Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/27/2006
01:43 PM
Tom Smith
Tom Smith
Commentary
50%
50%

Data Security: Out To Lunch, Er, Dinner

It was just last week that InformationWeek published the latest exhaustive analysis of what's emerging as the IT story of the first decade of this century: complete corporate and government ineptitude when it comes to managing sensitive personal data.

It was just last week that InformationWeek published the latest exhaustive analysis of what's emerging as the IT story of the first decade of this century: complete corporate and government ineptitude when it comes to managing sensitive personal data.It didn't take long for another company--Fidelity Investments--to get a black eye for mishandling a laptop containing personal information on 196,000 current and former employees of Hewlett-Packard. Lest you think some poor unsuspecting Fidelity employee was robbed of the laptop at gunpoint, or had their home forcibly broken into and the laptop stolen, think again.

The employee in question left the laptop in a rental car while having a three-hour dinner with colleagues, according to a story in the Wall Street Journal [subscription required] that included details from a police report. At some point in the evening, the vehicle's keys were given to a colleague to retrieve an item from the vehicle ("Here, take my keys, don't worry about the 200,000 customer names sitting unprotected in the car."). The colleague, it seems, left the vehicle unlocked, and the laptop went missing. It was just one of 65 laptops reported stolen from restaurant parking lots in Palo Alto, Calif., in the last 15 months.

A Fidelity spokesperson said the company takes information security "very seriously" (can't you tell?) and that company policy wasn't followed. Such mealy mouthed excuses grow increasingly tired with each of the 130-plus data breaches since early 2005. Because companies can't seem to institute policies or adequate technical safeguards, here's a few suggestions for ensuring your company doesn't let incompetent third parties or its own employees mishandle its data:

  • Oftentimes, it's an outside data handler that's the cause of the problem. In this case, the data handler forced HP to deal with any and all issues affecting the 196,000 current and former employees. One can only imagine the potential for lost productivity at HP as employees figure out if their identity has been stolen. That alone is enough to fire Fidelity, just as any company that's the victim in such a case should consider doing if a third party loses their data. While you're at it, fire knuckleheaded employees that traipse around with reams of data about their customers. If corporate policy doesn't explicitly forbid such behavior, fire the corporate policy department.

  • Companies should demand documented policies, procedures, and safeguards from any vendor handling sensitive data on their behalf. Ongoing audits should be used to verify compliance. Failure to maintain compliance should result in stiff financial penalties up to and including termination of a business relationship.

  • Do away, once and for all, with the practice of storing sensitive or private data on laptop computers, which by their very definition are intended to be transported and are therefore vulnerable to theft. There may be a completely valid reason that one person needs to have personal data on 196,000 customers on their laptop, but I doubt it.
HP was just one of three incidents last week (see the comprehensive list since 2005 here and more gory details here), and more may be in the offing.

Our friends in the federal government--not exactly a bastion of personal data protection--are at it again.

The Government Accountability Office says the IRS' IT security weaknesses "increase the risk that sensitive financial and taxpayer data will be inadequately protected against disclosure, modification, or loss, possibly without detection." Oh boy.

I've shared my recommendations on what companies need to do, mostly by putting the screws to their vendors, to protect themselves and their employee and customer data. What do you think needs to happen next?

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Vulnerability Disclosure Programs See Signups & Payouts Surge
Kelly Sheridan, Staff Editor, Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15216
PUBLISHED: 2020-09-29
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revisio...
CVE-2020-4607
PUBLISHED: 2020-09-29
IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due to improper input validation. IBM X-Force ID: 184884.
CVE-2020-24565
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...
CVE-2020-25770
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...
CVE-2020-25771
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...