The monstrous data breaches involving millions of records make all the headlines -- TJX, AOL, the Veterans Administration. However, it's those whoppers combined with the rat-a-tat-tat of seemingly daily divulgences involving lesser-known entities and fewer victims that add up to a costly and so-far-uncontrolled societal headache.
Logging these incidents and assembling reliable research data about the problem has been a bailiwick of security Web site Attrition.org since July 2005 -- and has at times proven daunting, as the database now contains more than 1,000 incident reports covering some 330 million records. Into the breach, so to speak, steps the Open Security Foundation, which recently announced it will formally maintain the DataLossDB -- also known as the Data Loss Database - Open Source.
Attrition.org staff member Kelly Todd, a DataLossDB project leader, tells me that a primary motivation behind the change is to increase public contributions to, and involvement in, the database.
"In the past, Attrition.org was approached by quite a few entities in the public and private sectors for input into their studies," Todd says. "The information itself will hopefully become more complete and accurate with community contributions, which should lend to more analysis about how and why data breaches occur, and, possibly [and hopefully] how they can be prevented in the future."
Of course, there will be quality controls.
"Anonymous submissions will be allowed, but we're hoping that people will sign up for an account so we can give credit to anyone who contributes to the data set," Todd says. "All submissions will be moderated by a core team of volunteers for accuracy."
I asked Todd if the escalation of the DataLossDB project was an indication that data breaches in general are likely to remain a growth industry.
"As far as actual breaches go, no one can say for sure if they'll increase or decrease, but public reporting and awareness has definitely increased in the last few years," he says. "I'd hesitate to call it a 'growth industry.' We're definitely seeing a lot more public interest in the topic, though, so even if breaches do decrease or level off, I imagine it will continue to be a popular topic of discussion for the months and years to come."
Real reasons these 10 states get the most spam
MessageLabs has released a list of the states that receive the most spam ... and the security vendor offers this highfalutin explanation for why these 10 are most targeted:
"The varying spam levels across states can be attributed to different socioeconomic factors and levels of security awareness in each state," says a MessageLabs expert. "The states that are experiencing higher spam levels may not place as high a priority on IT security overall or employees and businesses may be more willing to share their personal contact information in public domains."
Uh, maybe. Here are the 10 states in order of ascending spaminess ... and my take on the real reasons they are junk e-mail magnets:
10. Alabama: Just announced a crackdown on diploma mills -- a leading industry, apparently -- which should drop the state off this list in no time.
9. Pennsylvania: Its lawmakers are too busy policing the National Football League.
8. Texas: Construction is behind schedule on that antispam border fence.
7. Indiana: Name a town Santa Claus, expect a lot of mail.
6. North Carolina: Even spammers hate Duke.
5. Wisconsin: Cheese-head hats have proven to be an ineffective spam deterrent.
4. New Hampshire: Ban on spam filters takes that "Live Free or Die" thing a bit too far.
3. Oregon: Spam turned back at California line has to go somewhere.
2. South Dakota: That lone e-mail account makes for an inviting target.
1. Illinois: Obviously, Obama's weak on network security.