<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: fidelity]]></title>
    <link>http://securityratty.com/tag/fidelity</link>
    <description></description>
    <pubDate>Sun, 16 Sep 2007 08:36:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Presbyterian Hospital admissions rep allegedly steals patient information]]></title>
      <link>http://securityratty.com/article/1472d3fd5c2c44e4a769e4ba5ada2c55</link>
      <guid>http://securityratty.com/article/1472d3fd5c2c44e4a769e4ba5ada2c55</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/12/08

Organization
Presbyterian Hospital/Weill Cornell Medical Center

Contractor/Consultant/Branch
None

Victims
Patients

Number Affected
Over...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/mcpherson.jpg" align="right" height="198" width="165"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/12/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.nyp.org/">Presbyterian Hospital/Weill Cornell Medical Center</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>Over 50,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, phone numbers and social security numbers of male patients between 58 and 78 years old"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"A former employee of the New York Presbyterian Hospital/Weill Cornell Medical College pleaded guilty on Friday to selling information from the personal records of over 50,000 patients."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://cornellsun.com/section/news/content/2008/04/14/former-med-college%E2%80%88employee-pleads-guilty-charges-identity-theft">The Cornell Daily Sun</a> <br><a href="http://m.nypost.com/ms/p/nyp/nyp/view.m?pid=23907&amp;storyid=106316">New York Post</a> <br><a href="http://www.upi.com/NewsTrack/Top_News/2008/04/12/new_york_40000_patients_records_stolen/7783/">United Press International</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>United Press International<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A former employee of the New York Presbyterian Hospital/Weill Cornell Medical College pleaded guilty on Friday to selling information from the personal records of over 50,000 patients.<br><span style="font-style: italic;">[Evan] According to this statement, he has already pleaded guilty.</span><br><br>After the hospital was made aware of the theft in January, it was confirmed in an internal investigation hospital spokeswoman Myrna Manners said.<br><br>"We obviously deeply regret that this has happened," she told the Times.<br><br>Dwight McPherson, the man arrested in connection with the crimes, was said to have been selling information since 2006, when he was approached with a request for the names, phone numbers and social security numbers of male patients between 58 and 78 years old.<br><span style="font-style: italic;">[Evan] He was approached rather than the other way around?&nbsp; This is interesting if it is true.&nbsp; It means that identity thieves (or those that trade in such information) are actively seeking out employees of organizations for sensitive personal information.&nbsp; This is an angle that I never really thought of, though in hindsight I should have.</span><br><br>McPherson's alleged scam was uncovered when postal inspectors in Atlanta executing a search warrant on an identity-theft operation there discovered 221 documents that had come from New York-Presbyterian Hospital.<br><br>Dwight McPherson, a 38-year-old patient-admissions representative from Brooklyn, admitted he began to access the files and sell information in early 2006<br><br>the information was used for identity theft<br><br>McPherson was released on Saturday under the condition that he not leave the state<br><br>McPherson was released on $500,000 bail<br><span style="font-style: italic;">[Evan] Whoa!&nbsp; Does this mean that he had to come up with $50,000 to post bail?&nbsp; I think you have to come up with 10% yourself.&nbsp; $50,000 is a lot of money for a "patient-admissions representative" to have lying around.</span><br><br>His lawyer, Bob Walters, defended his client, saying, "He is a hardworking, honest man,"<br><span style="font-style: italic;">[Evan] Uh, but he pleaded guilty to taking the easy way and committing fraud, right?</span><br><br>After looking through computer logs, they realized McPherson's user login had been used to improperly access the files of 49,841 patients.<br><br>McPherson most recently sold 1,000 records near the end of last year for about $750 and more records a bit later for $600.<br><br>Those whose identities have been stolen will receive a letter detailing what happened, and have access to a hotline with credit-monitoring services.<br><br><span style="font-weight: bold;">Commentary:</span><br>Of the 300 breaches reported thus far on <a href="http://breachblog.com">The Breach Blog</a>, this is the first one that I recall in which an outsider approached an employee for personal information.&nbsp; I have read about breaches where the employee approached and sold information to an intermediary or outsider (i.e. Fidelity/Certegy and William Sullivan), but not the other way around.&nbsp; This is interesting.<br><br>Mr. McPherson appears to have used his legitimate user account to access records in a manner for which he was not authorized.&nbsp; This activity can be difficult to detect without specialized controls.&nbsp; People that do bad things end up costing us all in the long run. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/14/mcpherson.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 14 Apr 2008 12:04:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/records">records</category>
      <category domain="http://securityratty.com/tag/access records">access records</category>
      <category domain="http://securityratty.com/tag/dwight mcpherson">dwight mcpherson</category>
      <category domain="http://securityratty.com/tag/mcpherson">mcpherson</category>
      <category domain="http://securityratty.com/tag/patients">patients</category>
      <category domain="http://securityratty.com/tag/male patients">male patients</category>
      <source url="http://breachblog.com/2008/04/14/mcpherson.aspx">Presbyterian Hospital admissions rep allegedly steals patient information</source>
    </item>
    <item>
      <title><![CDATA[Fiber: Review of Optics, Cables & Connectors]]></title>
      <link>http://securityratty.com/article/96dc850bc005748fcb2bba0b6554c568</link>
      <guid>http://securityratty.com/article/96dc850bc005748fcb2bba0b6554c568</guid>
      <description><![CDATA[When I started this blog, I said I wanted to give you useful information, sometimes in the form of lengthy technology overviews, and sometimes in short snippets. I like to dig around the search terms,...]]></description>
      <content:encoded><![CDATA[<p>When I started this blog, I said I wanted to give&nbsp;you useful information, sometimes in the form of lengthy technology overviews, and sometimes in short snippets. I like to dig around the search terms, comments and emails to see what you want to know more about, and I&#8217;ve seen a lot of interest in&nbsp;fiber information. </p><p>The fiber types (such as&nbsp;multi-mode, single-mode), standards (SX, LX, LH) and &nbsp;connectors (LC, ST, SC) seem to be a topics that need clarification about 80% of the time when we&#8217;re working with customers on networking equipment or site surveys. </p><p>Here&#8217;s a <strike>brief</strike> review of the various types of fiber, optics, connectors and when to use what. Let&#8217;s start with the basic stuff, and move down the line. </p><p><strong>Multi-mode vs Single-mode<br /></strong>First of all, we have multi-mode and single-mode fiber. <strong>Multimode</strong> has a larger diameter&nbsp;&#8216;core&#8217; or the area in the middle the light travels through. The larger diameter- think of it as a big tunnel- lets the light take different paths, creating multiple rays, or modes. The light bounces around more, which means the connectors and splices for multimode are more&nbsp;forgiving than for singlemode, but the bouncing causes&nbsp;dispersion&nbsp;and fidelity loss.&nbsp;On the other hand, <strong>singlemode</strong> has a much smaller diameter core, giving the light one straight path, or mode, through the cable. Because of this, singlemode offers higher throughput and longer distance, but the light equipment and connectors are much more finely-tuned. Which, of course, means singlemode is much more expensive. </p><p>When you&#8217;re adding or surveying multimode fiber, you should know what <strong>core size</strong> you&#8217;re working with. The core size affects bandwidth and the maximum distance you can reliably run it. Multimode usually comes in 50- or 62.5-micron, which is the core diameter.&nbsp;The larger the core size, the more bandwidth you get, but the shorter distance you&#8217; can go.&nbsp;To give you a general comparison, most singlemode comes in 9-micron core, which is about 1/6<sup>th</sup> the diameter of multimode. </p><p><u>When to use what</u>. In short, the fiber type you choose will depend on 1) budget and 2) distance. Mostly, you&#8217;ll use multimode for short fiber runs, between switches, to servers and possibly between buildings, if they&#8217;re adjacent. You should use singlemode when you need higher throughput or a longer distance. Here&#8217;s a quick look at the types and maximum distances for each.<em> I&#8217;ve also included a proprietary rating, for connectors using 1550nm wavelength over singlemode fiber, to get increased distance. (Standard for singlemode is 1310).</em></p><ul><li><div>Multimode - up to 220m&nbsp;with 62.5 micron core</div></li><li><div>Multimode - up to 550m with 50 micron core</div></li><li><div>Singlemode - up to 5km-10km <em>(standard, using 1310nm optics)</em></div></li><li><div>Singlemode - up to 70+km* <em>(proprietary,&nbsp;using 1550 nm optics)<br /></em></div></li></ul><p><strong>Fiber Optic Standards</strong> <br />You&#8217;ll need to know the type of optic to specify for your network equipment. Some vendors have their own proprietary fiber optics, but the standards are <strong>1000Base-SX</strong> for multimode, and <strong>1000Base-LX</strong> for singlemode. You can use multimode with 1000Base-LX with the addition of a mode-conditioning cable to set the light along the correct path down the cable. LX, which is standard, uses the ~1310nm wavelength. Vendors have created <strong>1000BASE-ZX</strong> and <strong>1000BASE-LH</strong>, which use the 1550nm optics to obtain longer distances. Note, here we&#8217;re talking about 1-Gig fiber, not 10GbE, hence the <em>1000Base</em>. We usually just refer to these as SX, LX and LH, leaving off the <em>1000Base</em>- when talking about the optics.</p><ul><li><div>1000Base-SX - multimode</div></li><li><div>1000Base-LX - singlemode standard<em> (can be used over MM with mode-conditioning cable)</em></div></li><li><div>1000Base-LH - singlemode non-standard <em>(proprietary for longer distances at 1550nm)</em></div></li></ul><p><strong>Connectors</strong><br />Here&#8217;s the fun part, and no one remembers what connectors they have (if they even knew in the first place!). There are several out there, but you&#8217;re probably going to only ever run into&nbsp;three&nbsp;- <strong>LC</strong>, <strong>ST</strong> and <strong>SC</strong>. </p><p>I&#8217;ll start with <strong>LC</strong> since that&#8217;s usually found on switches and other current network equipment these days. LC stands for &#8216;Lucent Connector&#8217; (the creator) and is&nbsp;the connection type&nbsp;on&nbsp;SFPs (Small Factor Pluggable) or Mini-GBICs. They&#8217;re small, and were designed to replace the SC connectors. </p><p>Since I mentioned <strong>SC</strong>, let&#8217;s go there next. SC, or &#8216;Standard Connector&#8217; are the predecessor to LC, and are similar in shape, but quite a bit larger. We suggest using the mnemonic &#8216;Square Connector&#8217; to remember SC. </p><p>Last- and possibly least- we have <strong>ST</strong>, which really means &#8216;Straight Tip&#8217;, but many folks have a better time thinking of &#8216;Stab and Twist&#8217;. You stick it in and lock it in place by turning the outer barrel, sort of like BNC did. <em>And yes, I&#8217;m old enough to remember the BNC days ;)</em></p><p><strong>Duplex and Simplex</strong><br />Most often, you&#8217;ll be using duplex fiber, which consists of a pair of fiber for bi-directional communication. Then- of course- you would use simplex fiber cables if you only need to send data a single direction. Those applications are more specific, but they do exist.</p><p><strong>Ordering Fiber Cables</strong><br />If we&#8217;re translating all our acronyms and numbers into something we can use, then let&#8217;s talk about how you put it all together when you&#8217;re procuring cables. </p><p><u>For example</u>, let&#8217;s say you&#8217;re purchasing short fiber jumpers for connecting your patch cable to your switch. Most likely, you&#8217;ll want multimode, in a short length (2meters), with LC on the end going to the switch and let&#8217;s say SC on your patch panel. In our example, we&#8217;re assuming we have 62.5micron mm fiber. </p><p><u>What you&#8217;ll ask for is</u>: Fiber jumper, 2 meters, duplex, 62.5-micron&nbsp;multimode, LC to SC. </p><table><tbody><tr><td><img style="width: 123px; height: 70px" alt="fiber_LC_2.jpg" src="http://www.securityuncorked.com/storage/fiber_LC_2.jpg" /></td><td><img style="width: 118px; height: 76px" alt="fiber_SC_2.jpg" src="http://www.securityuncorked.com/storage/fiber_SC_2.jpg" /></td><td><img style="width: 117px; height: 74px" alt="fiber_ST_2.jpg" src="http://www.securityuncorked.com/storage/fiber_ST_2.jpg" /></td></tr><tr><td><span class="sizeLess20">LC</span></td><td><span class="sizeLess20">SC</span></td><td><span class="sizeLess20">ST</span></td></tr></tbody></table><p><em>These are the best images I found to demonstrate the shapes and orientation of the various duplex fiber connectors we talked about. You can find these images and descriptions&nbsp;at </em><a class="offsite-link-inline" href="http://www.cablestogo.com/resources/fiber.asp" target="_blank"><em>Cables To Go</em></a><em>.</em></p><p>&nbsp;</p><p><strong>Wowzers</strong>, I said this was going to be a short one. In fact, this post was originally titled &#8220;<em>Fiber: A&nbsp;Very Brief Review of Cables&nbsp;&amp; Connectors</em>&#8221; but I had to rename it ;)&nbsp;Oh well- now you have all the information in one place for future reference. </p><p># # #</p>
]]></content:encoded>
      <pubDate>Fri, 04 Apr 2008 23:22:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cables">cables</category>
      <category domain="http://securityratty.com/tag/simplex fiber cables">simplex fiber cables</category>
      <category domain="http://securityratty.com/tag/fiber">fiber</category>
      <category domain="http://securityratty.com/tag/connectors">connectors</category>
      <category domain="http://securityratty.com/tag/fiber cables">fiber cables</category>
      <category domain="http://securityratty.com/tag/short fiber runs">short fiber runs</category>
      <category domain="http://securityratty.com/tag/short">short</category>
      <category domain="http://securityratty.com/tag/single-mode">single-mode</category>
      <category domain="http://securityratty.com/tag/single-mode fiber">single-mode fiber</category>
      <source url="http://www.securityuncorked.com/security-uncorked/2008/4/5/fiber-review-of-optics-cables-connectors.html">Fiber: Review of Optics, Cables &amp; Connectors</source>
    </item>
    <item>
      <title><![CDATA[51,000 Current and former Agilent Technologies employees at risk]]></title>
      <link>http://securityratty.com/article/7f98d0a3b5ecf0829f46d93469acf677</link>
      <guid>http://securityratty.com/article/7f98d0a3b5ecf0829f46d93469acf677</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
3/22/08

Organization
Agilent Technologies

Contractor/Consultant/Branch
Stock &amp; Options Solutions

Victims
Current and former Agilent employees

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/agilent.jpg" align="right" height="51" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>3/22/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.home.agilent.com/agilent/home.jspx?cc=US&amp;lc=eng&amp;cmpid=4533">Agilent Technologies</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.sos-team.com/">Stock &amp; Options Solutions</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Current and former Agilent employees<br><br><span style="font-weight: bold;">Number Affected:</span><br>51,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, Social Security numbers, home addresses and details of stock options and other stock-related awards"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"A laptop containing sensitive and unencrypted personal data on 51,000 current and former employees of Agilent Technologies was stolen from the car of an Agilent vendor March 1 in San Francisco, the company said in a letter mailed to former employees this week."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.mercurynews.com/peninsula/ci_8660115?nclick_check=1&amp;forced=true">The Mercury News - Silicon Valley</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Vindu Goel, The Mercury News<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>A laptop containing sensitive and unencrypted personal data on 51,000 current and former employees of Agilent Technologies was stolen from the car of an Agilent vendor March 1 in San Francisco, the company said in a letter mailed to former employees this week.<br><span style="font-style: italic;">[Evan] A person in the comments of Vindu's View From The Valley "</span><a style="font-style: italic;" href="http://www.mercextra.com/blogs/vindu/2008/03/21/agilent-alert-thief-steals-laptop-with-personal-info-on-51000-employees/">Agilent alert: Thief steals laptop with personal info on 51,000 employees</a><span style="font-style: italic;">" story claims "Estimates show that 700,000 laptops are stolen every year. A little more than 1900 a day!"&nbsp; This number seems high to me, but I guess I wouldn't be too surprised if it were true.&nbsp; Storing confidential information on laptops (especially without additional controls) is risky.</span><br><br>The data includes employee names, Social Security numbers, home addresses and details of stock options and other stock-related awards.<br><br>In the letter, Agilent blamed the San Jose vendor, Stock &amp; Option Solutions, for failing to scramble or otherwise safeguard the data - "in violation of the contracted agreement."<br><span style="font-style: italic;">[Evan] We don't often read about a company coming right out and blatantly pointing the finger at their vendor.&nbsp; I like the "call it like you see it" approach.</span><br><br>"It wasn't encrypted, which was a surprise to us," said Agilent spokeswoman Amy Flores. She said the vendor told Agilent that an East Coast employee had brought the data-laden laptop to California for encryption, but someone broke into her car and stole the computer and her other belongings while the vehicle was parked near Fisherman's Wharf.<br><span style="font-style: italic;">[Evan] #1, we (meaning information security personnel) should not be surprised by what our vendors are doing with the information we are charged with protecting.&nbsp; Not only should we mandate specific controls in policies and contracts, but we also need to audit for compliance.&nbsp; #2, The vendor employee was bringing the laptop to California for encryption?&nbsp; I don't think there are any requirements that you have to go to California to encrypt laptops.&nbsp; Encryption should have taken place prior to allowing the information on it in the first place, and better yet should be part of a "standard" laptop build.</span><br><br>Flores said Agilent, a Santa Clara maker of test and measurement equipment, has no evidence that the lost data has been used to steal anyone's identity. However, Agilent is offering affected employees one free year of credit monitoring from Equifax.<br><span style="font-style: italic;">[Evan] I haven't said this for a while, but credit "monitoring" is an after the fact solution that only alerts a person after they are an identity theft victim.&nbsp; One year of monitoring is good for monitoring information that is no longer useful after one year.&nbsp; Obviously a Social Security number will still be valid after the monitoring has ended.</span><br><br>Ironically, Stock &amp; Option Solutions was hired to make sure that money management firm Smith Barney had properly transferred employee stock data to a new management firm, Fidelity Investments, which had been hired to administer Agilent's stock programs.<br><br>Matt O'Brien of Milpitas, a former research manager at Agilent who left in 2001, said he was "disgusted" when he received notice of the theft in his Friday mail.<br><br>said O'Brien. "Agilent should have put all of the data into an encrypted format to begin with."<br><span style="font-style: italic;">[Evan] Bingo.&nbsp; A victim with more information security common sense than the offender.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>At what point do we no longer accept lost or stolen laptops with confidential personal information at risk?&nbsp; Are the myriad of laws, regulations, negative news reports, etc. having a positive impact in reducing the frequency and number of victims?&nbsp; Maybe it's too early to tell.<br><br>I am also curious what Agilent and/or Stock &amp; Options Solutions are planning in order to prevent similar circumstances in the future. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/03/25/agilent.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 25 Mar 2008 06:13:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/agilent">agilent</category>
      <category domain="http://securityratty.com/tag/agilent technologies">agilent technologies</category>
      <category domain="http://securityratty.com/tag/agilent vendor march">agilent vendor march</category>
      <category domain="http://securityratty.com/tag/vendor">vendor</category>
      <category domain="http://securityratty.com/tag/administer agilent">administer agilent</category>
      <category domain="http://securityratty.com/tag/agilent alert">agilent alert</category>
      <category domain="http://securityratty.com/tag/agilent employees">agilent employees</category>
      <category domain="http://securityratty.com/tag/stock">stock</category>
      <category domain="http://securityratty.com/tag/stock options">stock options</category>
      <source url="http://breachblog.com/2008/03/25/agilent.aspx">51,000 Current and former Agilent Technologies employees at risk</source>
    </item>
    <item>
      <title><![CDATA[Five data leak nightmares]]></title>
      <link>http://securityratty.com/article/49469a47a7014ea98c21e04dc0454e95</link>
      <guid>http://securityratty.com/article/49469a47a7014ea98c21e04dc0454e95</guid>
      <description><![CDATA[When Home Depot lost a laptop containing personal information on 10,000 employees, it was just the latest in a string of high-profile data-leak incidents. The Veterans Administration, TJX,...]]></description>
      <content:encoded><![CDATA[When Home Depot lost a laptop containing personal information on 10,000 employees, it was just the latest in a string of high-profile data-leak incidents. The Veterans Administration, TJX, Monster.com, Fidelity National Information Services, Pfizer, AOL, Ameritrade – the list goes on and on.]]></content:encoded>
      <pubDate>Sun, 06 Jan 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/home depot lost">home depot lost</category>
      <category domain="http://securityratty.com/tag/high-profile data-leak incidents">high-profile data-leak incidents</category>
      <category domain="http://securityratty.com/tag/veterans administration">veterans administration</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/aol">aol</category>
      <category domain="http://securityratty.com/tag/employees">employees</category>
      <category domain="http://securityratty.com/tag/ameritrade">ameritrade</category>
      <category domain="http://securityratty.com/tag/pfizer">pfizer</category>
      <source url="http://www.networkworld.com/research/2008/010708-data-leak-nightmares.html?fsrc=rss-security">Five data leak nightmares</source>
    </item>
    <item>
      <title><![CDATA[Skipton Financial Services personal customer data on stolen laptop]]></title>
      <link>http://securityratty.com/article/c0527c011e51afeb9dc52bc4f5239096</link>
      <guid>http://securityratty.com/article/c0527c011e51afeb9dc52bc4f5239096</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
12/21/07 (backdated from writing of 1/4/08

Organization
Skipton Building Society

Contractor/Consultant/Branch
Skipton Financial Services (SFS
Moore...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/sfs.jpg" align="right" height="72" width="153">
<font size="2"><span style="font-weight: bold;">Date Reported: </span><br>12/21/07 (backdated from writing of 1/4/08)<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.skipton.co.uk/default.aspx" target="_blank"> Skipton Building Society</a><br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.skiptonfs.co.uk/" target="_blank"> Skipton Financial Services (SFS)</a><br><a href="http://www.moorestephens.co.uk/" target="_blank"> Moore Stephens Consulting</a><br><br><span style="font-weight: bold;">Victims:</span><br>Skipton clients with money invested in the Fidelity FundsNetwork<br><br><span style="font-weight: bold;">Number Affected:</span><br>Up to 14,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, addresses, dates of birth, National Insurance numbers*, and fund investment details including how much was invested.<br><br><font size="1">*~equivalent to Social Security numbers in US</font><br><br><span style="font-weight: bold;">Breach Description:</span><br>A laptop computer was stolen from a locker being used by a Moore Stevens Consulting employee that contained sensitive personal information belonging to as many as 14,000 Skipton Financial Services (SFS) clients who had invested money in the Fidelity FundsNetwork.&nbsp; Moore Stevens Consulting was on contract with SFS at the time of the theft.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.yorkshirepost.co.uk/news/Computer-theft-puts-14000-at.3611872.jp" target="_blank"> Yorkshire Post Story</a> <br><a href="http://www.theregister.co.uk/2007/12/21/skipton_data_security_breach/" target="_blank"> The Register</a> <br><a href="http://attrition.org/dataloss/2007/12/skipton01.html" target="_blank"> Attrition.org Data Loss Archive</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Rowena Mason, Yorkshire Post via Attrition.org<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Up to 14,000 customers of the financial giant Skipton have been left open to identity fraud, after the company admitted that a laptop containing customers' personal details was stolen<br><br>Investors with money in the Fidelity FundsNetwork were told yesterday that the stolen information includes names, addresses, date of birth, National Insurance numbers, fund investment details – and even how much each person had invested.<br><br>the laptop was taken from a locker being used by a staff member of an information technology (IT) consultancy employed by Skipton Financial Services.<br><br>Moore Stephens Consulting was carrying out work on an IT system for the Yorkshire-based investment company when the theft took place<br><span style="font-style: italic;">[Evan] An IT consultant should know better than to store confidential information on a laptop without encryption.</span><br><br>Last night a Skipton spokesman stressed that the laptop was password-protected and all affected accounts with Skipton Financial Services had been immediately suspended.<br><span style="font-style: italic;">[Evan] Password protection is NOT adequate protection, and suspending the account does nothing to protect victims against identity theft.&nbsp; Does suspending the account provide any protection?</span><br><br>Managing director Simon Holt wrote to all 14,000 customers apologising for the breach of security and assuring them that an investigation had been launched.<br><br>Mr Holt yesterday denied that his company had any responsibility for the loss of the laptop and said every possible step had been taken to reduce risk to clients.<br><span style="font-style: italic;">[Evan] I respectfully disagree with Mr. Holt.&nbsp; Organizations must hold their vendors, consultants, and contractors to the same security standards as those used within the organization.&nbsp; Customers (data owners) gave Skipton the information and Skipton is responsible for it until it is destroyed.&nbsp; No passing the buck allowed.</span><br><br>Skipton Financial Services told their customers about the missing data after advice from the Information Commissioner's Office<br><br>The managing partner of Moore Stephens, Colin Moore, said his firm was doing everything it could to protect data and review security procedures.<br><span style="font-style: italic;">[Evan] Moore Stephens did not do "everything it could to protect data".</span><br><br>A helpline for people whose details might have been taken is open from 8am to 8pm Monday to Friday on 0800 137832.<br><br><span style="font-weight: bold;">Commentary:</span><br>More stolen laptops with confidential information without protection equals more victims.&nbsp; What torques me more about this breach is the fact that an IT consultant was partly to blame.&nbsp; An organization pays a consultant because they believe that the consultant is an expert and knows how to do work at a high-level.<br><br>I am a consultant and look, my laptop is encrypted... <img src="http://breachblog.com/emoticons/wink.png" border="0" /><br><br><img src="http://images.quickblogcast.com/95781-88451/psenc.jpg" border="0" width="509"><br><br>Organizations that employ consultants which access confidential information resources MUST ensure that the consultants follow proper information security policies and procedures.&nbsp; This is accomplished through the creation of a Vendor/Third-Party Security Policy, thorough evaluation before a contract is signed, adding information security language to the contract, and regular reviews of the consultant's information security practices throughout the life of the contract. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2007/12/21/sfs.aspx" type="text/javascript" charset="utf-8"></script>
<br>
<br>
<script type="text/javascript"><!--
google_ad_client = "pub-4721162729073131";
google_ad_width = 468;
google_ad_height = 60;
google_ad_format = "468x60_as";
google_ad_type = "text_image";
google_ad_channel = "";
//-->
</script>
<script type="text/javascript">
</script>]]></content:encoded>
      <pubDate>Fri, 04 Jan 2008 19:21:58 +0000</pubDate>
      <category domain="http://securityratty.com/tag/skipton">skipton</category>
      <category domain="http://securityratty.com/tag/information includes names">information includes names</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security practices">information security practices</category>
      <category domain="http://securityratty.com/tag/skipton financial services">skipton financial services</category>
      <category domain="http://securityratty.com/tag/financial giant skipton">financial giant skipton</category>
      <category domain="http://securityratty.com/tag/store confidential information">store confidential information</category>
      <category domain="http://securityratty.com/tag/skipton spokesman">skipton spokesman</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <source url="http://breachblog.com/2007/12/21/sfs.aspx">Skipton Financial Services personal customer data on stolen laptop</source>
    </item>
    <item>
      <title><![CDATA[Some Yahoo! employees exposed through mistaken email]]></title>
      <link>http://securityratty.com/article/399de510c3b1f3c4db700ba509dc3a8d</link>
      <guid>http://securityratty.com/article/399de510c3b1f3c4db700ba509dc3a8d</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
11/30/07

Organization
Yahoo! Corporation

Contractor/Consultant/Branch
Fidelity Investments

Victims
Persons participating in the Yahoo! employee stock...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/yahoofidelity.jpg" align="right" height="73" width="146"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>11/30/07<br><br><span style="font-weight: bold;">Organization: </span><br>Yahoo! Corporation<br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>Fidelity Investments<br><br><span style="font-weight: bold;">Victims:</span><br>Persons participating in the Yahoo! employee stock purchase plan<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>First name, last name, Social Security number and Yahoo! employee ID number.<br><br><span style="font-weight: bold;">Breach Description:</span><br>On November 12th, 2007 Fidelity Investments inadvertently emailed a file containing personal information pertaining to Yahoo! employee stock purchase plan participants to the wrong company.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://doj.nh.gov/consumer/pdf/fidelity2.pdf" target="_blank"> The State of New Hampshire Attorney General breach notification</a><br><br><span style="font-weight: bold;">Report Credit:</span><br>The New Hampshire State Attorney<br><br><span style="font-weight: bold;">Response:</span><br>From the State of New Hampshire official breach notification and letter sent to victims:<br><br>Fidelity Investments on behalf of Yahoo Corporation is reporting an incident involving the brief, inadvertent disclosure by Fidelity of some information relating to Yahoo employees.<br><span style="font-style: italic;">[Evan] I am uncomfortable with the word "brief" when referring to a disclosure. Disclosed information is always disclosed, but I understand what Fidelity means in this context.&nbsp; You can't un-disclose information.</span><br><br>We are writing to notify you of a recent issue that involved some personal information about you maintained by Fidelity Stock Plan Services (Fidelity SPS), the administrative service provider and recordkeeper of Yahoo!'s employee stock purchase plan.<br><br>Fidelity inadvertently disclosed by e-mail a file containing personal information to two stock plan administrators at another Fidelity Investments client.<br><span style="font-style: italic;">[Evan] The notice does not inform the reader whether or not emails containing sensitive information are encrypted.</span><br><br>The e-mail contained names, Social Security numbers, and employee stock plan purchase information.<br><br>The incident occurred on November 12 and a determination that there had been inadvertent disclosure on November 14.<br><br>The individual who received the file, briefly viewed it and then sent it to another authorized plan administrator at the same company who never opened the email of viewed the file.<br><span style="font-style: italic;">[Evan] I wonder why the first administrator thought to send it on to another.</span><br><br>The company quickly notified Fidelity SPS of this matter.<br><br>The inadvertent recipients have deleted the e-mail and have confirmed that the file has been deleted and that the information has not been copied, printed, or downloaded.<br><br>Both plan administrators signed and delivered to Fidelity SPS a statement, confirming the facts described above and promising to maintain the confidentiality of any information that may have been viewed.<br><span style="font-style: italic;">[Evan] I'm not sure what else can be done after the fact.</span><br><br>At this time, we are not aware of any misuse of this information.&nbsp; Based on our review of the circumstances and the limited nature of the disclosure, we do not believe there is a significant risk of misuse of this information resulting from this disclosure.<br><br>Fidelity Investments has taken steps to further strengthen our controls to help prevent this from recurring.<br><br>Fidelity Investments is notifying potentially affected Yahoo employees, by e0mail on November 29 and by U.S. mail on November 30.<br><br>We deeply regret any inconvenience or concern this may have caused.&nbsp; if you have any questions about this matter, please feel free to call a Fidelity Stock Plan Services Representative at 800-544-9354.&nbsp; We are available from Sunday at 5:00 p.m. ET through Friday midnight ET.<br><br>Although this was Fidelity SPS's error, we at Yahoo! want to ensure that any questions or concerns you have about this event are being adequately addressed.&nbsp; If Fidelity SPS's representatives have not adequately addressed your concerns, please let us know by emailing stockadmin@yahoo-inc.com<br><br><span style="font-weight: bold;">Commentary:</span><br>It sounds like this is a human error.&nbsp; Information security breaches resulting from human error are one of the most (if not the most) challenging to protect against.&nbsp; Us humans often have other things on our mind.&nbsp; It appears as though Fidelity responded well to the incident, and I agree with their risk assessment (on this incident).<br><br>I do not know their internal procedures for sending this information so it is difficult to comment on.&nbsp; A couple of questions that I don't feel comfortable about are<br></font><ol><li><font size="2">Do Social Security numbers really need to be in the files that are sent to plan administrators?</font></li><li>If so, are they sent through normal email channels?<br></li></ol><font size="2"><br>People who don't know, need to understand that standard email is "clear-text" communication.&nbsp; Anyone from you to the recipient can intercept and read the contents of the email.&nbsp; <br><br>To demonstrate, let's say that I am sending my online bank password to my wife via email, to her Google email account, Gmail (a no-no, but a demo nonetheless).&nbsp; My network administrator, my email administrator, various engineers at our internet service provider (ISP), various engineers at other internet service providers between my ISP and Google, various engineers at Google, various other engineers between Google and my wife's ISP, and various engineers at my wife's ISP could all intercept the message and read the contents.&nbsp; I am not going to say that this happens or has happened, but the very real risk exists.&nbsp; There are many other secure alternatives, one of which is encrypted email. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown at Fidelity Investments or Yahoo!<br>Muliple for other Fidelity organizations.</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2007/12/12/yahoofidelity.aspx" type="text/javascript" charset="utf-8"></script>
<br>
<br>
<script type="text/javascript"><!--
google_ad_client = "pub-4721162729073131";
google_ad_width = 468;
google_ad_height = 60;
google_ad_format = "468x60_as";
google_ad_type = "text_image";
google_ad_channel = "";
//-->
</script>
<script type="text/javascript">
</script>]]></content:encoded>
      <pubDate>Wed, 12 Dec 2007 12:11:31 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fidelity investments">fidelity investments</category>
      <category domain="http://securityratty.com/tag/fidelity">fidelity</category>
      <category domain="http://securityratty.com/tag/fidelity inadvertently">fidelity inadvertently</category>
      <category domain="http://securityratty.com/tag/fidelity investments client">fidelity investments client</category>
      <category domain="http://securityratty.com/tag/email">email</category>
      <category domain="http://securityratty.com/tag/fidelity investments inadvertently">fidelity investments inadvertently</category>
      <category domain="http://securityratty.com/tag/yahoo">yahoo</category>
      <category domain="http://securityratty.com/tag/administrator">administrator</category>
      <category domain="http://securityratty.com/tag/email administrator">email administrator</category>
      <source url="http://breachblog.com/2007/12/12/yahoofidelity.aspx">Some Yahoo! employees exposed through mistaken email</source>
    </item>
    <item>
      <title><![CDATA[Why Don't Financial Institutions Have Vulnerability Reporting Policies Online?]]></title>
      <link>http://securityratty.com/article/895097ff747f8671a5ebb67967302e7e</link>
      <guid>http://securityratty.com/article/895097ff747f8671a5ebb67967302e7e</guid>
      <description><![CDATA[You may remember I did a bit on vulnerability reporting policies a little while ago. I was interested in crafting a vulnerability disclosure policy that was responsible both for the company posting...]]></description>
      <content:encoded><![CDATA[You may remember I did <a href="http://securityretentive.blogspot.com/2007/07/security-reporting-policies-that.html">a bit </a>on vulnerability reporting policies a little while ago.  I was interested in crafting a vulnerability disclosure policy that was responsible both for the company posting it, security researchers, but also took into account the liability issues surrounding security researchers testing web applications.<br /><br />In my previous piece I pulled together a quick summary of the public-facing security reporting policies (or lack thereof) for a number of big sites on the web.  Recently I started doing the same for financial institutions.  I tried finding disclosure policies online for major financial institutions such as Citibank, Wells Fargo, Washington Mutual, Chase, Fidelity, etc.  I was unable to find a externally accessible security reporting/disclosure policy for any of the major financial institutions I looked at.<br /><br />Why is that?<br /><ul><li>Fear that a disclosure policy makes it look like they could have a security issue?</li><li>Worried about too many people contacting them about bogus issues?</li><li>They don't want to be the first to publish one?</li></ul>I'm not suggesting that everyone ought to follow the <a href="http://ha.ckers.org/RSPolicy/">RSPolicy</a> but maybe they ought to have something online rather than nothing?<img src="http://feeds.feedburner.com/~r/SecurityRetentive/~4/157304493" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sun, 16 Sep 2007 08:36:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/financial institutions">financial institutions</category>
      <category domain="http://securityratty.com/tag/online">online</category>
      <category domain="http://securityratty.com/tag/vulnerability disclosure policy">vulnerability disclosure policy</category>
      <category domain="http://securityratty.com/tag/disclosure policy">disclosure policy</category>
      <category domain="http://securityratty.com/tag/policies">policies</category>
      <category domain="http://securityratty.com/tag/vulnerability">vulnerability</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security researchers">security researchers</category>
      <category domain="http://securityratty.com/tag/major financial institutions">major financial institutions</category>
      <source url="http://feeds.feedburner.com/~r/SecurityRetentive/~3/157304493/why-dont-financial-institutions-have.html">Why Don't Financial Institutions Have Vulnerability Reporting Policies Online?</source>
    </item>
  </channel>
</rss>
