Scott Wright’s Security Views

This breach occurred as a result of a state intern taking a backup tape home from the office, and having his car broken into (click HERE). Initially, it was thought that the tape contained private records of 64,000 state employees. However, upon further investigation they found that it had contained 370,000 Ohio citizens� personal data, including names of people with uncashed tax refund cheques and lottery winners.

What went wrong?

The state government office had a 2001 policy that said backup tapes were to be taken home each night by the network administrator. There is no word on whether or not the policy was more specific regarding the handling of the tapes as sensitive data. Continue Reading »

I just wanted to follow up for a moment on my last post about what your staff thinks is important information to the operation of your business. It is not uncommon to find relatively sensitive information lying on the pile of printouts that didn’t get picked up.

Occasionally, things like the head engineer’s CV or a financial proposal on an acquisition may show up in that pile, and who wouldn’t be a little curious to find out some interesting tid-bits? The CV on the printer is not uncommon in any business, and it’s the employee’s personal agenda that is at risk. However, financial proposals or other sensitive information will eventually show up.

Continue Reading »

If you are an executive in your organization, here’s an exercise that might open your eyes to what the real problems are with security in your organization. Randomly stop and ask people in the hall or in meetings what information they handle in their jobs that could be valuable to an outsider… You know, something worth stealing.

Chances are, you will find a lot of people who would say things like “I don’t know”, “nothing”, or “that big, expensive software program we bought last year”. Maybe you were expecting them to say things like “customer lists”, “power supply designs”, “process descriptions”, “corporate strategies”, “financial plans”, “hiring plans”. How about you get back to me and let me know (anonymously, if you like) what percentage identified the real Intellectual Property (IP) that your organization’s business systems depend on to operate from day to day.

Continue Reading »

A year or so ago, my family computer caught a nasty virus, despite the fact that I was using Norton Internet Security, with Antivrus an Antispyware protection. It was frustrating to see that there was clearly some kind of malicious code at work, but that the software that was supposed to protect me was saying “All Systems Are A-OK”.

The problem at the time was that every time you opened Internet Explorer (there’s a topic for another post!), the browser would go off to a site called “Win-Fixer”, telling us that our machine had a virus, and that Win-Fixer was a product we could purchase to fix the problem. Can you say “Extortion”? Continue Reading »

This is the first in what unfortunately could be many posts I’ll call “Case Studies”. It’s unfortunate, because breaches are now publicized on such a regular basis, I could make a blog entirely about them, as SC Magazine now does. It’s called the Breach Blog. In my case, I was thinking it may be helpful to add some value to some of their entries by doing a bit of analysis and guidance on what you can do to avoid them.

Unauthorized File Sharing Software Leads to Pfizer employees’ Data exposure…

This breach was the result of an employee’s spouse using an office laptop at home for personal use. File sharing software was loaded, against company policy, and BINGO, 17,000 company employees’ personal information was exposed over a Peer-to-Peer network (including past and current employees). It’s not clear from the SC Mag post which P2P network was involved, or whether all the data was confirmed to have been transmitted over the network. Continue Reading »

It was a small session, but was jam-packed with thought-provoking discussion, with everything from futuristic toilets that will be able to send data on your stool samples directly to your doctor, to smart dust (maybe as an allergen desensitizer? who knows?)….

But seriously, Bill Pascal of the Canadian Medical Association and Mark Dermer of the Canadian Health Infoway provided a great tag-team summary of the economic landscape (both global and Canadian), as well as a view of political and technological challenges in Canadian e-Health. Not surprisingly, security and privacy were considered to be key issues that must be built in (with privacy being highlighted as the major concern - they aren’t trying to stop foreign espionage, just misuse of personal health information). Continue Reading »

Thanks to Mike Rothman for locating this entertaining, but very informative post from Dark Reading that prints some of the top complaints managers have about security vendors. (HERE)

From my time as a Product Manager, I saw this problem from both sides. It’s hard to make round pegs fit into square holes. It should be the Sales Rep’s job to properly screen their prospects. But week after week I got pulled into presentations with prospects that represented “million dollar deals”. I have to admit it was often fun and educational for me to see Real Prospects and talk to them. That’s important, too. But if some reasonable percentage of those prospects had actually bought product we would all have been rolling in stock options and driving Porsches.

On the other side, vendors still contact me to pitch their solutions without knowing how, or even trying to find out anything about what my real problems are (or my Clients’ problems).

So, even though it can be a fun diversion from the daily routine to sit through a vendor pitch, or to get out of the office and present your latest technology to an unqualified prospect, your time is always better spent thinking about what you can be doing to make the most impact on your business, and then doing NOTHING ELSE until that’s taken care of. That will not only help your organization “get to secure” faster, it won’t hurt your career either. For that matter, it’s usually a faster way to get to the car dealer.