Tricia Griffith, CEO of Progressive, the large insurance provider, said: “With the right people, culture, and values, you can accomplish great things.” [1]

Several excellent analogies can be used to describe the global challenge we face in cyberspace. We can describe it as modern piracy, given the history of piracy impacting so many people while it was rampant, its criminal nature, and its use in proxy wars between the great naval powers of the 17^th and 18^th centuries. It could be thought of as similar to infectious disease, given how often software viruses are proximate to fraud and sabotage and how wide-spread and destructive these viruses are and how they spread through contact. It can be considered akin to unbridled marketplace competition as perhaps the emerging industrialists envisioned their battlefield in the 18^th and 19^th centuries. And, of course, it can be thought of more directly as outright war, where skirmishes and battles are fought by and for nation states with catastrophic collateral damage being inflicted on citizens the world over.

In each case, the common first step in fighting back is to change the culture. Whether it’s to band governments together to defeat a common enemy, create a public/private cooperative, or develop a sense of civic duty through education and public discourse, causing a culture change is often the first step in turning the tide.

With that as the backdrop, let’s think about how we’re doing in this culture change we know we need. ISACA^® and the CMMI Institute tapped the power of their combined community to look at how we’re doing at developing and adopting a cybersecurity culture. The 2018 ISACA/CMMI Culture of Cybersecurity Research looks at more than 30 data points, and with almost 5,000 respondents over small, medium and large organizations, this survey is extremely valuable at helping us assess where we are.

To make the shift we need requires three distinct steps or phases. First, we need to create awareness of the problem in a way that makes it real to the entire workforce. It needs to be personal. People need to understand why it matters, not just to their organization, but to them. Next, teach people basic self-defense. They need to know what they should do to protect themselves.  Then finally, we need to develop within the workforce a sense of unity of purpose and make real to them the shared outcomes we want to achieve.

From the research, we see that 87% of respondents believe that establishing a stronger cybersecurity culture will improve profitability or viability. We also learn that almost 8 in 10 believe those without such a culture experience more breaches and more than 7 in 10 think they would be more susceptible to phishing. I think this is great; it means we are motivated to make the changes we need to the cyberculture we have, and we believe it is essential to the organization, not the regulators, that we do so.

Coming back to our three steps, we also see from the research that fully 96% of respondents already have or expect to have employee training in place by the end of next year. We can assume then if you are reading this you likely have a program in place. Most importantly, the topic most often addressed is cyber risk awareness, cited by 8 in 10 respondents. Your task now is to make sure this awareness program establishes the connection for the workforce of how cyber hygiene impacts them personally. You’re not alone. Barely 3 in 10 believe their workforce understands their role in cybersecurity completely or very well.

Conversely, around 5 in 10 believe they somewhat understand their role and almost 2 in 10 (19%) fall into the not at all and minimal categories. I think we need to move a good many people from “somewhat” to “very well” to create the momentum we need toward a sense of unity around the outcomes we want. 3 in 10 can’t well create a draft for their teammates, but perhaps 6 or 7 in 10 can. We agree this is important, 41% of respondents agree that the lack of employee buy-in or understanding is the most critical inhibitor for achieving the desired cybersecurity culture.

Of course, measuring our progress is essential. First, make the tweaks to your program to make it personal to all workers. Then, add regular assessments to gauge how the workforce is responding. Less than 3 in 10 organizations do that now. Moving the bar on this metric will significantly improve the effectiveness of your cybersecurity awareness program. Engage with the workforce, measure phishing click-throughs, reward successful outcomes, and make sure you have consistent executive sponsorship. If executive management can motivate the workforce to improve product quality and increase sales, they can certainly accomplish the great things that Ms. Griffith believes a great culture can achieve by driving a change in the cybersecurity culture.

1. Tricia Griffith Quotes. BrainyQuote.com, Xplore Inc, 2018. https://www.brainyquote.com/quotes/tricia_griffith_852303, accessed September 27, 2018.

This article was originally published in ISACA in October, 2018

With the California Consumer Privacy Act (CCPA) going into effect on January 1, 2020, I think it’s timely to look at how digital natives may change the way we view data privacy altogether. If you were a toddler when Voyager 1 and 2 buzzed Saturn in 1980 and 1981 respectively, you are a digital native, as is anyone who came along after you. Maybe you started high school when email and file-sharing started going mainstream, and by the time you graduated, The New York Times had a homepage, at least one of your parents was likely online, and we, consumers at large, were beginning to experience FOMO (fear of missing out) if we weren’t online.

Ubiquitous tracking and big data pools as we know them today weren’t even a glimmer in a mad data scientist’s eye back then — and yet, people born before we learned who shot J.R. (or digital immigrants, as they came to be known) had already been making privacy mistakes for years.

Privacy Habits of the Past

Although the term was coined in the 1960s, identity theft has been with us for much longer. This author shares a name with a notorious horse thief, born Henry McCarty in the 19th century American Wild West. This scoundrel misappropriated the name William Bonney from an obituary in a New Jersey newspaper before he went west and famously fell into considerable mischief.

Two generations after his demise, the U.S. government began handing out identifiers for the new Social Security program. That’s where the trouble began in earnest. Many states put that number on their state-issued driver’s licenses — and this practice wasn’t banned until 2005. When Medicare came along in the 1960s, the Social Security number (SSN) was used as an identifier for each recipient. It was convenient, and it seemed like a good idea at the time, but the practice was officially ended in 2017.

Another habit we all got into long before digital natives started tagging themselves in hundreds of social media photos was putting our driver’s license numbers, addresses and phone numbers on the face of our checks. Credit cards weren’t widely accepted at grocery stores until the late 1990s, and who wanted to carry cash? None of us wanted to wait in long lines while the cashier wrote our phone and driver’s license numbers on our check to guard against fraud. It was easier and faster to have the info printed right on the check when we ordered them. The banks knew all about it. It was convenient, and yes, it seemed like a good idea at the time.

As we started using credit cards more broadly, we found ways of getting into even more privacy trouble. Rewards programs started sprouting like weeds. There were airline miles, discounts at the check stand and loyalty points for every possible purchase. Now, we coin new currencies faster than influencers gain followers. For 15 percent off, we allow our pharmacy, grocer, clothier and online retailer to track everything we buy, and we’d dutifully bark our phone number at clerks with people all around us to make sure we got credit for every purchase.

Digital natives certainly aren’t alone in posting photos, videos and online journals from their own social media accounts. While it might be easier for someone who grew up with the technology to post a fully captioned photo that tags five friends or colleagues, the consequences seem to vary more by the reach of the social profile in question than demographic factors. These consequences can range from varying degrees of embarrassment to ostracization and severe career impact. Sharing photos, videos and inner thoughts seemed like a good idea at the time — just like sharing SSNs, driver’s license numbers and phone numbers did before.

Data Privacy Expectations Are Rapidly Evolving

Our collective attitude toward data privacy is changing as we learn more about how maintaining data privacy is both desirable and difficult. We are now more attuned to the effects of sharing and the consequences of subtle privacy violations. In short, we’re in an era of rapidly evolving data privacy expectations. We’re increasingly turning to regulators to help us corral entities who would sell pieces of our information that we wouldn’t necessarily share on our own. Partly due to the experiences of digital natives, we are reconsidering the rules of data sovereignty.

As the consequences of data sharing become more evident (think public shaming versus identity theft) and long-lasting (searches often expose events going back decades), we are recognizing that our online images and thoughts can define us and should be owned by us, regardless of whether we fully understood the impact of sharing them. If a musical group can stop a political campaign from using its song or an actor can stop a merchant from using their image in an advertisement, it is my opinion that each of us should be able to determine how our images and musings may be used by collectors and whether to allow their collection at all.

The Berne Convention, which was adopted way back in 1886, established that publication alone is enough to establish a copyright. I’d assert that it’s not much of a stretch to extend that to what we publish about ourselves, whether that information is generated intentionally or as a byproduct of living in the digital age.

Should We Have Personal Sovereignty Over Our Data?

Regulators alone cannot solve this problem. It seems to me that what digital natives have asked us to do — sometimes explicitly, but often indirectly — is create the technical means to grant and revoke permission to collect, access, use and share the data we all produce.

Regulators could force each covered entity to create processes whereby current data subjects can request agency over their data privacy. New technologies could be created to encode each atomic unit of data and establish clear ownership. With options such as blockchain and smart contracts, I believe we could honor evolving data privacy expectations and enable data subjects to set or change the rules to which data brokers and users must adhere. If those parties fail to act in accordance with those rules, they could be prohibited from using that data.

Certainly, this concept has a more complex application when it comes to the digital exhaust we create (think location data and log data) as opposed to data elements that are more obviously descriptive, but this seems like more of an architectural challenge than one of scale to me. After all, we’ve managed to solve the scale problem for collection and use. As I see it, giving data subjects sovereignty over their data seems like a logical next step for our time — one that might just remain a good idea as we look back on this time years from now.

This article was originally published on Security Intelligence on Jan 8, 2020

“No, no!” said the Queen. “Sentence first – verdict afterwards.”

“Stuff and nonsense!” said Alice loudly. “The idea of having the sentence first!”
The value proposition for data is not in its protection (sentence), but in its use (verdict).
In this series of articles, we’re going to explore an alternate value proposition for data classification and the benefits of thinking of data classification primarily as an enabler for using data rather than protecting data.

In this first article, we’ll consider the fundamental reason that we want to classify data with this mindset.

In the second article, we’ll contemplate how to change the data classification schemes we use to fit our needs.

In the third and final article, we’ll examine the business processes that must change to accommodate our alternative value for data classification.

Now let’s come back and state our value proposition in a business-appropriate manner. The value of data is a function of the value derived by the business from its use of the data, minus the cost of generating, acquiring, handling, and holding the data, while also meeting any custodial requirements. The custodial requirements dictate the lengths we must go to protect it from unsanctioned access or use.

We generate a lot of data. It’s hard to know what to do with each data set. Why not just treat it all the same? If it’s just a matter of money, write a big check and give everyone − our customers, our shareholders, our employees, and our regulators − total assurance that we’re on it and that all the data is safe. Why not just assume the same custodial requirements for all our data and be done with it?
A safe is a useful analogy. One reason to buy a safe is to protect valuable papers and jewels. Sometimes a bank is hired to do this, and the bank puts its clients’ valuables in its safe. These safes are of different sizes, configurations and classifications. We don’t give a lot of thought about why because it’s intuitive. A bank has more valuable objects to protect and needs a bigger safe. A bank also has a higher aggregate total value in its safe, and therefore requires a safe that is more difficult to move and more resistant to cracking. Many banks configure these mega safes to be vaults, entire rooms dedicated to protecting valuables. Some banks layer safes within vaults.

We might choose to put all our papers in our in-home safe. Typically, we don’t do that. We might decide to hire a bank to store all of our documents, including old magazines with articles we might want to read again. We don’t typically do that either. We don’t usually have to ask ourselves what we want in the safe or in the vault. We know the intrinsic value of the papers we own, and we understand the harm that could be done if they are lost, damaged or stolen. We then act accordingly. We know that if we put all of our documents (data) in the safe, we’ll spend a lot of time spinning the dial to lock and unlock the safe, or traveling to and from the bank, rather than using the documents. But we also feel a pull toward putting our grandmother’s diamonds in the bank vault (or at least our own safe), because we don’t want to be the one responsible for losing Nana’s earrings, therefore incurring her wrath. We take our custodial responsibilities seriously.

We know it doesn’t make sense to store a newspaper in the safe, because the content is public knowledge. Assuming we don’t mind ink rubbing off on our fingers, we just want to read the newspaper. If we’re subscribing to the newspaper and have documents or valuables that we use a bank to keep safe, we likely can afford to safeguard more than we do. We don’t because we perform a little calculus for each valuable – how do I use this, and does it warrant special safekeeping?

The same value and cost mechanisms are at work for the data that our organization uses. A crucial piece of the cost equation is the custodial requirement. There are three ways to protect data: we can control access to it, we can obfuscate it, or we can destroy it. Each of these protections comes at a cost, so we need to make sure we ask all of the following questions (and others, below is just a representative list). Making assumptions about the underlying need for these controls costs time and money. However, the controls themselves create barriers, both large and small, to using the data to the organization’s maximum advantage:

• Do we have to back it up?
• Do we have to protect it during transmission?
• Do we have to encrypt it at rest?
• Do we have to control access?
• Do we have to monitor access and usage?
• Do we have to adhere to a policy for data retention and destruction?

Common data classification approaches are 3-tier, 4-tier and 5-tier schemes that provide increasing levels of granularity for non-public information. A typical 3-tier scheme might include public, internal use only, and sensitive. A 4-tier scheme might include public, internal use only, confidential, and secret. A 5-tier scheme might include public, internal use only, confidential, sensitive, and secret. Let’s assume each tier is numbered, starting with 1 for public and ending at 3, 4 or 5. The higher the number, the greater the need for data handling controls.

In many organizations, data classification is done much like the Queen of Hearts decreed. We perform a classification of the sensitivity of the data, which dictates data handling requirements for each data set based on the sensitivity of the data. This classification seems reasonable, but when doing so, we often decouple knowledge of the use of the data (how we derive its value) from the type or sensitivity of the data (prerequisite for designing the protection scheme). This happens because two different teams are involved and for them to coordinate their assessment requires that each have the other’s context. When the data classification effort is undertaken months or years after the business decision to acquire or generate the data, a disconnect is assured.

In many organizations, data classification is done much like the Queen of Hearts decreed. We perform a classification of the sensitivity of the data, which dictates data handling requirements for each data set based on the sensitivity of the data.

Every time we answer yes to one of the questions listed above, we spend money, which decreases the value of the data to the organization. More importantly, we also decrease the operational value of the data to the business because each of these data handling controls comes with an operational burden. Our teams have to spend time and effort to conform to our usage requirements. Don’t use it while it’s being backed up, encrypt it during transmission, encrypt it when storing it on disk, decrypt it when using it, rotate encryption keys, grant access, manage access, keep access logs, analyze the logs, and so forth. Data gains value from its use, not from being hidden and protected.

It follows, therefore, that when we fail to classify data accurately, we build inefficiencies into our data protection processes. We force ourselves to create the equivalent of multi-room bank vaults when all we might need is an in-home wall safe. Often, the inefficiencies built into our data protection schemes manifest as logic errors that allow inappropriate access to our data. This inappropriate access can lead to everything from corporate embarrassment to regulatory sanction to data theft, loss, and destruction. This defeats the purpose of the protections we’ve put in place.

Storage space is so inexpensive that we’ve all become data hoarders. But as the age of the data increases, the cost to store it remains steady or increases while the value of the data is likely decreasing. The value could be decreasing simply because the data is less current, and therefore any insights it provides is less useful. It could also be decreasing in value because the operational burden may be increasing. There is a burden to rekeying, backup schemes, and access controls and as standards evolve, older data must undergo more ETL (extract, transform, and load) activities to continue to include the older data sets with newer data sets for combined analysis.

What is needed is a data classification scheme that has a few additional attributes as well as a mindset shift that allows us to think differently about the data we keep, and which data sets need which protections. We’ll explore these new attributes and this new mindset in a follow-on article in the next issue.

This article was originally published in Cybersecurity Magazine in Summer 2018