IBM Optim
Data Privacy....Closing the Gap
Steve Johnston
Field Marketing Manager, Optim
IBM Software Group
2008 IBM Corporation
Optim
Agenda
The Latest on Data Privacy
Understanding Data Governance
The Easiest Way to Expose Private Data
Understanding the Insider Threat
Considerations for a Privacy Project
Success Stories
No part of this presentation may be reproduced or transmitted in any form by any means,
electronic or mechanical, including photocopying and recording, for any purpose without the
express written permission of IBM
2
2008 IBM Corporation
Optim
Disclaimers
IBM customers are responsible for ensuring their own compliance with legal
requirements. It is the customer's sole responsibility to obtain advice of competent
legal counsel as to the identification and interpretation of any relevant laws and
regulatory requirements that may affect the customer's business and any actions the
customer may need to take to comply with such laws.
IBM does not provide legal advice or represent or warrant that its services or
products will ensure that the customer is in compliance with any law.
The information contained in this documentation is provided for informational
purposes only. While efforts were made to verify the completeness and accuracy of
the information provided, it is provided as is without warranty of any kind, express or
implied. IBM shall not be responsible for any damages arising out of the use of, or
otherwise related to, this documentation or any other documentation. Nothing
contained in this documentation is intended to, nor shall have the effect of, creating
any warranties or representations from IBM (or its suppliers or licensors), or altering
the terms and conditions of the applicable license agreement governing the use of
IBM software.
2008 IBM Corporation
Optim
The Latest on Data Privacy
2007 statistics
$197
Cost to companies per
compromised record
$6.3 Million
Average cost per data breach
incident
40%
% of breaches where the
responsibility was with
Outsourcers, contractors,
consultants and business
partners
217 Million
TOTAL number of records
containing sensitive personal
information involved in security
breaches in the U.S. since 2005
* Sources: Ponemon Institute, Pirvacy
Rights Clearinghouse, 2007
4
2008 IBM Corporation
Optim
Did You Hear?
UK govt suffered a massive data
breach in Nov. 07
HMRC (Her Majesty's Revenue
& Customs) UK equivalent to
IRS
Lost 2 disks containing personal
information on 25 million people
(ALMOST of UK population!)
Information has a criminal value
of $3.1 Billion
No reported criminal activity to
date
5
2008 IBM Corporation
Optim
How much is personal data worth?
Credit Card Number With PIN - $500
Drivers License - $150
Birth Certificate - $150
Social Security Card - $100
Credit Card Number with Security
Code and Expiration Date - $7-$25
Paypal account Log-on and Password - $7
Representative asking prices found recently on cybercrime forums.
Source: USA TODAY research 10/06
2008 IBM Corporation
Optim
Where do F1000 Corporations Stand today?
2008 IBM Corporation
Optim
Consumer Reaction
Banking Customer Survey (Ponemon Institute)
Considered
Terminating
Service
40%
Concerned
27%
Terminated
Service
19%
Not
Concerned
14%
8
2008 IBM Corporation
Optim
Cost to Company per Missing Record: $197
Lost
Productivity,
$30
$7
$13
$4
Loss of
Customers,
$98
Over 100 million records lost at a cost of
$16 Billion.
Incident
Response,
$54
$3
$1
$24
Free/Discounted Services
Notifications
Legal
Audit/Accounting Fees
Call Center
Other
Source: Ponemon Institute
9
2008 IBM Corporation
Optim
Where is Confidential Data Stored?
[1] ESG Research Report: Protecting Confidential Data, March, 2006.
10
2008 IBM Corporation
Optim
What is Data Governance?
Data Governance is the political process of changing organizational behaviour to
enhance and protect data as a strategic enterprise asset
Implementing Data Governance is a fundamental change to the methods & rigor both
Business and Information Technology use to define, manage and use of data
The core objectives of a governance program are:
11
Guide information management decision-making
Ensure information is consistently defined and well understood
Increase the use and trust of data as an enterprise asset
Improve consistency of projects across an enterprise
2008 IBM Corporation
Optim
Without Data Governance
People make mistakes
Those mistakes more
commonly result in losses
than hackers
Those losses effect every
aspect of IT and business
But data is still an abstract
concept and governance
needs technology to be
improved
2008 IBM Corporation
Optim
Why the focus on Data Governance?
Regulatory Compliance
Consumer privacy
Financial Integrity
Intellectual Property Theft
Confidential manufacturing
processes
Financial information
Customer lists
Digital source code
Marketing strategies
State sues global management consulting company over
stolen backup tape. Unencrypted tape contained
personal information on 58 taxpayers and nearly 460
state bank accounts.
Over 45 million credit and debit card numbers stolen from
large retailer. Estimated costs $1bn over five years (not
including lawsuits). $117m costs in 2Q 07 alone.
Research data
Economic Espionage
Trade secret
13
2008 IBM Corporation
Optim
Who is breaking in and how?
Hackers take advantage of:
Vulnerable network or infrastructure security, poor server or database security
standards
Thieves steal:
Physical medium (backup tapes or disk drives), User-ids and passwords
Employees or Business Partners have authorization to servers, databases and
data
No security strategy is 100% hacker proof
Most security breaches occur internally
Accidental opening of firewall
Stealing user-id, password from authorized user
Have the authority to access the server or the data
14
2008 IBM Corporation
Optim
What is Done to Protect Data Today?
Production Lockdown
Physical entry access controls
Network, application and database-level security
Multi-factor authentication schemes (tokens,
biometrics)
Unique challenges in Development and Test
Replication of production safeguards not sufficient
Need realistic data to test accurately
15
2008 IBM Corporation
Optim
The Easiest Way to Expose Private Data
Internally with the Test Environment
70% of data breaches occur internally
(Gartner)
Test environments use personally
identifiable data
Standard Non-Disclosure Agreements
may not deter a disgruntled employee
What about test data stored on laptops?
What about test data sent to
outsourced/overseas consultants?
How about Healthcare/Marketing
Analysis of data?
Payment Card Data Security Industry
Reg. 6.3.4 states, Production data (real
credit card numbers) cannot be used for
testing or development
* The Solution is Data De-Identification *
16
2008 IBM Corporation
Optim
The Latest Research on the Test Data Usage
Overall application testing/development
62% of companies surveyed use actual customer data instead
of disguised data to test applications during the development
process
50% of respondents have no way of knowing if the data used
in testing had been compromised.
Outsourcing
52% of respondents outsourced application testing
49% shared live data!!!
Responsibility
26% of respondents said they did
not know who was responsible for
securing test data
Source: The Ponemon Institute. The Insecurity of Test Data: The Unseen Crisis
17
2008 IBM Corporation
Optim
What is Data De-Identification?
AKA data masking, depersonalization,
desensitization, obfuscation or data scrubbing
Technology that helps conceal real data
Scrambles data to create new, legible data
Retains the data's properties, such as its width,
type, and format
Common data masking algorithms include
random, substring, concatenation, date aging
Used in Non-Production environments as a Best
Practice to protect sensitive data
18
2008 IBM Corporation
Optim
Failure Story A Real Life Insider Threat
28 yr. old Software Development Consultant
Employed by a large Insurance Company in Michigan
Needed to pay off Gambling debts
Decided to sell Social Security Numbers and other identity
information pilfered from company databases on 110,000
Customers
Attempted to sell data via the Internet
Names/Addresses/SS#s/birth dates
36,000 people for $25,000
Flew to Nashville to make the deal with..
The United States Secret Service (Ooops)
Results:
Sentenced to 5 Years in Jail
Order to pay Sentry $520,000
19
2008 IBM Corporation
Optim
The Top 3 Reasons Why Insiders Steal Data
1. Greed
2. Revenge
3. Love
Source: US Attorney Generals Office, Eastern PA District
20
2008 IBM Corporation
Optim
How is Risk of Exposure being Mitigated?
No laptops allowed in the building
Development and test devices
Do not have USB
No write devices (CD, DVD, etc.)
Employees sign documents
Off-shore development does not do the testing
The use of live data is kept quiet
21
2008 IBM Corporation
Optim
Encryption is not Enough
DBMS encryption protects DBMS theft and
hackers
Data decryption occurs as data is retrieved from
the DBMS
Application testing displays data
Web screens under development
Reports
Date entry/update client/server devices
If data can be seen it can be copied
Download
Screen captures
Simple picture of a screen
22
2008 IBM Corporation
IBM Optim
Strategic Issues for Implementing Data Privacy
2008 IBM Corporation
Optim
Data Masking Considerations
Establish a project leader/project group
Determine what you need to mask
Understand Application and Business
Requirements
Top Level Masking Components
Project Methodology
24
2008 IBM Corporation
Optim
Data Masking Consideration Step 1
Establish a Project Leader/Group
Many questions to be answered/decisions
to be made
Project Focus
Inter-Departmental Cooperation
Use for additional Privacy Projects
25
2008 IBM Corporation
Optim
Data Masking Consideration Step 2
Determine what you need to
mask
Customer Information
Employee Information
Company Trade Secrets
Other
26
2008 IBM Corporation
Optim
Data Masking Consideration Step 3
Understand Application and
Business Requirements
Where do applications exist?
What is the purpose of the
application(s)?
How close does replacement data
need to match the original data?
How much data needs to be
masked?
27
2008 IBM Corporation
Optim
Data Masking Consideration Step 4
Masking Components (Top Level)
Masking is not
simple!
Many DBMS
Legacy Files
Multiple platforms
Needs to fit within
existing processes
Not a point solution
consider the
enterprise
Not a one time
process
28
2008 IBM Corporation
Optim
Component A - Consistency
Masking is a repeatable process
Subsystems need to match originating
The same mask needs to be applied across
the enterprise
Predictable changes
Random change will not work
Change all Jane to Mary again and again
29
2008 IBM Corporation
Optim
Example: First and Last Name
Direct Response Marketing,
Inc. is testing its order
fulfillment system
To fictionalize customer
names, use the a random
lookup function to pull first
and last names randomly
from the Customer
Information table:
Gerard Depardieu
becomes Ronald Smith
Lucille Ball becomes
Elena Wu
30
2008 IBM Corporation
Optim
Example: Bank Account Numbers
First Financial Banks account
numbers are formatted 123-4567
with the first three digits
representing the type of account
(checking, savings, or money market)
and the last four digits representing
the customer identification number
To mask account numbers for
testing, use the actual first three
digits, plus a sequential four-digit
number
The result is a fictionalized account
number with a valid format:
001-9898 becomes 001-1000
001-4570 becomes 001-1001
31
2008 IBM Corporation
Optim
Propagating Masked Data
Customers Table
Cust ID
Name
Street
08054
Alice Bennett
2 Park Blvd
19101
Carl Davis
258 Main
27645
Elliot Flynn
96 Avenue
Orders Table
Cust ID Item #
32
Key propagation
Propagate values in the
primary key to all
related tables
Necessary to maintain
referential integrity
Order Date
27645
80-2382
20 June 2004
27645
86-4538
10 October 2005
2008 IBM Corporation
Optim
Masking with Key Propagation
Original Data
De-Identified Data
Customers Table
Cust ID
Name
Street
08054
Alice Bennett
2 Park Blvd
19101
Carl Davis
258 Main
27645
Elliot Flynn
96 Avenue
Orders Table
Cust ID Item #
33
Customers Table
Cust ID
Name
Street
10000
Auguste Renoir
Mars23
10001
Claude Monet
Venus24
10002
Pablo Picasso
Saturn25
Referential
integrity is
maintained
Orders Table
Order Date
Cust ID Item #
Order Date
27645
80-2382
20 June 2004
10002
80-2382
20 June 2004
27645
86-4538
10 October 2005
10002
86-4538
10 October 2005
2008 IBM Corporation
Optim
Component B - Context
Client Billing Application
A single mask will affect
downstream systems
Column/field values must still
pass
edits
DB2
SS#s
SS#s
157342266
157342266
132009824
132009824
SSN
Phone numbers
E-mail ID
Zip code must match
Address
Phone area code
Data is masked
Age must match birth date
SSN#s
134235489
323457245
34
SSN#s
Masked fields
are consistent
134235489
323457245
2008 IBM Corporation
Optim
Component C - Flexibility
Laws being interpreted
New regulations being
considered
Change is the only certainty
ERPs being merged
Masking routines will change,
frequently
Quick changes will be needed
35
2008 IBM Corporation
Optim
Data Masking Consideration Step 5
Project Methodology
Determine Base Directives
Compile Data Sources List
Design Transformation Strategy
Develop Transformation Process
Implement Testing Strategy
.
36
2008 IBM Corporation
Optim
The Market Need
Corporations have a duty to protect confidential customer
information and have gained an understanding that
vulnerabilities exist both in the Production and Test
Environments
Companies have begun implementing basic privacy
functionality but are requiring more specific and application
aware masking capabilities that can be applied across
applications
- IT organizations require that development databases
provide realistic and valid test data (yet not identifiable) after
it is masked. This includes: Valid social security #s, credit
card #s, etc.
- Enterprises require the option to mask data
consistently across several different applications, databases,
and platforms
37
2008 IBM Corporation
Optim
Success with Data Masking
Today we dont care if we lose a laptop
- Large Midwest Financial Company
The cost of a data breach is exponentially more expensive
than the cost of masking data
- Large East Coast Insurer
38
2008 IBM Corporation
Optim
Success: Data Privacy
About the Client:
$300 Billion Retailer
Largest Company in the World
Largest Informix installation in the world
Application:
Multiple interrelated retail transaction
processing applications
Challenges:
Comply with Payment Card Industry (PCI)
regulations that required credit card data to be
masked in the testing environment
Implement a strategy where Personally
Identifiable Information (PII) is de-identified
when being utilized in the application
development process
Obtain a masking solution that could mask
data across the enterprise in both Mainframe
and Open Systems environments
Client Value:
Satisfied PCI requirements by giving
this retailer the capability to mask
credit data with fictitious data
Masked other PII, such as customer
first and last names, to ensure that
real data cannot be extracted from
the development environment
Adapted an enterprise focus for
protecting privacy by deploying a
consistent data masking methodology
across applications, databases and
operating environments
Solution:
IBM Optim Data Privacy Solution
39
2008 IBM Corporation
Optim
Success: Data Privacy
About the Client:
$35 Billion Financial Services Company
Application:
Custom Banking Applications
Client Value:
Satisfied the regulatory agency
mandate to prevent fraud and
Challenges:
avoided penalties by de-identifying
Complying with a regulatory agency
customer financial information in the
mandate to address increased risk for
CIS application development and
fraud, related to customer information in
testing environments
the CIS application development and
In less than 4 months, implemented
testing environments
consistent methods for de Implementing a privacy protection strategy
identifying or scrubbing personal
in time to support major year-end testing
financial information in time for the
runs and quarterly enterprise application
next application releases
testing activities
Adapted an enterprise focus for
Expanding data privacy protection to
protecting privacy by deploying a
include the mainframe and open systems
consistent data masking
development and testing environments
methodology across applications,
databases and operating
Solution:
environments
IBM Optim Data Privacy Solution
W06
40
2008 IBM Corporation
Optim
How does Data De-Identification Protect Privacy?
Comprehensive enterprise data masking provides the
fundamental components of test data management
and enables organizations to de-identify, mask and
transform sensitive data across the enterprise
Companies can apply a range of transformation
techniques to substitute customer data with
contextually-accurate but fictionalized data to produce
accurate test results
By masking personally-identifying information,
comprehensive enterprise data masking protects the
privacy and security of confidential customer data, and
supports compliance with local, state, national,
international and industry-based privacy regulations
41
2008 IBM Corporation
Optim
Concluding Thought #1
It costs much less to protect sensitive data than it
does to replace lost customers and incur damage
to the image of the organization and its brandan
irreplaceable asset in most cases.
IT Compliance Group Benchmark Study 2/07
42
2008 IBM Corporation
Optim
Concluding Thought #2
We're not going to solve this by making data
hard to steal. The way we're going to solve it is by
making the data hard to use.
Bruce Schneier, author of "Beyond Fear: Thinking Sensibly
About Security in an Uncertain World"
43
2008 IBM Corporation
Optim
Optim Test Data Management
Typical Client Concerns:
Test environments not up to date. Lag production by 3-18 months.
Developers can not get access to the data they need to test new application releases.
Long and slow development and test cycles.
Looking to speed application delivery processes.
Solution: IBM Optim Test Data Management Solution
Enables the creation of targeted right-sized subsets for application testing
Value Proposition:
Speeds Application Delivery
Eliminate the need and time to clone the entire production data base for the test
environment
Create targeted, right-sized subsets faster and more efficiently than cloning
Improve operational efficiencies by shortening iterative testing cycles
Shift the detection and resolution of application defects to the front-end of the
development process
Improve test coverage and enhance accuracy
44
2008 IBM Corporation
Optim
Optim Data Privacy
Typical Client Concerns:
Unmasked and personally identifiable data in test environments
Third-party consultants on staff that have access to the personally identifiable data
Outsourced and or off-shored testing services have access to the personally
identifiable data
High Risk and Penalties
Failed privacy audits
Solution: IBM Optim Data Privacy
Consistent and Scalable Solution to secure and protect personally identifiable data
across the enterprise.
De-identify and mask confidential test data to close the security gap.
PCI compliant.
Supports complex environments where application data is federated across a
multitude of infrastructures, applications and data bases.
Value Proposition:
Risk Mitigation
45
2008 IBM Corporation
Optim
Enterprise Architecture
Single, scalable, interoperable EDM solution provides a central point to deploy policies to extract, store, port, and protect
application data records from creation to deletion
46
2008 IBM Corporation
Optim
Questions?
For more information:
Steve Johnston
[email protected]
www.OPTIMSOLUTION.COM
47
2008 IBM Corporation
Optim
48
2008 IBM Corporation
