“How do you weigh up IT Security costs in your organisation?“
Sometimes, it's not just a number on an invoice. If your company suffered from a malious attack from a fraudster who stole important data or brought down critical business systems what would be the full cost to the business?
To start with there's the expenses of legal fees, call centers and lost employee productivity. There is also regulatory fines, a fall in share prices and customer losses to consider.
The fact is that the loss of sensitive data can have a dehabilitating effect on an organization's bottom line- especially if it is ill-prepared. A Forrester report published last year estimated the cost to be between $90 to $305 per record lost which does not include additonal marketing activities and discounts offered to rebuild customer loyalty. There are weekly media reports of these e-crimes. A Best Western Hotel was a recent case. Whilst the security breach has been closed, the after shock from this data loss goes beyond those whose personal data could have been compromised. Only 10 people affected?
How confident would you be at booking your next stay with them? So whilst departmental heads are looking to trim pounds off their budgets due to the economic climate, reducing your IT security budget to zero may cost more than you think.
1 comments:
My name is Marcus Gamo, and I'm a public relations represenative and work closely with Best Western International.
The following statement is intended to provide further detail on the largely erroneous story originated by The Sunday Herald newspaper in Scotland, concerning the breach of Best Western’s Central Reservations System.
We can confirm that on August 21, 2008, three separate attempts were made via a single log-on ID to access the same data from a single hotel. The hotel in question is the 107-room Best Western Hotel am Schloss Kopenick in Berlin, Germany, where a Trojan horse virus was detected by the hotel’s anti-virus software. The compromised log-in ID permitted access to reservations data for that property only. The log-in ID was immediately terminated, and the computer in question has been removed from use.
We can also confirm that we have been able to narrow down the number of customers affected by this breach to ten. We have contacted those customers and offered assistance as needed.
Points of note:
The compromised user ID permitted access only to the reservations at a single hotel, and there is no evidence of unauthorized access to data for any other Best Western hotel.
Best Western purges reservations data within seven days of guest departure, thereby limiting potential data exposure to (1) guests who departed up to one week prior to the exposure; (2) current guests; and (3) future guests of that particular hotel.
There is no evidence of any unauthorized access to any other customer data.
In the day-to-day conduct of our business, we comply with the Payment Card Industry (PCI) Data Security Standards (DSS). To maintain that compliance, Best Western maintains a secure network protected by firewalls and governed by a strong information security policy. We regularly test our systems and processes in an effort to protect customer information, and employ the services of industry-leading third-party firms to evaluate our safeguards. We also delete credit card information and all other personal information upon guest departure.
Given the nature of IT security, absent evidence of actual attempts to enter our system without authorization, Best Western’s highest level of response must consist of the following: (1) to continue to monitor for such activity; (2) to assist law enforcement authorities and our credit card partners with their investigation; (3) to amplify our already stringent data security regime, which is of course compliant with PCI standards; (4) to reinforce best data protection practices at our 4000 worldwide hotels. We are actively engaged in all four of these areas, on behalf of our valued customers and member hotels.
Customers with concerns are encouraged to call Best Western Customer Care at US 800-528-1238.
Post a Comment