Would you pass a data leak audit?
How would you measure up if a consultant came in to test your company for "data leaks?" Are you sure you would pass with flying colors? Would you be embarrassed?
Security consultancy Networks Unlimited gave a reporter permission to follow along as it conducted a data leak audit at a Boston drug firm (as long the company wasn't identified). The results were eye-opening. The director of IT at the firm was initially confident; he figured a few weak spots would be uncovered but nothing major. He was shocked when the 15-day audit turned up 11,000 potential leaks and revealed some huge deficiencies.
"During the audit, more than 700 leaks of critical information, such as Social Security numbers, pricing, financial information and other sensitive data in violation of the Payment Card Industry's standards. He also found serious lapses--more than 4,000--that ran counter to HIPAA and Defense Department Information Assurance Certification rules," according to the reporter's subsequent article in ComputerWorld.
