Risk
3/27/2006
01:43 PM
Tom Smith
Tom Smith
Commentary
50%
50%

Data Security: Out To Lunch, Er, Dinner

It was just last week that InformationWeek published the latest exhaustive analysis of what's emerging as the IT story of the first decade of this century: complete corporate and government ineptitude when it comes to managing sensitive personal data.

It was just last week that InformationWeek published the latest exhaustive analysis of what's emerging as the IT story of the first decade of this century: complete corporate and government ineptitude when it comes to managing sensitive personal data.It didn't take long for another company--Fidelity Investments--to get a black eye for mishandling a laptop containing personal information on 196,000 current and former employees of Hewlett-Packard. Lest you think some poor unsuspecting Fidelity employee was robbed of the laptop at gunpoint, or had their home forcibly broken into and the laptop stolen, think again.

The employee in question left the laptop in a rental car while having a three-hour dinner with colleagues, according to a story in the Wall Street Journal [subscription required] that included details from a police report. At some point in the evening, the vehicle's keys were given to a colleague to retrieve an item from the vehicle ("Here, take my keys, don't worry about the 200,000 customer names sitting unprotected in the car."). The colleague, it seems, left the vehicle unlocked, and the laptop went missing. It was just one of 65 laptops reported stolen from restaurant parking lots in Palo Alto, Calif., in the last 15 months.

A Fidelity spokesperson said the company takes information security "very seriously" (can't you tell?) and that company policy wasn't followed. Such mealy mouthed excuses grow increasingly tired with each of the 130-plus data breaches since early 2005. Because companies can't seem to institute policies or adequate technical safeguards, here's a few suggestions for ensuring your company doesn't let incompetent third parties or its own employees mishandle its data:

  • Oftentimes, it's an outside data handler that's the cause of the problem. In this case, the data handler forced HP to deal with any and all issues affecting the 196,000 current and former employees. One can only imagine the potential for lost productivity at HP as employees figure out if their identity has been stolen. That alone is enough to fire Fidelity, just as any company that's the victim in such a case should consider doing if a third party loses their data. While you're at it, fire knuckleheaded employees that traipse around with reams of data about their customers. If corporate policy doesn't explicitly forbid such behavior, fire the corporate policy department.

  • Companies should demand documented policies, procedures, and safeguards from any vendor handling sensitive data on their behalf. Ongoing audits should be used to verify compliance. Failure to maintain compliance should result in stiff financial penalties up to and including termination of a business relationship.

  • Do away, once and for all, with the practice of storing sensitive or private data on laptop computers, which by their very definition are intended to be transported and are therefore vulnerable to theft. There may be a completely valid reason that one person needs to have personal data on 196,000 customers on their laptop, but I doubt it.
HP was just one of three incidents last week (see the comprehensive list since 2005 here and more gory details here), and more may be in the offing.

Our friends in the federal government--not exactly a bastion of personal data protection--are at it again.

The Government Accountability Office says the IRS' IT security weaknesses "increase the risk that sensitive financial and taxpayer data will be inadequately protected against disclosure, modification, or loss, possibly without detection." Oh boy.

I've shared my recommendations on what companies need to do, mostly by putting the screws to their vendors, to protect themselves and their employee and customer data. What do you think needs to happen next?

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.