AOH :: ISN-3282.HTM

Guidance Software Settles FTC Charges




Guidance Software Settles FTC Charges
Guidance Software Settles FTC Charges



http://www.washingtonpost.com/wp-dyn/content/article/2006/11/16/AR2006111601339.html 

By CHRISTOPHER S. RUGABER
The Associated Press
November 16, 2006

WASHINGTON -- Guidance Software Inc. said Thursday it's settled Federal 
Trade Commission charges stemming from a 2005 security failure that 
allowed hackers to access the credit card information of thousands of 
customers.

Guidance, which makes software used by law enforcement agencies and 
corporations to investigate network breaches, failed to take "reasonable 
security measures" to protect sensitive customer data and that its 
failure to do so "contradicted security promises made on its Web site" 
and violated federal law, according to an FTC statement.

The settlement requires the company to implement a comprehensive 
information-security program and obtain audits by an independent 
third-party security professional every other year for the next 10 
years. The settlement also bars the company from misrepresenting its 
security measures in the future, the FTC said.

The agency departed from its usual 20-year monitoring period because of 
Guidance's cooperation and the "limited nature of the breach," according 
to the company.

The settlement agreement involved no financial penalties and did not 
constitute an admission of guilt, the privately held company said.

According to the FTC, the company "failed to implement simple, 
inexpensive and readily available security measures" to protect its 
customers' data. The company, the agency said, also failed to adequately 
asses the vulnerability of its network to well-known Web-based attacks 
and did not take steps to detect unauthorized access to its consumers' 
credit card information.

"In contrast to claims about data security made on Guidance's Web site, 
the company created unnecessary risks to credit card information by 
permanently storing it in clear readable text," the FTC said.

Pasadena, Calif.-based Guidance said it has taken several steps to boost 
its computer security, including hiring a senior director of information 
technology and corporate security.

"We will continue with an aggressive approach to information security 
and plan to surpass the requirements set forth in our agreement with the 
FTC," Guidance Chief Executive John Colbert said.


_________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn 
 

Site design & layout copyright © 1986-2014 CodeGods