Murdoch Kills 'News of the World': The Coming Security Backlash

It was interesting to watch News Corpo.’s response to the voicemail hacking allegations -- this practice had been going on for years. It appeared to be a current event with enough magnitude to kill one of the publishing firm's most successful businesses.

What happened wasn’t that the crime changed, but that people’s perception of the crime changed, and what was allowed suddenly wasn’t. The environment continues to be very hostile to companies that violate privacy, and companies like Google and Facebook that trade in personal information are at risk. They aren’t the only ones: We can see the problems Sony is having and the fact this could drift to anyone (like the carriers who controlled the voice mail systems) who gets breached.

Voicemail is normally provided by a carrier, but it could be provided by a company or a government. In either case, a breach that exposed a protected person (civil servant or soldier who died on duty, suicide victim, child, disabled person, elderly person, etc.) could result in a backlash not just against the attacker, but against the organization that didn’t adequately secure the service.

Given News Corp.’s reach and business, and the need for it to switch the focus off of it, the likely target would be the service providers who were breached, and News Corp. has the reach and resources to pull off this change.

But even if it doesn’t, anyone who provided a service that is seen as inadequately secure is at risk, and the real problem is that the bar for “inadequate” is dropping like a rock. What seemed acceptable last week no longer seems acceptable today, and one big public breach could result in a massive backlash. You could actually be more secure than a competitor, but if it is your company that gets hit, it is your company that could be in front of a Senate committee or on the wrong side of a class action suit like Sony.

Clearly, part of this is making sure security of personal information is at an acceptable level of risk by balancing the likely chance you’ll have an event like this with the level of effort you are making to secure the critical personal information.

This suggests having in place response plans for when the event occurs that immediately focuses on going after the attackers who penetrated the company. It would also message out the firm or entity as a victim and can articulate what has been done to secure the information as reasonable.

This is all about managing perceptions, and I think News Corp. got this wrong. The firm should have fired and filed criminal charges against the employees who committed the acts against protected people, but defended those that went after public figures under freedom of press rules.

The effort should have been to make this look like a few people didn’t understand that those who are aren’t public figures are off-limits. Shutting down the entire paper makes them look guilty. The response makes this actually appear more like a cover-up, where they are attempting to burn the evidence, and it isn’t playing out well -- likely because News Corp. didn’t have in place a contingency play for an investigation method blowing up on them.

What we often forget about security is that a good portion of the effort is about managing perceptions. If people feel secure, then they think you are doing a good job. If they don’t, then you aren’t, and often there is little relation to how secure they are to how secure they feel.

Given the rapid proliferation of breaches, plans to deal with the media aspect of the breach and to focus anger on the attacking -- rather than the defending -- organizations would be wise for those of us on the defense side.

Rob Enderle is is president and founder of The Enderle Group. Special to Dark Reading