June 2011 – Dearest Leader

A casual observation of investor confidence after an infosec breach.

One of the issues that security and privacy professionals discuss with our clients is the potential loss of customer confidence if confidential information is compromised. The responses this concern vary across industry and business size. The controls implemented would vary based on the information collected, the tolerance for risk, and the client’s ability implement cost effective controls. Since the downturn in the economy many companies have been scaling back expenditures on security controls and accepting more risk. This involves taking a more compliance centric view and making expenditures only on technology and personnel to comply with the law or self-regulating industry standards, rather than a risk centric view. When accepting more risk it is reasonable to assume that the probability of a security incident will increase and/or the impact/remediation will be more costly to clean up. Does this present any concern for the public?

Several technology executives have implied privacy is dead get over it. With the proliferation of social tools such as Facebook, Twitter, Foursquare, Gowalla, and Google Latitude, the general public has no problem with letting the their “friends” or the whole internet know where they are and what they are doing. Many people, especially the younger generations don’t see it as a big deal to broadcast that they aren’t home or their most intimate and politically incorrect thoughts. Granted GenY is focusing more buying experiences rather than material possessions, so the impact burglary may be less for GenY, but that is another topic we may discuss in detail under a personal finance tag in the future. The silent death of privacy across generations may also be foretelling the the death of security from the viewpoint of the public.

As company executives accept more security risk, the consumer public has also been accepting more risk or relying on risk transference to protect themselves. Combine apathy with risk transference and you have a big stiff cocktail of SNMP (Someone’s -Not Mine- Problem). ATM skimmers are all over the news, and among the GenX and younger crowd there is relatively little concern when compared to older individuals. That is derived from a very small sample so take it as you will. Why no concern? Most credit cards have zero liability for the consumer and fraudulent charges can be corrected immediately along with a new credit card sent overnight. To the consumer this is a minor irritation and the only people suffering are those dirty Wall Street bankers everyone loves to hate. Even debit card fraud is only slightly more irritating when dealing with small community banks and credit unions who are likely to have the consumer protections as credit cards.

Is the public suffering from apathy when companies experience a security breach? Is security dead and the inconvenience of having information compromised something that we will just have to put up with going forward? If we are not there yet we may be getting there soon. When examining investor confidence of companies that have security incidents there appears to be very little concern, even for large security breaches. When compared to the overall S&P 500 Index several of these companies rise and fall along with the Index. This would indicate that any declines in share price are related to the Index itself falling.

In recent days EMC and SPX are up and down together.

Lockheed Martin experienced a large percent move relative to SPX, but the ups and downs do have some correlation.

L-3 Communications has moved with SPX very closely since news of the intrusion broke.

Sony has underperformed when compared to SPX and their stock price has been affected the by multiple intrusions and related news stories.

EMC declined in mid March after the breach. The decline of about 10% was relatively small compared to what it could have been. Three months later EMC is performing as if the breach and any long term issues are a distant memory. EMC is currently trading in a range between 27 and 28.75.

Near the end of May Lockheed Martin announced that they had been the victims of a security breach. Nothing unusual happened to the stock price and the declines can be correlated to losses in the general market.

L-3 Communications has also been pulling back, but seeing a shooting star candle and confirmation the next day that could be expected. We can assume that any loss in value is simply related to overall market corrections.

Sony may be the exception since they have lost a lot of value since March. Sony is different than Lockheed or L-3. They have been punished multiple times by various hacking groups and the news stories simply won’t go away. The decline is about 30%.

Compare and contrast the charts above with this chart of BP after the Deepwater Horizon explosion.The stock declined almost 50% before beginning to recover and reached –30% after a week.

There are differences between all of the companies which does not allow an apples-to-apples comparison. Customers of Lockheed Martin can’t obtain a substitute from someone else as easily as Sony customers. BP is in the business of tangible goods and an oil spill has different impact in the minds of investors and the public than a data breach.

Conclusion:

Based on non-scientific, casual observations, a one-time news event has little effect on the stock price when compared to multiple news stories over a period of time. This is important to the overall business ecosystem from several viewpoints

Short sellers in the market may be able to take advantage of short term moves in price, but if the story fades from the news it would be best to cover and wait for more news.
Hacktivists wanting to teach a long term lesson to a company will need to hit them multiple times or release breadcrumbs of information over a period of time to keep the story in the news so it can wear on investor sentiment.
Consumers will need to accept that the impact to a company will be relatively minor if they mishandle private data one time. Wall Street will not severely punish the companies for poor data handling practices.
Security and Privacy professionals will need to give up on selling the idea that a one-time security breach will harm their client’s business. Based on these stock charts there is little incentive to spend money on prevention.
Consumers are at the mercy of the companies they deal with and simply put up with the inconvenience. There is little evidence of a crippling or destroying exodus of customers or a change in consumer behavior.

Disclosure: We currently have no long or short positions mentioned in this post. We may have held positions in the past.

The Seattle Times has an interesting story about the King County Library System removing their security cameras. This is an excellent case study to illustrate that more security equipment does not always lead to better security. The case stems from an incident where a patron was mugged in the parking lot. The Des Moines Police asked to see the security footage from the cameras, but the library refused, presumably citing the need to protect their customers’ privacy. The police obtained a court order to review the footage and eventually caught the suspect. The police were not happy with the library’s cooperation.

The decision to remove the security cameras "hinders our ability to do police work," Collins (Des Moines PD Spokesperson) said.

The library made the decision to remove the security cameras to prevent similar incidents in the future. Does removing the security cameras actually present a problem from a security professionals point of view? We can perform an assessment of the situation to determine if the library is making a prudent decision. Top management at the library has decided that the confidentiality of the library patrons outweighs any benefit that the security cameras provide. Under a security management framework such as ISO 27001, top management determines the goals for an organization’s security program. In this case library management is correct in making the decision to remove the security cameras since the security framework leaves all decisions to top management.

Under the ISO 27001 framework risk assessments must be conducted on a periodic basis. To visually express top management’s decision we can use CIA in a risk matrix to illustrate their concerns. The following examples are illustrative only.

Risk	Confidentiality	Integrity	Availability
Customer Reading Choice Compromise	High	Low	Low
Vandals	Low	Low	Low
Muggers	Low	Low	Low

In this case management has decided that the risk all of a patron’s reading choices being recorded by surveillance cameras is of greater concern than other things that may be seen by the cameras. Based on the risks it would be logical to remove the cameras. What about hindering the police in their line of work? That should not be a concern of a security professional consulting on behalf of or employed by the library. There are numerous reasons why this is true. Management at the library has decided there are certain things that the police should not have access to. This is no different than protecting the physical premises of a business or using logical access controls to prohibit viewing of specific files. Who the outside threat is should not be a concern to the security professional under the ISO 27001 framework.

There also financial reasons that weigh into the decision to remove the cameras. In most businesses a compliance professional or paralegal will be fielding court orders for data. A fulltime resource would cost a minimum of $30,000 a year. Does spending that $30,000 a year bring $30,000 worth of value to the customer? It does not bring benefit to the customer, but it does benefit the police. Since the police are not part of the same organization it makes very little sense to help them from a security professional or management accountant’s point of view. If the video footage is that important to the police they should provide the equipment and manpower to monitor it or the library should invoice the police for their costs of maintaining the equipment.

If we take off our security hats for a moment and put on our management accounting hats we can see that helping law enforcement does not provide economic benefit to the organization. Therefore in order to save $30,000 by not hiring a fulltime resource we would need to remove the reason for hiring a resource. We now have a business reason to remove the cameras.

Critics may argue that the cameras are already paid for and removing them wastes taxpayer money. Once again we will need to do a financial analysis to determine whether or not the cameras should stay. Most camera systems today are linked into a DVR which is usually supported by an organization’s IT department. For purposes of this illustration we will assume that the camera systems are basically computers. Computers have a five year depreciation before they are scrapped and removed from an organization’s financial books. How many companies keep computers more than five years? From a practical and a financial standpoint we can assume that the camera system would be replaced every five years much like a computer would.

The library system has also stated that the cost of maintaining the camera system is $30,000 per year. Presumably this is the cost of a maintenance contract. By removing the cameras the library immediately starts saving $30,000 a year. One way to express loss of value is to take the current depreciation value of the cameras, subtract the value the library receives from selling the equipment, and subtract the $30,000 a year in maintenance savings. If the cameras are very old and have a little financial value that it is possible that we will have a negative number, which means that the removal of the cameras provide immediate payoff. Without knowing the details of the original purchase it is reasonable to assume that if the cameras are one or two years old we would obtain immediate ROI by removing the cameras, selling them, then begin booking the savings from canceling the maintenance contract. If factoring in the cost of a compliance professional or paralegal is done, it is possible the camera system could be scrapped in its first year of operation based on the savings that would occur in years two and beyond. There is also the capital budget savings from not purchasing a new camera system every five years.

Security and privacy professionals should not assume that more is always better. Introducing additional equipment and processes can compromise the security and privacy of a client’s customers. Top management at the organization determines what risks face that organization. While it may be unconventional to assume that law enforcement is a security risk, there is certainly nothing wrong with that approach if the organization chooses to classify them as a risk. Security and privacy professionals must also wear many different hats. By taking unconventional approaches to security and privacy, and by involving other disciplines such as accounting and finance, security and privacy professionals can better serve their clients by protecting what their clients determine to be valuable.

Month: June 2011

Security and Privacy are Dead and Nobody Cares

Improve Security & Privacy, and Protect Your Patrons by Reducing Security