Another Story of Lost Data

eddorre

Another Story of Lost Data

Computerworld is running yet another article on a company losing their backup tapes.

This case caught my eye immediately because it has happened in “my own backyard.” According to the article a set of disks and tapes was stolen from the car of a Providence employee while the car was at his home in Portland, Oregon.

A spokesman for Providence said that the data on the tapes was encrypted but the data on the disks was not. Walker, the spokesman, mentioned however that the data on the disks was is stored in a way that would make it difficult, if not impossible, for someone to access it, then make any sense out of it.“

This is another black eye for IT departments everywhere and a call to review their offsite tape policies.

If you are concerned that your information might be at risk, you should read the ”http://www.providence.org/oregon/hcs/newsrelease.htm">Providence press release and if necessary call their hotline number at 1-888-284-8997.

Comments

1
I am more worried in general about this garbage. Why aren’t things like this under lock and key or behind a couple guard dogs?
Robert http://www.osnr.org

Friday January 27, 2006 10:29
2
Robert,

It’s starting to take a worrisome tone, that’s for sure.

As to an answer to your question there are probably a lot of factors that contribute to this but I think it’s because information security always take a backseat to other projects.

Encrypting your backups is not inexpensive. I should know, I’ve researched it myself.

The extra 10-40k that you could spend getting software or a hardware device to do the encrypting could be spent on other projects and often is.

You also may have managers that aren’t info-security savvy that might not think that it’s a plausible risk.

Either way, it’s a very disturbing trend and I believe eventually there will be legislation in place that punishes companies when these types of things happen.

It happened in health care (HIPAA – I’m sure that Providence is paying the 250,000 fine) and it’ll happen in other industries too.

When real money is on the line, companies will start to listen.
carlos http://eddorre.com

Saturday January 28, 2006 23:47

admin
3
We actually had a mandatory 2-hour seminar at work a couple weeks ago about security. In our business, we maintain people’s credit cards by the millions. And there have been rare cases where someone has walked up to a hotel front desk and stolen the blasted server itself, which contains said credit cards. Most likely the thief wouldn’t know they’re on there or how to get access to them, but one of the changes we’re moving to is encryption of credit card numbers. This will ensure compliance with new regulations from Visa.
Robert http://www.osnr.org

Sunday January 29, 2006 11:35
4
Robert,

Considering the line of work that you are in and the data that you handle, I applaud their progressive thinking when it comes to security.

In response to your anecdote about stealing the server itself (which is hilarious) actually violates on the basic tenets of information security. If you have no physical security, then you have no security at all.

In that specific case, the thief might have just wanted the computer to re-sell for drugs or what not.

However as criminals start to wise up about how profitable identity theft is then you’ll actually start to see people steal, mug, maim, kill for those electronic records and they’ll certainly know some way to get the records off their if they are unencrypted or poorly encrypted.

Naturally, businesses have to step up and start acting to protect consumers before it gets to this level.
carlos http://eddorre.com

Wednesday February 01, 2006 22:18

admin

Comments are closed

Comments are closed on this post. If you have something on your mind regarding this post, don't hesitate to drop me a line.