data – Bredemarket

When, Not If, Your PII is Exposed

The best thing for all of us to do is just flat out assume that the personally identifiable information (PII) that companies collect from us WILL be compromised.

I’ve always assumed that Madison Square Garden and the New York Knicks LIKE celebrities. They get so much free publicity from them, after all.

But Madison Square Garden didn’t adequately protect celebrity PII.

“A criminal hacker collective called ShinyHunters recently published a slew of documents exposing the MSG database….ShinyHunters had demanded ransom to delete their data, but MSG apparently didn’t meet their terms.”

But then the celebrities found out what MSG was tracking about them.

“93 entries are marked as “LGBTQIA,” such as Ricky Martin, Phoebe Bridgers, and Geese’s Emily Green….

“The database also marks some entries with risk scores, often based on social media posts, a source told Wired. ‘It doesn’t have to be that serious. You could just be critical of the team or the place itself,’ the source said.”

This is what businesses like MSG fail to recognize. A data breach doesn’t only harm the victims. It also harms the organization itself because they’re perceived as a security risk. In the case of MSG they’re also perceived as nosy, even paranoid.

Which is one of the reasons why Bredemarket collects only the minimum necessary data on its Calendly form and other forms. I don’t ask for your sexual orientation or even your favorite sports team.

Business Concerns Always Override Technology Concerns

The Institute for Defense and Government Advancement (IDGA) recently released some survey results. Now I don’t want to simply reproduce the results; go here to download your own copy of the report.

But I do want to say this.

“A large number” of IDGA survey respondents expressed concern about “Interagency information sharing.”

This is NOT a technology concern. The technologies exist to enable information sharing. For example, one of Bredemarket’s clients recently made the technological changes necessary to allow an application, designed to interface to agency A, to instead interface to agency B.
No, this is a business concern—or in this case a governmental concern. A matter of setting up the processes to allow Bob from agency A to exchange data with Judy from agency B. Even though Bob thinks that Judy is a bozo, and vice versa.

And while we’re on the topic…

If you’re worried about Big Government (the FBI and the CIA and the BBC, BB King, and Doris Day) (or INTERPOL and Deutsche Bank, FBI and Scotland Yard) combining all their information to entrap you, your fears may be difficult to realize. Yes, there are cases in which the agencies share data. But there are also cases where they don’t, because it’s in an agency’s interest to keep its data to itself.

Agencies usually ask the question “How can I GET the data from the Bureau of Stuff?” They normally don’t ask the question “How can I GIVE my data to the Bureau of Stuff?”

And that’s why agencies run into problems sharing data.

Dig It.

Computer World.

(Past illustrations) Creating actionable information to document and expand a merged company’s combined market

(This past illustration describes something that I performed in my career, either for a Bredemarket client, for an employer, or as a volunteer. The entity for which I performed the work, or proposed to perform the work, is not listed for confidentiality reasons.)

By Lacrossewi – Own work, CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=81149806

PROBLEM

After a merger of two companies, the combined company needed to know which customers used solutions from the combined company, which customers used competitor solutions, and which used both.

For example, a customer may use the combined company’s solution for one product line, but a competitor solution for another product line.

As the combined company introduced new products and entered new markets, this information was also required for the new product lines and markets.

SOLUTION

While others worked on front-end presentations of public portions of the data, I gathered the underlying data.

For multiple product lines, I recorded (when known/applicable) the type of customer (for example, a statewide government agency), current vendor, previous vendor, initial and extended contract value, product version, relevant statistics about the customer, and a designated reviewer for future quarterly updates.

The data was both stored separately for each product line and was also summarized.

Information was color-coded to highlight the combined company’s market position.

Data could be filtered as necessary (for example, only showing statewide government agencies).

The complete collection of highly sensitive data was tightly held.

Portions of the data were passed to selected subject matter experts on a quarterly basis for updating, allowing front-end presentations to be updated quarterly.

Additional information was gathered as new markets were entered and new products were launched.

RESULTS

The combined company had a better view of its positions in its various markets.

The resulting actionable information could be used to target specific customers and replace competitor products with the combined company’s products.