Experts says trashed hard drive fiasco at Pfizer could have been avoided with Encryption

Credant says trashed hard drive at Pfizer would not have happened if data had been encrypted

Credant Technologies says that a security gaffe resulting from an employee at health service company Pfizer throwing an apparently surplus hard drive into the trash would not have happened if the data were encrypted.

Michael Callahan, the military grade encryption specialist's senior vice president, said that the fact that the company has had to write to the people affected - whose names and social security numbers were apparently listed on the hard drive - and offer them credit and ID theft monitoring is both expensive and embarrassing for the company.

"If the health services company had adopted an encryption policy on its sensitive data - whether the data is in transit or at rest – then the accidental disposal of the drive by the New Hampshire staffer wouldn't have been the headline news for the company," he said.

"What makes the case interesting from a policy enforcement approach is that the employee threw the drive into the trash at his home, which means that office security protection systems wouldn't have stopped this from happening," he added.

According to Callahan, this is where an encryption policy on sensitive data can act as a safety net to prevent embarrassing situations like this from hitting the headlines.

The important take-out from this incident, he explained, is that it proves the need for a multi-layered set of IT security defences in a typical organisation.

Obviously, he said, office security policies would have spotted the unauthorised disposal of the hard drive in the company trash and the drive would have been intercepted by the site security staff.

At home, he added, the employee was effectively outside of the control of the office security systems and, as such, the contents of their hard drive was at much greater risk then normal.
And this, he noted, is where a company-wide encryption of sensitive data policy would have stepped in to prevent employee stupidity from costing the company money and avoiding red faces in the boardroom.

"It's worth noting that this isn't the first time that Pfizer has been hit by data breaches. During 2007 and 2008 the company hit the headlines several times. It is to be hoped that this latest data security incident triggers a review of the firm's encryption policies and procedures," he said.

For more on Pfizer's trashed disk drive problems: http://preview.tinyurl.com/pqvtaf

For more on Credant Technologies: http://www.credant.com

Source: Eskenzi PR
<>