Calls to adopt international standards for data security

Dubai: Customer data may be at risk in the Middle East because governments aren't requiring firms to follow internationally rec-ognised security standards, experts say.

The compliance industry for computer security firms in the United States will reap $80 billion over the next five years, according to one estimate. But divining the value of this in the Middle East is more obscure, said Asem Galal, general manager of computer security firm Mc-Afee.

This is because in the US and other governments, firms in specific industries where sensitive data is collected must all comply with certain standards.

HIPAA is a standard for healthcare, Cobit is applied in information technology management, and PCI is used for the credit card industry, for example.

But in the Middle East, governments haven't adopted internationally recognised standards for data protection, he said during a press conference unveiling McAfee's compliance management product, as well as a new data loss prevention system which can stop employees from copying company data onto flash drives and the internet.

The result is that companies aren't fully protected, and sensitive customer data in the Middle East becomes exposed to threats from hackers.

The same lax regulatory climate means the public don't always find out about privacy breaches, he added.

"Customers are not protected by international standards," said Galal.

"Banks in the territories we live in aren't necessarily obliged to inform customers if the bank has been attacked."

In a digital world, the dangers can come from nearly anywhere.

A recent survey by McAfee found that 55 per cent of workers in the US take confidential company documents out of the office on portable devices several times per week.

Whether the data is taken innocently or maliciously, the result can be serious, with proprietary software, business proposals, price lists and customer data liable to get in the hands of rivals.