ANTenna Blog -- How-To

What's on your server? Whatever it is, in this day and age, if your data concerns the public, it better be encrypted on your server.

A recent report noted that nearly a third of consumers terminate their relationship with an organization that has suffered a data breach involving their personal information. So, if you find that someone has raided your customer data files, you might be tempted to keep mum about it-but you can't. By one count, 39 states plus the District of Columbia have data breach notification laws, requiring that if you have a data breach, the people whose personal data was exposed must be notified. If this is not done "without unreasonable delay," you could face civil or criminal penalties.

There is no comparable federal law, but you might as well pretend there was. Because all the major states have such laws, exempting residents of the other 11 is not practical. But conforming to these laws is not only humiliating, it's expensive -- the average data breach cost $197 per exposed file, according to one study. Sending out the notification letters only cost $15 each, with the bulk of the cost stemming from lost business.

But most of the state laws in question include a "get out of jail free card," specifically exempting encrypted data, so that losing it doesn't count. For the other states, the exemption is presumably implied, as a thief could not extract information from the data.

Basically, the genie is out of the bottle. Data that escapes into the wild can live there indefinitely, thanks to the Web, where scam artists swap stolen identities as if they were baseball cards (and for comparable prices). One list shows that 227 million personal records have been lost in the U.S. since the start of 2005.

Obviously, encrypting sensitive data on your server is your best move. Your server may be locked up tight, in both the physical and network sense, but tomorrow someone could copy a sensitive file to his laptop, and the day after tomorrow that laptop could be stolen out of his car. And then you'll learn more than you ever wanted to know about data breach notification laws.

Go to the bMighty Server How-To Center