Commentary by Gregg Larson
RISMEDIA, March 25, 2008-Last month, a Clareity staffer was one of tens of thousands of people that received a notification informing them of a security breach at their long-distance phone company. What had been illicitly accessed? Just the e-mail address, username and password from their online account.
While no “traditionally” sensitive information-such as bank account or credit card information-could be accessed with that log-in, the company still had to go through an expensive breach notification process. Why? Because it was possible that the username or e-mail address, in combination with the users’ passwords, could have been used to access other secure sites online.
There’s a tangled web of state and provincial laws that describe how businesses must protect data, and how they must notify people if their information is stolen. Every state now has such laws, at least to some extent. All existing laws require notification to those affected by a security breach.
But what does this mean for real estate?
According to a 2006 study, the total cost of a breach averaged $182 per lost customer record. Dealing with an information security breach cost one broker more than $1.7 million last year.
Between its information security assessments, ongoing monitoring services and payment card industry (PCI) compliance services, Clareity has been working hard to help businesses take reasonable steps to avoid an information security breach. However, our industry still has a long way to go; it’s up to each of us to take those first steps.
Gregg Larson is the CEO of Clareity Security.
For more information, visit www.ClareitySecurity.com.
