Comments from Pat Clawson, CEO at Blancco Technology Group on potential causes of the breach and the measures that could have been taken to prevent it.
Pat Clawson, CEO at Blancco Technology Group :
- How could this have been prevented? Is there any valid reason for this database not to have been securely erased when JD Wetherspoon moved to a new provider?
One thing that’s interesting about this data breach is that the leaked information was housed on a database related to an old version of JD Wetherspoon’s website that’s since been replaced. When a company decides to replace old websites and launch ones, it’s not a decision that’s made quickly and months of planning go into it. So when that decision was made, JD Wetherspoon should have also created a plan to remove all data completely and permanently from the old database. This would have required identifying a technology solution that could do this, as well as establishing clear processes, documentation and training/communications to all internal departments.
- Who do you think is most responsible for this breach? Is it the third party who failed to protect/destroy this sensitive data or JD Wetherspoon for failing to ensure their supplier took the appropriate actions?
Whenever something goes wrong, people often get lost on focusing on the wrong things – pointing fingers, placing blame and evading responsibility. It’s not about saying one party is 100% to blame. When JD Wetherspoon chose to sign a contract with an third-party vendor to host its (old) website, it immediately took on the responsibility for managing that relationship and doing due diligence on the vendor’s systems and processes being used to house its website. To blame the vendor for the delay in discovering the breach is just irresponsible and it points to a major weakness in how JD Wetherspoon’s internal IT and technology teams managed the relationship with the vendor.
There’s no justifiable reason for JD Wetherspoon to not have taken these precautionary data security measures. But it’s also a very common and frequent oversight made by many companies. Even though things like ‘breach notification’ are being pushed heavily with new legislation like the General Data Protection Regulation that’s close to being finalized in Europe, the true definition of secure data removal – or data erasure – just isn’t known enough or discussed enough. And a lot of the times, companies mistakenly presume ‘deleting’ data is the same thing as ‘erasing’ data. But it’s not and that’s where you see companies like JD Wetherspoon and Ashley Madison getting into serious trouble.
But that doesn’t mean the third-party vendor who accepted the contractual responsibility and fees to host JD Wetherspoon’s old website isn’t responsible either. The vendor should have been forthcoming and transparent in giving JD Wetherspoon’s IT teams access to view their internal data security processes, data removal methods, tools and technology implemented, documentation and most importantly, communication that the breach had occurred at the time that it did, not months later after the fact.
- Does this point to a wider issue within data lifecycle management and what happens to information that no longer needs to be stored?
The breach itself and the tone of JD Wetherspoon’s response point to a wider issue. All too often, companies think about data security in terms of physical assets and devices. Instead, organizations need to plan for the entire data lifecycle – from creation to storage to finally, secure and permanent removal. Here’s why.
There are a lot of different deletion methodologies that exist. The approach you choose depends on your risk tolerance, security posture, your policies and the specific types of data being stored. And one of the biggest lessons from last year’s data breach at Sony is that there’s really no such thing as ‘unimportant’ data. Although most data protection laws and regulations are focused on protecting customer and employee data (and possibly financial data if you’re a public organization), and most organizations are extremely sensitive and vigilant about protecting their intellectual property (from product designs and manufacturing processes to customer lists and go-to-market strategies), few think about the skads of supposedly mundane data contained in everyday emails or employee spreadsheets. But even seemingly unimportant data could cause serious damage to the customers in question and to the companies who failed to stop the breach from occurring.
[su_box title=”About Blancco Technology Group” style=”noise” box_color=”#336588″]
Blancco Technology Group help clients’ customers test, diagnose, repair and repurpose IT devices with the most proven and certified software. Our clientele consists of equipment manufacturers, mobile network operators, retailers, financial institutions, healthcare providers and government organizations worldwide. The company is headquartered in Alpharetta, GA, United States, with a distributed workforce and customer base across the globe. Blancco, a division of Blancco Technology Group, is the global de facto standard in certified data erasure. We provide thousands of organizations with an absolute line of defense against costly security breaches, as well as verification of regulatory compliance through a 100% tamper-proof audit trail. Xcaliber Technologies, a division of Blancco Technology Group, is a global innovator in mobile device diagnostics. SmartChk is a multi-channel solution that enables consistent, accurate and measurable diagnostics of Smartphones and Tablets in all stages of Customer Care and the Reverse Supply Chain.[/su_box]
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.