IT Week in the UK today ran a story "Companies keep silent on data breaches". It's interesting in that it discusses the fact that recent research shows that one third of all enterprise security breaches go unreported. It raises the question of whether or not to report enterprise security breaches?
In my own personal opinion, I believe that if the breach potentially endangers customer data, then the customers must be notified. If the customers are the general public and not enterprises, then I believe the announcement must be made publicly. In fact, I think that laws need to be standardized across the planet demanding this.
While the impact on the enterprise can be grave in announcing this (e.g. TJ MAX) the long term outlooks for both the consumer and the enterprise are better than by not reporting it and effectively sweeping it under the carpet.
Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com
del.icio.us