1. ARMAGEDDON IS HERE: IDENTITY AND COMPUTER BREACHES

2. You Don’t Know What You Don’t Know
There’s No Such Thing as Worthless Data
The bad guys gather seemingly worthless bits of data to launch social engineering attacks or use a small piece of information to complete the attack puzzle
Compromises Happen All of the Time
Even to companies who take security seriously
Even to companies who do everything reasonable
It may not be YOUR data but it is YOUR responsibility to protect it

3. IT’S NOT JUST NORMA AND MIKE’S PROBLEM
RICK assumes the risk for the
loss of data
IT protects the data to the
identified risk level
Data protection, breach
prevention MUST be a joint
operation for success

4. Breach Scenario

5. There is a Cost for a Compromise

6. Who are the Victims? 37% of breaches affected financial organizations
24% of breaches occurred in retail and restaurants
20% of network intrusions involved manufacturing, transportation, and utilities
20% of network intrusions hit information and professional services firms
38% of breaches impacted larger organizations
27 countries affected

7. Who Perpetrated the Breaches?

8. What Can I Personally Do?
Only collect and use information that is absolutely necessary, and only share with those who absolutely need the information
“Review and reduce”—inventory your PII and PII data flows, and look for ways to reduce PII
Follow all Departmental policies and procedures
Think before you hit the “send” button ( is by far the #1 source of breaches)
“Scramble, don’t gamble”—encrypt, encrypt, encrypt
Minimize (or eliminate) the use of portable storage devices
Protect PII on paper—enforce a clean desk policy, use secure shredding bins, locked cabinets, etc.

9. Questions?