Using a Taxonomy to Analyze Recent Data Losses

Abstract

Malicious hackers tend to steal headlines, but do their stories correlate to the threats that are most prevalent in your industry? Reviewing a selection of publicized security incidents from 2005–2007, Lee proposes a taxonomy of breaches based on the concept of the threat/vulnerability pair. He explores the proportion of incidents of each type in several broadly defined industries, followed by analysis and discussion of effective technical, procedural, and administrative controls. The data and analysis can assist business leaders to make informed decisions about the distribution of limited information security assets.

About the I/S Journal

I/S: A Journal of Law and Policy for the Information Society is an interdisciplinary journal of research and commentary, concentrating on the intersection of law, policy, and information technology. I/S represents a one-of-a-kind partnership between one of America's leading law schools, the Moritz College of Law at The Ohio State University, and the nation's foremost public policy school focused on information technology, Carnegie Mellon University's H.J. Heinz III School of Public Policy and Management.

Subscribe to the I/S Journal or contact Interhack to receive a copy of the paper.

About Interhack

Based in Columbus, Ohio, Interhack Corporation is a professional services firm with clients all over North America. Founded in 1997 by a team of information security researchers, Interhack accepted the mission to make global computing and communications infrastructures worthy of trust. Interhack's two practice areas, Information Assurance and Forensic Computing, support that mission.  The company is a supporting member of The Usenix Association. Additional information about Interhack is available at web.interhack.com.