Making data-breach research easier

The monstrous data breaches involving millions of records make all the headlines -- TJX, AOL, the VA. However, it's those whoppers combined with the rat-a-tat-tat of seemingly daily divulgences involving lesser-known entities and fewer victims that add up to a costly and so-far-uncontrolled societal headache.

Logging these incidents and assembling reliable research data about the problem has been a bailiwick of security Web site Attrition.org since July 2005 -- and has at times proven daunting, as the database now contains more than 1,000 incident reports covering some 330 million records. Into the breach, so to speak, steps the Open Security Foundation, which is announcing with Attrition.org that as of this morning OSF will formally maintain the DataLossDB -- also known as the Data Loss Database - Open Source.

Attrition.org staff member Kelly Todd, a DataLossDB project leader, tells me that a primary motivation behind the change is to increase public contributions to and involvement in the database.

"In the past, Attrition.org was approached by quite a few entities in the public and private sectors for input into their studies," says Todd. "The information itself will hopefully become more complete and accurate with community contributions, which should lend to more analysis about how and why data breaches occur, and, possibly (and hopefully) how they can be prevented in the future."

From the press release:

The Open Security Foundation's DataLossDB will be free for download and use in non-profit work and research. The new Web site launch (http://www.datalossdb.org/) builds off of the current data set and provides an extensive list of new features. DataLossDB has attained rapid success due to a core group of volunteers who have populated and maintained the database. However, the new system will provide an open framework that allows the community to get involved and enhance the project. "For a data set as dynamic as this, it made sense to build it into a more user-driven format," states David Shettler, the lead developer for the Open Security Foundation. "With the release of this new site, the project can now be fed by anyone, from data loss victims to researchers."

Of course, there will be quality controls.

"Anonymous submissions will be allowed, but we're hoping that people will sign up for an account so we can give credit to anyone who contributes to the data set," says Todd.  "All submissions will be moderated by a core team of volunteers for accuracy."

I asked Todd if the escalation of the DataLossDB project was an indication that data breaches in general are likely to remain a growth industry.

"As far as actual breaches go, no one can say for sure if they'll increase or decrease, but public reporting and awareness has definitely increased in the last few years," he says. "I'd hesitate to call it a 'growth industry.' We're definitely seeing a lot more public interest in the topic, though, so even if breaches do decrease or level off, I imagine it will continue to be a popular topic of discussion for the months and years to come."

Welcome regulars and passersby. Here are a few more recent Buzzblog items. And, if you'd like to receive Buzzblog via e-mail newsletter, here's where to sign up.

Doing the Laptop Drive of Shame.

Bank of America to support Firefox, finally.

What does Cisco have against Quebec? (Answer: silly contest rules.)

Attrition.org nails another nitwit ... this time with Monty Python's Holy Grail.

"I have a lost laptop horror story for you."

Kellogg's and LEGO team up to teach kids to choke.

The REAL sticking point between Microsoft and Yahoo!

This Year's 25 Geekiest 25th Anniversaries.

Top 10 Buzzblog posts for '07: Verizon's there, of course, along with Gates, Wikipedia and the guy who lost a girlfriend to Blackberry's blackout.