Below is an overview of a couple articles recently written about a Security Breach that affected thousands people because a lack of policies. A United Kingdom insurance giant Zurich has lost a tape backup in transit to South Africa. Because the lack of efficient policies this has cost the large corporation of Zurich client trust, future revenues, and potential fines.

On October 22 of this year insurance giant Zurich UK announced to the public the loss of data relating to 641,000 customers due to a security breach. During the transit of a data tape to a secure storage unit in South Africa a year prior is when the suspected breach occurred. The tape backup contained details of 51,000 UK customers, Zurich’s entire South African customer base of 550,000 clients, alongside the details of 40,000 customers in Botswana. Some of the data contained names and contact details as well as bank details for client payments. The customers, authorities, and the public were alerted to the breach in an attempt to minimize any future potential identity theft.

Annette Court, the chief executive of general insurance for Europe and Zurich Financial Services, said the loss was “unacceptable” and that the company takes security “very seriously.” In addition she stated, “We are putting a great deal of investment into strengthening our internal processes to ensure that incidents of this nature do not happen again in the future” and admitted that Zurich’s’ security procedures had failed. (Neal, D) After reviewing the articles found on Zurich we are made aware by Ms Court that there were some internal processes that failed. Ms Court did not state whether or not this was a violation or simply a process not followed properly so we cannot conclude whether this was a malicious or an accidental breach of the data.

The Yorkshire Post did quote Ms Court stating, “we have no evidence that our customers’ data has been accessed or compromised in any way.” A 2009 identity theft Study from Javelin Strategy & Research reveals that 71% of fraud happens within a week of stealing a victims’ personal data, therefore we can hold our breath and hope that this was just an accidental breach of data. Although due to the short time elapsed we will not know for a while until an investigation is completed. Some policies that come to mind that should have been implemented and followed to prevent this breach would include encryption of mobile data and procedures for taking inventory when an item arrives and leaves.

If the company utilized Symantec Backup Exec 11d for their tape backups then the best practices guide for this application states the Backup Exec administrator could have placed a 256-bit AES encryption on the data with a passphrase of 16 or more characters. According to Dekart.com with a 16 character passphrase this would take about 1,872,000 years to identify by a brute force attack. So in the event a backup tape was compromised the likelihood of the data becoming exposed is extremely rare.