customer information held by others. They also want immediate public disclosure of any compromising of their data.
Protecting data is certainly important. However, as we have often said, walls can and will be breached. When this occurs, having an information governance and cybersecurity response plan in place will address the immediate demand from the public for disclosure and remediation, and may even keep your organization out of the headlines.
Far too many people are cavalier about password security. Perhaps knowing what cyber-thieves do once they have your password will encourage better practices. Fortunately, as reported on the BBC News website, two computer scientists from the University College in London, England recently released the findings of a study on this very topic.
The duo created 100 fake Gmail accounts and then “accidentally” shared their credentials on forums and sites that nefarious data traders are known to frequent.
What they found was that there are three main types of data thieves:
Password theft is increasing. Yahoo, MySpace, Twitter, LinkedIn, Dropbox and Tumblr have at least two things in common. They are all widely used social networking sites (well, maybe not MySpace anymore), and they have all had their user accounts stolen in the past couple of years. Yahoo has the dubious honour of having the most user accounts stolen – over 500 million were acquired by thieves in 2014.
If you have a user account on any of these sites, you ought to change your password. In fact, changing your password for any user account, on a regular basis, is a good habit to pick up. Not only will you protect yourself, you will help to protect all of your contacts from becoming victims as well.
Information security should be at the top of everyone’s list of Internet habits. The better protected you are, the less likely you are to be the victim, and tool, of a data thief.
Vote for our Blog - Click Below