eWeek: What about security on the side of making sure youve gotten rid of what you have no business reason to keep? Skaff: We have a similar policy in terms of e-mail retention. Its something weve just started to address and have started to look into as an important focus. In terms of document destruction, weve actually looked at other forms of protection--more specifically, around encryption, hard disk encryption and those areas, as sort of an alternate method. In terms of a clean sweep, it hasnt been as much of a priority for us--up until now, at least. It is something that I am aware of. Gunnerson: Do you use key destruction as a way of getting rid of the ability to read documents or read hard drives?Schwedhelm: On July 1, a new California law will require us to publicly disclose if were hacked. Any business in California is going to be required to do this. eWeek: Is it falling on your shoulders to become the force for user and business unit education in this area? Schwedhelm: Yes. Im also the banks security officer, in addition to being IT, so this falls in my neck of the woods. eWeek: Where do you see yourself being challenged to develop new capabilities or to develop new skills in your people? Schwedhelm: Security, specifically intrusion detection. A good deal of this, again, is being driven by SB 1386. The way this law is written, if you are aware, or just believe, youve been breached, you have to disclose it. eWeek: Do you anticipate that California law becoming a model for other states? Schwedhelm: Actually, it would be wonderful if it were to become a national law. It will become a nightmare if, for example, you have one law in Nevada and in Arizona youve got another. eWeek: Are you seeing initiatives in other states that would be similar but different enough to be a problem? Schwedhelm: We havent heard of anything yet. The latest Ive heard is this is kind of the trendsetter.
Skaff: That is the easiest way, so, yes. Thats what weve been using so far. I dont really think of it as the best solution, by any means. Its certainly the simplest in the short run.