A statistical analysis of disclosed storage security breaches

ABSTRACT

Many storage security breaches have recently been reported in the mass media as the direct result of new breach disclosure state laws across the United States (unfortunately, not internationally). In this paper, we provide an empirical analysis of disclosed storage security breaches for the period of 2005-2006. By processing raw data from the best available sources, we seek to understand the what, who, how, where, and when questions about storage security breaches so that others can build upon this evidence when developing best practices for preventing and mitigating storage breaches. While some policy formulation has already started in reaction to media reports (many without empirical analysis), this work provides initial empirical analysis upon which future empirical analysis and future policy decisions can be based.

REFERENCES

• 1: A chronology of data breaches reported since the choicepoint incident (list). Privacy Rights Clearinghouse http://www.privacyrights.org/ar/ChronDataBreaches.htm.
• 2: Dataloss mailing list. Attrition.org http://attrition.org/security/dataloss.html.
• 3: Entities that suffered large personal data incidents (list). Attrition.org http://attrition.org/errata/dataloss.
• 4: Recommended practices on notice of security breach involving personal information. State of California Department of Consumer Affairs/Office of Privacy Protection, April 2006.
• 5: A. Acquisti, A. Friedman, and R. Telang. Is there a cost to privacy breaches? an event study. In Workshop on the Economics of Information Security (WEIS), 2006.
• 6: C. Conkey. Identity theft: Shielding yourself. July 14, 2006.
• 7: Ragib Hasan , Suvda Myagmar , Adam J. Lee , William Yurcik, Toward a threat model for storage systems, Proceedings of the 2005 ACM workshop on Storage security and survivability, November 11-11, 2005, Fairfax, VA, USA [doi>10.1145/1103780.1103795]
• 8: M. Hines. Data losses may spark lawsuits. In eWeek, June 12, 2006.
• 9: P. Mueller. How to survive data breach laws. Network Computing, June 8, 2006.
• 10: Bruce Schneier, Risks of third-party data, Communications of the ACM, v.48 n.5, May 2005 [doi>10.1145/1060710.1060744]
• 11: R. Tehan. Personal Data Security Breaches: Context and Incident Summaries. In Congressional Research Service Report for Congress, December 16, 2005.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.2 Storage Management

  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.4 Systems and Software

General Terms:
Economics, Legal Aspects, Security

Keywords:
breach disclosure laws, security breaches, storage security