- Microsoft will float cloud OS this month
- Top 16 Chinese iPhoneys
- Pimp your ride: Cool car technology
- Laptop stolen from McCain campaign
- Cisco, Microsoft roll out server, networking appliance
Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:Application Performance Solutions | App Performance | Networking Solution | SafeGuard Enterprise Solution Center | SOA | Value of WDS
The week he was promoted from acting to permanent CIO at the University of Connecticut, Michael Kerntke had his mettle tested by the June 20 discovery of a rootkit on a system housing the names and Social Security numbers of 72,000 employees, students and alumni.
An investigation found that the rootkit, an attacker tool for compromising computer systems without detection, hadn't been touched since it was installed in October 2003. That made it highly unlikely personal records were ever copied off the server. Still, Kerntke persuaded senior administration to err on the side of caution and go public with the breach.
The frenzy had finally died down that Friday, but at 7 p.m. as he neared his driveway in his Chevy Tahoe, he got another call from his public relations manager. A channel 3 news crew was waiting for him back at the data center and needed him to show them around.
"I never thought when I took this job that I'd be on TV," says Kerntke, who not only kept his job despite the breach, but also earned accolades from school administrators for his ability to communicate the extent of the damage to a non-technical news audience and to be available for interviews at odd hours.
Facing the limelight is part of the way IT executives' jobs are getting more challenging as a result of new rules to report private data breaches. There's also the other work involved - the investigations, repairs and notifications arising from data breaches that expose personal information. In all, 80 such breaches went public between Feb. 15 and Sept. 29, according to the Privacy Rights Clearinghouse.
While IT executives don't seem to be losing their jobs over the rising number of publicly reported breaches, their companies are experiencing severe losses, starting with an exodus of customers and customer loyalty. According to a September survey of 10,000 adults conducted by the Ponemon Institute, a privacy research organization, 19% of respondents ended their relationships with companies reporting breaches, and 58% say they have lost trust.
Publicly held companies also suffer a 5% stock drop in the wake of such a disclosure, according to the 2003 study "The Economic Cost of Publicly Announced Information Security Breaches" published in the Journal of Computer Security. And the cost of informing affected parties also is expensive, ranging anywhere from $15 to $35 per victim, according to Jonathan Penn, principal analyst for identity and security at Forrester Research.
|

The Vista era of Windows is here. Yet most organizations will retain Windows XP alongside new Vista...
Vulnerability Management For DummiesDownload this concise book "Vulnerability Management for Dummies," to learn about the simple steps...
Security Considerations When Deploying Remote Access SolutionsEffective network security is most successful when you use a layered approach, with multiple...

The Vista era of Windows is here. Yet most organizations will retain Windows XP alongside new Vista...
Turning information into a Competitive AdvantageCompanies today are realizing that competitive advantage is harder to sustain when based solely on...
PoE Plus: Impact on the PoE MarketThe standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Discover why Unified Threat Management Firewalls are ready for the enterprise today. High...
The Evolution of Network SecurityWe have so many holes punched in our firewalls today that many industry insiders question the value...
The self-managed networkWe aren't there yet, but advances in network and systems management tools are making it possible to...
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.
Download the white paper.
Applications: taking back control
Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.
Learn more today.
Comment