I’d argue that it’s always rational to treat a lost tape as if it were a meaningful breach of security. It only appears irrational when viewed in hindsight, when you know the real status of the tape the whole time.

Martin

It is often irrational to treat the mere loss of a tape as a legally-meaninful breach of security. –Ben

I’m in no position to confirm or dispute your percentages, but my own experience in the SF Bay Area don’t back up yours. I haven’t been in an Iron Mountain facility, but the people who’ve dropped off and picked up my tapes through the years have been of just about every ethnicity. They’ve all spoken English at least as well as most of my coworkers. And I seriously doubt it had any impact on their trustworthiness as employees. You’ve already stated it had no affect on their ability to do the work.

I worry every bit as much about the administrator at the corporate level making an extra tape and taking it home as I do about someone at the offsite storage company stealing a tape. Either one’s possible, and the risk of either happening is probably more dependent on the person’s credit rating than their racial background.

Any data backing up your assertions will be appreciated.

Martin

Me too. Companies have traditionally offered something like 1 year of credit monitoring service. I don’ t think that is nearly long enough. The monitoring needs to be for the lifetime of the stolen data. For example, if a SSN is stolen, then the monitoring needs to be for the lifetime of the SSN (could be a long time if a SSN can’t be expired). If it is personal data (i.e. mother’s maiden name, etc.) it would have to be for the remaining lifetime of the person.

Companies have taken custody of this personal data. As such, they need to be held responsible for it. They need to guarantee its safety over its lifetime or they shouldn’t have it.

What happens when the bad guys sit on the data for a year or two, and then act on it? This is especially troublesome for stolen SSN. CC#s expire and can be changed in the face of a known compromise. However, I expect I will have my same SSN (and most other personally identifying data that might have been stolen along with the SSN) for many years to come.

The real problems will arise when this warehoused stolen data is acted on after an extended period of time (i.e. 2-3+ years) after a breach like this. At that time, I expect it will be extremely difficult to correlate that compromise to today’s breach event to find the responsible party.

And these offsite storage companies still don’t offer insurance options for that kind of incident. Iron Mountain usually pays only the cost of the tape when it is lost.

Wouldn’t it (insurance) be a business diferential good enough to make companies change their offsite storage providers?

Regards,

Augusto