Why Do You Rob Banks

Willie Sutton was a famous U.S. bank robber.  When asked why he robbed banks, he responded by saying, "because that’s where the money is". That logic and answer can be applied to all types of data security incidents. Often times, what makes a given system a target is because, "That’s where the data is, which means that’s where the money is."

Now the fact of the matter is, money is not the only reason for breaches. Companies can be targets for many reasons including simple or competitive maliciousness. The "Sutton" principle still applies, though, because concentrations of data and, more importantly, concentrations of valuable data, create targets. We see this played out in many of the high profile security breaches.

Recently, Epsilon, which manages e-mail marketing campaigns, was broken into and e-mail addresses were stolen. This event triggered several inquiries to me as to whether or not NICE CXone utilized Epsilon for any of our e-mail services… We do not, and therefore, the Epsilon event did not result in the compromise of any NICE CXone data.

That event also evoked questions about how NICE CXone protects its customer’s data. Now that’s a long story in the telling, but I can short list some of the best practices that we follow.

1. Do not keep unnecessary data. NICE CXone has many tools that allow our solutions to consume data without storing it on our system. If at all possible, we make every effort to not store customer information on our systems.
2. Minimize data concentrations. I cannot provide the proprietary specifics, but NICE CXone is able to segment data to prevent the concentration of all customer data in one place.
3. Secure connections and session timers.
4. Encryption of sensitive data.
5. Technical controls such as firewalls, intrusion detection, physical accesses and password controls.
6. Code security that addresses threat vectors such as SQL injection, XSS and buffer overruns.
7. Vulnerability scans and penetration testing.
8. Internal controls and separation of duties for NICE CXone employees.
9. Regular internal audits of NICE CXone's own internal controls and user access.
10. Vendor and 3^rd party security reviews.
11. Security Awareness training for all employees.
12. Anti-virus and patch management.
13. SAS70 and other external audits.

These are some of the things NICE CXone does to secure information within its environment.

Regulators often focus on specific data types such as PII, PCI, HIPAA, etc. The fact of the matter is, all of our customers’ data is important, regardless of whether it fits into a specific regulatory category or not.

At NICE CXone, we know that all of your data is important to you, and it’s important to us.