understanding: the key to protecting highly sensitive personally identifiable information timothy j....
TRANSCRIPT
Understanding: The Key to Protecting Highly Sensitive Personally Identifiable Information
Timothy J. Brueggemann, Ph.D.
Introduction
The reliance of organizations on the collection and storing of data
HSPII is defined as information which can be used to discern or to trace an individual’s identity either alone or when combined with other information which is held in the public domain
Access to information and data is easier than ever to obtain, use, and share
Introduction – cont.
Lost or stolen laptops
Challenges that face an organization today
Increase organizational efficiency
the protection of the HSPII
New perspectives in organizational security have grown from the increased amount of government legislation and increased public awareness.
Data security is an area that is one of the most studied, and often the area that is the most confused with a HSPII program.
Privacy
As a legal right privacy was defined by Samuel D. Warren and Louis D. Brandeis in 1890 as “the right to be let alone”
Not currently enacted into law
In the 1960s and 1970s congress became increasingly concerned about the amount of data being stored on databases
Legislation
The Privacy Act of 1974
Health Insurance Portability and Accountability Act (HIPAA)
Family Education Rights Act (FERPA)
Electronic Communications Privacy Act (ECPA), 18 U.S.C. 2510-2521
Problem Areas
Increases in online technology
Attacks on privacy occur in many areas
Employment Records
The Internet
Government Databases
Corporate Databases
The Study
Define the level of understanding the IT worker had on HSPII at their organization
Four areas reviewed
Knowledge of HSPII Program
Ascription to Technology
Ascription to Technology – Belief
Senior Management Involvement
The Study – cont.
The population for this study was comprised of all IT workers employed by Fortune 500 companies within and outside of the United States.
A convenience sample was taken from one large Fortune 500 company.
Approximately 8,000 IT employees
A random sample of 10% of the IT staff was selected
A minimum response rate of 260, 32.5%, was necessary to represent the 800 employees selected to participate
Actual response rate was 332 or 41.5%
The Study – cont.
Six hypotheses were formed for this study.
H1: The time in the Information Technology field has a relationship to the Information Technology workers’ understanding of Personally Identifiable Information Programs.
H2: The education level of Information Technology employees has a relationship to their understanding of Personally Identifiable Information Programs.
H3: The length of time with the company of Information Technology employees has a relationship to their understanding of Personally Identifiable Information Programs.
H4: There is a difference in the understanding of Personally Identifiable Information Programs between those who have employees that report to them and those who do not have employees report to them.
H5: The role of Information Technology employees has a relationship to their understanding of Personally Identifiable Information Programs.
H6: The age of Information Technology employees has a relationship to their understanding of Personally Identifiable Information Programs.
Summary
1. Explored the understanding level of HSPII programs by the IT professional
2. Additional insights gained from this study
3. The age group of the IT professional
Concluding Remarks
The possibility of data loss continuously threatens the security and the availability of IT systems and IT resources. The HSPII program must be a reiterative process and must be ongoing for it to be of value. IT systems and applications need to continually be examined and evaluated to determine any new risks that may arise around HSPII data security. One of the, if not the primary, risk to any HSPII program is a lack of understanding of the individuals most involved in protecting the data; the IT professional.