Introduction

It was long day for Mark at the office. He had worked for the Oklahoma Department of Human Services for several years. It was Friday and he was ready to go home. Even though it was the weekend, he had some work that he needed to catch up on over the weekend. He decided he would bring his laptop home with him and finish the work on Sunday. After getting home, he was anxious to get inside to see his family. Because of the rush, he left his laptop in the car.

The weekend went by, and Sunday morning rolled around. When Mark went out his car he realized it had been broken in to and the company laptop was stolen. Mark was shocked. He had been working with a lot of sensitive information on the laptop. It had several people’s Social Security numbers on it and if anyone got that information they would be able to have access to several people’s personal information. Worse yet, those people’s identities could get stolen with that information.

“If only I had kept the laptop with me”, thought Mark. He didn’t know what he was going to tell his boss. Worse yet, he didn’t know if the person that stole the laptop knew what sort of information was on there. “At least the computer is password protected” Mark thought. “Hopefully the person won’t be able to get into the computer itself.” When Mark told his boss, they scrambled to figure out what to do. They didn’t have any sort of official action or procedures to follow, and were unsure of how to handle such a situation.

Department Reaction to the Breach

The lack of knowledge on security and governance is evident in the fact that authorities considered the loss to be minimal merely because the laptop was encrypted.

Testimony to this is the statement by OKDHS Director Howard H. Hendrick, “risk of the data being accessed is low because the computer uses a password protected system”.
Cost