Lessons learned from corporate security breaches

Jay Cline, over at Computer World, is writing about "lessons learned" from the recent string of privacy/security breaches. He concludes with a bit of a "to do" list:

Lessons learned from corporate security breaches - Computerworld

"So what projects need to be at the top of your organization's agenda for the next 12 months?

• Adopt a comprehensive information security program based on the ISO 17799 and Payment Card Industry standards.
• Require any sensitive information stored on laptops to be encrypted.
• Formalize a process where employees can contact a central phone number or e-mail to report suspicious activity with company information.
• Validate the security of suppliers that handle your sensitive information, including backup tapes and documents.
• Train employees on your security policies and procedures and performing periodic spot checks to measure compliance.

Completing these types of projects is no guarantee of avoiding a publicized security breach. But they'll go a long way in properly allocating your limited budgets toward the areas of greatest risk."

All that makes sense, but I'd add a few elements to the mix:

1. Review all your information holdings to make sure that you only have information that you should, that the information has been collected with the consent of the individuals and that you are not retaining any information longer than is reasonably necessary for the purposes for which it was collected. (If you don't need it, don't keep it around. What you don't have can't be stolen or misused.)
2. Adopt a privacy/security policy that strictly delineates what information can be collected, how it will be used and for how long it will be retained.
3. Train all your employees to be sensitive to security and privacy issues.
4. Encrypt all information on any computer, not just laptops. (Servers and desktop computers are easily stolen.)
5. To the extent that's possible, keep all sensitive information on a central server that is well secured.
6. Collect audit trail information for all access to sensitive information, so you know who had access to it and when. Review the audit records for anything suspicious.

This isn't comprehensive, but it's a start ...