HOW TO THINK ABOUT SECURITY BREACHES
1RUG931DQG7RU*XDUGFHUWDLQO\DUHQ¶WWKH¿UVWFRPSDQLHVRUHYHQWKH
¿UVWVHFXULW\FRPSDQLHVWRH[SHULHQFHPDMRUVHFXULW\EUHDFKHV,Q
JHQHUDOP\DSSURDFKWRHYDOXDWLQJSURGXFWVWKDWVX̆HUVHFXULW\
breaches is to judge them as much on how they handle the breach as the
VHYHULW\RIWKHEUHDFKLWVHOI
$IWHUDOODWWDFNVDJDLQVWDQ\RUJDQL]DWLRQWKDWVWRUHVXVHULQIRUPDWLRQ²
ZKLFKLVHYHU\RUJDQL]DWLRQ²DUHWREHH[SHFWHG1RWWREHF\QLFDOEXW
EUHDFKHVDUHJRLQJWRKDSSHQ7KH\PLJKWEHVPDOOWKH\PLJKWEH
PDVVLYH²EXWHYHQWXDOO\VRPHRQHZLOO¿QGDZD\LQ
:KDWLVPRUHLPSRUWDQWWKDQSUHYHQWLQJDEUHDFKLVFRSLQJZLWKWKH
DIWHUPDWK7DNHWKHH[DPSOHRI/DVW3DVV7KLVSDVVZRUGPDQDJHU
UHFRUGVORJLQVDQGWKHQSOD\VWKHPEDFNIRUIDVWHDV\ORJLQV,WDOVRFDQ
JHQHUDWHXQLTXHFRPSOH[SDVVZRUGVIRUHDFKRI\RXUDFFRXQWV,W¶VD
JUHDWVHUYLFH
,QWKHFRPSDQ\DQQRXQFHGLWKDGEHHQWKHYLFWLPRIDQDWWDFN
/DVW3DVVTXLFNO\QRWL¿HGXVHUVDQGSRVWHGLQIRUPDWLRQWRLWVSXEOLFEORJ
DERXWWKHDWWDFN7KHFRPSDQ\KDGDOVRSODQQHGIRUDZRUVWFDVH
VFHQDULR ,WKDGDOUHDG\HQFU\SWHGDOORILWVXVHUV¶LQIRUPDWLRQDQGWKH
LQIRUPDWLRQWKDWZDVVWROHQZRXOGKDYHEHHQGL̇FXOWLIQRWLPSRVVLEOH
WRXVHDVDUHVXOW/DVW3DVVVWLOOUHFRPPHQGHGWKDWXVHUVFKDQJHWKHLU
PDVWHUSDVVZRUGVMXVWWREHVXUH
7KLVZDVDQH[DPSOHRIDFRPSDQ\KDQGOLQJDEUHDFKZHOO,WZDV
WUDQVSDUHQWDERXWWKHDWWDFNDQGSURYLGHGFOHDUDGYLFHIRUD̆HFWHG
LQGLYLGXDOV0RVWLPSRUWDQW/DVW3DVVWRRNSURDFWLYHVWHSVWRVHFXUHWKH
LQIRUPDWLRQLWKROGV'DWDZDVHQFU\SWHGSDVVZRUGVKDVKHGDQGVDOWHG
:KHQDWWDFNHUVVWROHGDWDWKHFRPSDQ\ZDVFRQ¿GHQWWKDWQRQHRILW
FRXOGEHXVHGWRPRXQWIXUWKHUDWWDFNV
,QJHQHUDO1RUG931DQG7RU*XDUGERWKKDYHJRRGUHVSRQVHVEXWWKH\
GROHDYHDIHZWKLQJVWREHGHVLUHG)RURQHWKLQJDUHSUHVHQWDWLYHRI
7RU*XDUGWHOOVPHWKDWWKHFRPSDQ\GLVFORVHGWKHEUHDFKEDFNLQ0D\
7RU*XDUGVD\VWKDWLWGHWHUPLQHGWKHDWWDFNSRVHGQRWKUHDWEXWLW
M
a
x
E
d
d
y
