Last week, I saw two stories on a local television network, about two different local organizations that exposed Social Security Numbers (SSN) through two different forms of media: electronic communications and the U.S. Mail. I have chosen to leave the names of the organization absent in this posting, because the stories are not important, but rather the level of importance these stories had as compared to other less related stories. In the total of roughly 5 minutes given to these individual stories through a local news station, the impact has left me thinking about how desensitized our society must be as it relates to the protection of the SSN. Security has always been considered critical to controlling access to systems, but who is controlling access to data? Data in itself is the reason for protecting systems, but somehow, data gets exposed, and it has nothing to do with security of the system.
If the Social Security Number represents your identify, why can't you control how it is used. According to the Social Security Administration (SSA) Publication No. 05-10064, October 2007 "the Social Security Administration protects your Social Security number and keeps your records confidential." But what about the hundreds of other organizations that have your SSN? Are they providing the same guarantee when protect your personal information?
These two stories carelessly exposed the SSN, not by a lack of protection in the systems, but a lack of protection in handling the data (specifically the SSN). I believe just as online services such as banking and other financial institutions are requiring more and more methods of identity authentication to access their online sites for performing routine financial and transaction-based functions, the SSN needs to be upgraded to require multiple layers of security to represent ones identity, such as a consumer chosen pin, or a loopback verification that gives you the consumer insight into when and how your SSN has been used. Until these measures have been implemented, your SSN may never be within your control.
More...
07-24-2008
