<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: identifiable]]></title>
    <link>http://securityratty.com/tag/identifiable</link>
    <description></description>
    <pubDate>Mon, 09 Jun 2008 09:38:01 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Massachusetts issues new rules for businesses to protect personally identifiable information, Congress considers FISMA reform]]></title>
      <link>http://securityratty.com/article/c616e19ff2bc5cc2ee14dfdb4cc8b4d5</link>
      <guid>http://securityratty.com/article/c616e19ff2bc5cc2ee14dfdb4cc8b4d5</guid>
      <description><![CDATA[As reported in the Boston Globe on September 23rd, the Massachusetts Office of Consumer Affairs and Business Regulation issued regulations earlier this week that will place new requirements on...]]></description>
      <content:encoded><![CDATA[<p>As <a title="http://www.boston.com/business/articles/2008/09/23/tougher_consumer_data_rule_adopted/" href="http://www.boston.com/business/articles/2008/09/23/tougher_consumer_data_rule_adopted/">reported   in the Boston Globe</a> on September 23rd, the <a title="http://www.mass.gov/?pageID=ocahomepage&amp;L=1&amp;sid=Eoca&amp;L0=Home" href="http://www.mass.gov/?pageID=ocahomepage&amp;L=1&amp;sid=Eoca&amp;L0=Home">Massachusetts   Office of Consumer Affairs and Business Regulation</a>&nbsp;issued <a title="http://www.mass.gov/?pageID=ocamodulechunk&amp;L=1&amp;L0=Home&amp;sid=Eoca&amp;b=terminalcontent&amp;f=idtheft_201cmr17&amp;csid=Eoca" href="http://www.mass.gov/?pageID=ocamodulechunk&amp;L=1&amp;L0=Home&amp;sid=Eoca&amp;b=terminalcontent&amp;f=idtheft_201cmr17&amp;csid=Eoca">regulations</a> earlier this week that will place <B>new requirements on businesses to safeguard   personally-identifiable   information (PII)...</b>]]></content:encoded>
      <pubDate>Wed, 24 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/businesses">businesses</category>
      <category domain="http://securityratty.com/tag/massachusetts office">massachusetts office</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/september 23rd">september 23rd</category>
      <category domain="http://securityratty.com/tag/consumer affairs">consumer affairs</category>
      <category domain="http://securityratty.com/tag/business regulation">business regulation</category>
      <category domain="http://securityratty.com/tag/boston globe">boston globe</category>
      <category domain="http://securityratty.com/tag/pii">pii</category>
      <category domain="http://securityratty.com/tag/week">week</category>
      <source url="http://www.rsa.com/blog/blog_entry.aspx?id=1353">Massachusetts issues new rules for businesses to protect personally identifiable information, Congress considers FISMA reform</source>
    </item>
    <item>
      <title><![CDATA[Regulatory compliance tops issues facing IT managers]]></title>
      <link>http://securityratty.com/article/1d703bf042558930c5b431c93a08fbad</link>
      <guid>http://securityratty.com/article/1d703bf042558930c5b431c93a08fbad</guid>
      <description><![CDATA[Regulatory compliance will be the top business and technology issue facing IT managers and executives worldwide in the next 12 to 18 months, with a major emphasis on protecting personally identifiable...]]></description>
      <content:encoded><![CDATA[Regulatory compliance will be the top business and technology issue facing IT managers and executives worldwide in the next 12 to 18 months, with a major emphasis on protecting personally identifiable information (PII) and transaction monitoring.]]></content:encoded>
      <pubDate>Mon, 04 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/regulatory compliance">regulatory compliance</category>
      <category domain="http://securityratty.com/tag/executives worldwide">executives worldwide</category>
      <category domain="http://securityratty.com/tag/top business">top business</category>
      <category domain="http://securityratty.com/tag/technology issue">technology issue</category>
      <category domain="http://securityratty.com/tag/managers">managers</category>
      <category domain="http://securityratty.com/tag/major emphasis">major emphasis</category>
      <category domain="http://securityratty.com/tag/identifiable information">identifiable information</category>
      <category domain="http://securityratty.com/tag/pii">pii</category>
      <category domain="http://securityratty.com/tag/transaction">transaction</category>
      <source url="http://www.networkworld.com/news/2008/080508-regulatory-compliance-tops-issues-facing.html?fsrc=rss-security">Regulatory compliance tops issues facing IT managers</source>
    </item>
    <item>
      <title><![CDATA[Gonzo: Two Thumbs In and Up]]></title>
      <link>http://securityratty.com/article/6853c438c7bef73e63a300124d9cf5de</link>
      <guid>http://securityratty.com/article/6853c438c7bef73e63a300124d9cf5de</guid>
      <description><![CDATA[Just saw the Hunter S. Thompson movie - Gonzo , and if you are a fan you should to. Lots of good stuff in there, the film links various part of his life and career, and gives a pretty unvarnished view...]]></description>
      <content:encoded><![CDATA[<p><a href="http://en.wikipedia.org/wiki/Hunter_S._Thompson"></a><a style="float: left;" href="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553c045c48834-pi"><img  class="at-xid-6a00d83451c75869e200e553c045c48834 " alt="180px-Gonzo_citation" src="http://1raindrop.typepad.com/.a/6a00d83451c75869e200e553c045c48834-320wi" style="margin: 0px 5px 5px 0px;"></a> Just saw the Hunter S. Thompson movie - <a href="http://www.rottentomatoes.com/m/gonzo_the_life_and_work_of_dr_hunter_s_thompson/">Gonzo</a>, and if you are a fan you should to. Lots of good stuff in there, the film links various part of his life and career, and gives a pretty unvarnished view of the high highs and the low lows. Weaves in writing, politics, and fame seamlessly.

I have never really had as much fun as early on in my career in the early-mid 90s I was a web programmer in Aspen, hacking CGI/PERL. Among the most fun things was building and running HST's site. My boss, Ed, was his neighbor. Ed was also seriously allergic to bees. One day he was alone in his house and got stung. He was dying. Luckily Hunter was due over to his house to watch a basketball game, walked in and called 911. My boss woke up in the ambulance with Hunter pounding on him chest and screaming at him. Ed said - "Waking up to that face screaming at me, I didn't know if I was alive or dead."

Seeing the movie it was also great to see a lot of the Woody Creek folks again like George Stranahan, who lovingly said about Hunter - "my friend and neighbor who never paid his rent, broke up my marriage and taught my children to smoke dope. "

Of course, there was no way he could match his early productivity and this is true of almost all artists. Most of the last two decades were wasted from a writing standpoint. However his <a href="http://proxy.espn.go.com/espn/page2/story?id=1250751">piece</a> written on 9/11 is as good as its gets:

</p><blockquote><p>
	The towers are gone now, reduced to bloody rubble, along with all hopes for Peace in Our Time, in the United States or any other country. Make no mistake about it: We are At War now -- with somebody -- and we will stay At War with that mysterious Enemy for the rest of our lives. 	
	</p></blockquote><blockquote><p>It will be a Religious War, a sort of Christian Jihad, fueled by religious hatred and led by merciless fanatics on both sides. It will be guerilla warfare on a global scale, with no front lines and no identifiable enemy. Osama bin Laden may be a primitive "figurehead" -- or even dead, for all we know -- but whoever put those All-American jet planes loaded with All-American fuel into the Twin Towers and the Pentagon did it with chilling precision and accuracy. The second one was a dead-on bullseye. Straight into the middle of the skyscraper. 	
	</p></blockquote><blockquote><p>Nothing -- even George Bush's $350 billion "Star Wars" missile defense system -- could have prevented Tuesday's attack, and it cost next to nothing to pull off. Fewer than 20 unarmed Suicide soldiers from some apparently primitive country somewhere on the other side of the world took out the World Trade Center and half the Pentagon with three quick and costless strikes on one day. The efficiency of it was terrifying. 	
	</p></blockquote><blockquote><p>We are going to punish somebody for this attack, but just who or what will be blown to smithereens for it is hard to say. Maybe Afghanistan, maybe Pakistan or Iraq, or possibly all three at once. Who knows? Not even the Generals in what remains of the Pentagon or the New York papers calling for WAR seem to know who did it or where to look for them. 	
	</p></blockquote><blockquote><p>This is going to be a very expensive war, and Victory is not guaranteed -- for anyone, and certainly not for anyone as baffled as George W. Bush. All he knows is that his father started the war a long time ago, and that he, the goofy child-President, has been chosen by Fate and the global Oil industry to finish it Now. He will declare a National Security Emergency and clamp down Hard on Everybody, no matter where they live or why. If the guilty won't hold up their hands and confess, he and the Generals will ferret them out by force. 	
	</p></blockquote><blockquote><p>Good luck. He is in for a profoundly difficult job -- armed as he is with no credible Military Intelligence, no witnesses and only the ghost of Bin Laden to blame for the tragedy.
	
</p></blockquote><p>


One unintended lesson I take away from Hunter's life is how important patience is. Obama is a politician and may yet disappoint us all, but I gotta believe Hunter would be seriously impressed. If he had waited another couple of years, he may have seen a lot of the stuff he fought for in 1968 and 72 come to fruition. Sometimes you are just 36-40 years ahead of your time and you have to be ok with that and figure out how to deal if possible. (Note - it sure sometimes feels this way in software security).

Speaking of security:

</p><blockquote>
	<p><a href="http://www.ram.org/contrib/security.html">Security</a> 	
	</p></blockquote><blockquote><p>by Hunter S. Thompson (1955). 	
	</p></blockquote><blockquote><p>Security ... what does this word mean in relation to life as we know it today? For the most part, it means safety and freedom from worry. It is said to be the end that all men strive for; but is security a utopian goal or is it another word for rut? 	
	</p></blockquote><blockquote><p>Let us visualize the secure man; and by this term, I mean a man who has settled for financial and personal security for his goal in life. In general, he is a man who has pushed ambition and initiative aside and settled down, so to speak, in a boring, but safe and comfortable rut for the rest of his life. His future is but an extension of his present, and he accepts it as such with a complacent shrug of his shoulders. His ideas and ideals are those of society in general and he is accepted as a respectable, but average and prosaic man. But is he a man? has he any self-respect or pride in himself? How could he, when he has risked nothing and gained nothing? What does he think when he sees his youthful dreams of adventure, accomplishment, travel and romance buried under the cloak of conformity? How does he feel when he realizes that he has barely tasted the meal of life; when he sees the prison he has made for himself in pursuit of the almighty dollar? If he thinks this is all well and good, fine, but think of the tragedy of a man who has sacrificed his freedom on the altar of security, and wishes he could turn back the hands of time. A man is to be pitied who lacked the courage to accept the challenge of freedom and depart from the cushion of security and see life as it is instead of living it second-hand. Life has by-passed this man and he has watched from a secure place, afraid to seek anything better What has he done except to sit and wait for the tomorrow which never comes? 	
	</p></blockquote><blockquote><p>Turn back the pages of history and see the men who have shaped the destiny of the world. Security was never theirs, but they lived rather than existed. Where would the world be if all men had sought security and not taken risks or gambled with their lives on the chance that, if they won, life would be different and richer? It is from the bystanders (who are in the vast majority) that we receive the propaganda that life is not worth living, that life is drudgery, that the ambitions of youth must he laid aside for a life which is but a painful wait for death. These are the ones who squeeze what excitement they can from life out of the imaginations and experiences of others through books and movies. These are the insignificant and forgotten men who preach conformity because it is all they know. These are the men who dream at night of what could have been, but who wake at dawn to take their places at the now-familiar rut and to merely exist through another day. For them, the romance of life is long dead and they are forced to go through the years on a treadmill, cursing their existence, yet afraid to die because of the unknown which faces them after death. They lacked the only true courage: the kind which enables men to face the unknown regardless of the consequences. 	
	</p></blockquote><blockquote><p>As an afterthought, it seems hardly proper to write of life without once mentioning happiness; so we shall let the reader answer this question for himself: who is the happier man, he who has braved the storm of life and lived or he who has stayed securely on shore and merely existed?
</p></blockquote><p>

A ship is safest at port, but thats not why we build ships. 
</p>]]></content:encoded>
      <pubDate>Thu, 17 Jul 2008 06:10:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/life">life</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/sought security">sought security</category>
      <category domain="http://securityratty.com/tag/personal security">personal security</category>
      <category domain="http://securityratty.com/tag/national security emergency">national security emergency</category>
      <category domain="http://securityratty.com/tag/software security">software security</category>
      <category domain="http://securityratty.com/tag/expensive war">expensive war</category>
      <category domain="http://securityratty.com/tag/war">war</category>
      <category domain="http://securityratty.com/tag/hunter">hunter</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/07/gonzo-two-thumbs-in-and-up.html">Gonzo: Two Thumbs In and Up</source>
    </item>
    <item>
      <title><![CDATA[A backup tape is stolen from Greensboro Gynecology Associates]]></title>
      <link>http://securityratty.com/article/50667ca11f139e2009a7776a17ed3db5</link>
      <guid>http://securityratty.com/article/50667ca11f139e2009a7776a17ed3db5</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/15/08

Organization
Greensboro Gynecology Associates

Contractor/Consultant/Branch
None

Victims
Physicians, staff members, and patients

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/gga.jpg" width="70" align="right" height="70"><font size="2"><b>Date Reported: </b><br>7/15/08<br><br><b>Organization: </b><br><a href="http://www.greensborogynassoc.medem.com/">Greensboro Gynecology Associates</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Physicians, staff members, and patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, addresses, Social Security numbers, employers, insurance companies, policy numbers and family members"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"GREENSBORO - Patients at a Greensboro doctors’ office have been notified that their personal information - including Social Security numbers and addresses - was stolen in May."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.news-record.com/content/2008/07/15/article/security_breach_puts_patients_of_greensboro_gynecology_at_risk">News &amp; Record</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Ryan Seals, News &amp; Record<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>In a letter mailed to patients, Greensboro Gynecology Associates said a backup tape of their computer database was stolen.<br><span style="font-style: italic;">[Evan] Does "their computer database" include billing information and other confidential information other than personally identifiable information?</span><br style="font-style: italic;"><br>The letter was dated June 16, but some letters weren't postmarked until July 9.<br><br>The medical practice said a backup tape of patient information was stolen on May 29 from an employee who was taking the tape to an off-site storage facility for safekeeping.<br><span style="font-style: italic;">[Evan] I wonder what type of off-site storage facility.&nbsp; Some of the small businesses that I have encountered consider an employee's home to be an "off-site" storage facility.</span><br style="font-style: italic;"><br>The stolen information included patients' name, address, Social Security number, employer, insurance company, policy numbers and family members.<br><br>The tape did not include treatment or specific medical data.<br><br>"We are very concerned about this theft, as we too are victims," Pat Higgins, the practice's administrator, wrote in an e-mail Tuesday. "We are notifying our present and former patients. ..."<br><br>The practice at 719 Green Valley Road Suite 305 said personal information for its physicians and other staff members also was on the stolen tape.<br><br>the case is under investigation<br><br>did not respond to inquiries about how many patients were affected, how the theft occurred and whether anything else was taken<br><br>The practice's letter said the theft had been reported to police. However, officials with the Greensboro Police Department and the Guilford County Sheriff's Office said they had no such report on file.<br><span style="font-style: italic;">[Evan] This is interesting news.</span><br><br>The data was not encrypted, but Greensboro Gynecology Associates said the stolen data isn't likely to be accessed.<br><br>"We have consulted with several computer security experts, and they have advised it is highly unlikely the tapes can be accessed because of the program used and the language (the information) is written in," according to a recording on a hotline set up to address patients' concerns.<br><span style="font-style: italic;">[Evan] Who are these several computer security "experts'?&nbsp; I hate to disagree, but...&nbsp; The assessment is based on "the program used and the language" that the archived information is written in.&nbsp; Really?&nbsp; How hard is it to obtain the necessary hardware and software to access the information?&nbsp; Someone interested in accessing the tape could conceivably flip the data protection tab on the tape (to prevent data corruption through inadvertent writes), download some of the more popular backup software programs, buy a compatible drive (stolen or on eBay), and go to town.&nbsp; Couldn't they?&nbsp; Backup Exec is a very popular backup program.&nbsp; Anyone can download a 60-day trial for free.&nbsp; More talented professionals have even more sophisticated methods of accessing data on tape. </span><br style="font-style: italic;"><br>Greensboro Gynecology Associates said they are consulting with computer security experts to prevent similar thefts in the future.<br><span style="font-style: italic;">[Evan] I kind of hope that they are not consulting with the same computer security "experts" referenced above.</span><br style="font-style: italic;"><br>"We sincerely regret and apologize that this incident occurred," the letter said<br><br><span style="font-weight: bold;">Commentary:</span><br>Many backup software solutions include the option to encrypt the written data built-in.&nbsp; Why not use it?<br><br>Greensboro Gynecology Associates has established a hotline for concerned patients.&nbsp; The phone number is (336) 544-4590.&nbsp;&nbsp; The hotline asks patients to leave their name and telephone number for a staff member to return their call. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/16/gga.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 16 Jul 2008 12:16:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/greensboro gynecology">greensboro gynecology</category>
      <category domain="http://securityratty.com/tag/greensboro">greensboro</category>
      <category domain="http://securityratty.com/tag/tape">tape</category>
      <category domain="http://securityratty.com/tag/backup tape">backup tape</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/specific medical data">specific medical data</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/computer security">computer security</category>
      <source url="http://breachblog.com/2008/07/16/gga.aspx">A backup tape is stolen from Greensboro Gynecology Associates</source>
    </item>
    <item>
      <title><![CDATA[P2P-related breach affects high-profile clients from Wagner Resource Group]]></title>
      <link>http://securityratty.com/article/989cd0c39e1e8d8d99a391e92dc0fb1d</link>
      <guid>http://securityratty.com/article/989cd0c39e1e8d8d99a391e92dc0fb1d</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/9/08

Organization
Wagner Resource Group

Contractor/Consultant/Branch
None

Victims
Clients

Most notably Supreme Court Justice Stephen G. Breyer,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wagner.jpg" width="200" align="right" height="120"><font size="2"><b>Date Reported: </b><br>7/9/08<br><br><b>Organization: </b><br><a href="http://www.wagnerrg.com/new/invest-taxfree/gate.asp">Wagner Resource Group</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Clients*<br><br><font size="1">*Most notably Supreme Court Justice Stephen G. Breyer, which has been well publicized.</font><br><br><span style="font-weight: bold;">Number Affected:</span><br>~2,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, dates of birth and Social Security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The Washington Post today ran a story I wrote on a data breach of a local investment firm that exposed the names, birth dates and Social Security numbers of some of the Washington area's most powerful attorneys, including Supreme Court Justice Stephen Breyer."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://blog.washingtonpost.com/securityfix/">SecurityFix</a> <br><a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/07/08/AR2008070802997.html">Washington Post</a> <br><a href="http://www.upi.com/Top_News/2008/07/09/Justices_data_breached_in_file-sharing/UPI-14191215609364/">United Press International</a> <br><a href="http://www.nbc4.com/news/16832357/detail.html">NBC Universal, Inc</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Brian Krebs, Washington Post<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Sometime late last year, an employee of a McLean investment firm decided to trade some music, or maybe a movie, with like-minded users of the online file-sharing network LimeWire while using a company computer<br><span style="font-style: italic;">[Evan] P2P file sharing and other client software use can pose a very significant risk in most companies.&nbsp; It is typically an easy risk to address however.&nbsp; A mixture of any one or more of the following controls can help to mitigate the risk; information security training and awareness, egress traffic monitoring and filtering, intrusion detection/prevention, and hardened workstations (i.e. removal of administrative access) to name a few.</span><br style="font-style: italic;"><br>In doing so, he inadvertently opened the private files of his firm, Wagner Resource Group, to the public.<br><span style="font-style: italic;">[Evan] This is a common oversight.&nbsp; LimeWire and other P2P file sharing applications are wonderful tools for doing what they are designed to do.&nbsp; Before allowing their use (or any other software), an organization must evaluate the risks in doing so.&nbsp; If you intend to use or allow the use of LimeWire in your organization, understand how the software works and how it is configured.&nbsp; During the install you will be prompted for the "Save Folder and Shared Folders".&nbsp; Be careful what you choose, and be careful about what information you put in these locations in the future.&nbsp; Most organizations that are aware of risks just choose not to allow P2P use.</span><br><br><img src="http://images.quickblogcast.com/95781-88451/limewire.jpg" width="576" border="0"><br><br>That exposed the names, dates of birth and Social Security numbers of about 2,000 of the firm's clients, including a number of high-powered lawyers and Supreme Court Justice Stephen G. Breyer.<br><span style="font-style: italic;">[Evan] The high-profile nature of this breach is what has grabbed headlines all last week.</span><br><br>Of the 2,000 records from Wagner Resource Group that were found online, 700 included Social Security numbers, names and birth dates, while other records included only one or two of those details. <br><br>The breach was not discovered for nearly six months.<br><span style="font-style: italic;">[Evan] This is another danger posed by information leaked through P2P.&nbsp; Once information has leaked, how does an organization detect that it has been leaked?&nbsp; There is no longer any control.</span><br style="font-style: italic;"><br>A reader of washingtonpost.com's Security Fix blog found the information while searching LimeWire in June.<br><span style="font-style: italic;">[Evan] I wonder why the reader did not notify the authorities and/or Wagner at the time of its discovery.&nbsp; Maybe he/she did.&nbsp; I don't know.</span><br style="font-style: italic;"><br>Robert Boback, chief executive of Tiversa, the company hired by Wagner to help contain the data breach, said such breaches are hardly rare.<br><br>About 40 to 60 percent of all data leaks take place outside of a company's secured network, usually as a result of employees or contractors installing file-sharing software on company computers.<br><span style="font-style: italic;">[Evan] Really?!&nbsp; I would have not guessed that the percentage would be so high.&nbsp; Interesting.</span><br><br>"We've seen a lot of instances where a company will be working on a product that's not even released yet, and the diagrams for that product are already out on the Net," Boback said.<br><span style="font-style: italic;">[Evan] Very good point.&nbsp; It isn't just personally identifiable information that is leaked, there are plenty of instances where intellectual property (IP) is exposed.&nbsp; I have read estimates that as much as 80% or organizational assets globally are intangible (information, knowledge, etc.).</span><br style="font-style: italic;"><br>"This case is unique because of the high profile of the targets. The individuals on this list are at a very high risk, almost imminent, of identity theft." <br><br>Tiversa officials found that more than a dozen LimeWire users in places as far away as Sri Lanka and Colombia downloaded the list of personal data from the Wagner network.<br><br>"To me, this was devastating," said Phylyp Wagner, founder of the investment firm. "I didn't even know what peer-to-peer was. I do now."<br><span style="font-style: italic;">[Evan] This is a big problem!&nbsp; Corporate leaders must be made aware of the risks surrounding the information for which they are ultimately responsible for.</span><br style="font-style: italic;"><br>Wagner said his company has contracted with FirstAdvantage of Poway, Calif., which last week sent out letters notifying affected clients of the breach and offering each six months of free credit-report monitoring.<br><br>He emphasized that the peer-to-peer disclosure never endangered his clients' financial records, which are stored by a separate company.<br><span style="font-style: italic;">[Evan] Maybe not their financial records, but it did affect some people's financial status (at least temporarily).</span><br><br>But that may be small consolation to several lawyers on the list who said they recently experienced unexplained financial activity.<br><br>"This may explain why two weeks ago I got a $9,000 cellphone bill from AT&amp;T," said Steven Agresta, a partner with the law firm Alston &amp; Bird.<br><br>Someone had opened a phone account using his date of birth and Social Security number, but with a different address.<br><br>this morning I heard from reader Christopher Lynt, a patent attorney from Virginia whose personal data was included in the file exposed via P2P.<br><br>He told me that last July, an identity thief used his SSN and birth date to have $1,000 wired to Mexico from Lynt's bank and credit accounts.<br><br><span style="font-weight: bold;">Commentary:</span><br>This certainly isn't the first time we have read about P2P file sharing network exposures.&nbsp; If your organization can find a way to use the technology without posing an unacceptable risk, then fine.&nbsp; If not, then don't allow the technology to be used.&nbsp; Seems pretty plain and simple.<br><br>There is much work to be done.&nbsp; At Wagner and elsewhere. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/14/wagner.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 14 Jul 2008 13:08:21 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wagner">wagner</category>
      <category domain="http://securityratty.com/tag/p2p">p2p</category>
      <category domain="http://securityratty.com/tag/investment firm">investment firm</category>
      <category domain="http://securityratty.com/tag/evan p2p file">evan p2p file</category>
      <category domain="http://securityratty.com/tag/mclean investment firm">mclean investment firm</category>
      <category domain="http://securityratty.com/tag/p2p file">p2p file</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/wagner network">wagner network</category>
      <category domain="http://securityratty.com/tag/wagner resource">wagner resource</category>
      <source url="http://breachblog.com/2008/07/14/wagner.aspx">P2P-related breach affects high-profile clients from Wagner Resource Group</source>
    </item>
    <item>
      <title><![CDATA[Senators question NebuAd, targeted ad privacy]]></title>
      <link>http://securityratty.com/article/d5f2bcff2499977a2e1fa7701d523184</link>
      <guid>http://securityratty.com/article/d5f2bcff2499977a2e1fa7701d523184</guid>
      <description><![CDATA[Senators question NebuAd on its information collection practices at a hearing in which the company's CEO said it does not collect personally identifiable information or keep the information it...]]></description>
      <content:encoded><![CDATA[Senators question NebuAd on its information collection practices at a  hearing in which the company's CEO said it does not collect personally identifiable information or keep the information it collects for an extended time.
<p><a href="http://feeds.computerworld.com/~a/Computerworld/Security/News?a=uhyy4g"><img src="http://feeds.computerworld.com/~a/Computerworld/Security/News?i=uhyy4g" border="0"></img></a></p><img src="http://feeds.computerworld.com/~r/Computerworld/Security/News/~4/331790668" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/senators question nebuad">senators question nebuad</category>
      <category domain="http://securityratty.com/tag/identifiable information">identifiable information</category>
      <category domain="http://securityratty.com/tag/information collection practices">information collection practices</category>
      <category domain="http://securityratty.com/tag/collects">collects</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/ceo">ceo</category>
      <category domain="http://securityratty.com/tag/collect">collect</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <source url="http://feeds.computerworld.com/~r/Computerworld/Security/News/~3/331790668/article.do">Senators question NebuAd, targeted ad privacy</source>
    </item>
    <item>
      <title><![CDATA[Simple oversight at TNS Infratest exposes participant information]]></title>
      <link>http://securityratty.com/article/ca9bbb88145ecdbedb20b4a7aa81936a</link>
      <guid>http://securityratty.com/article/ca9bbb88145ecdbedb20b4a7aa81936a</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/4/08

Organization
Taylor Nelson Sofres plc (TNS

Contractor/Consultant/Branch
TNS Infratest

Victims
Survey participants

Number Affected
41,000
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/tns.jpg" width="98" align="right" height="98"><font size="2"><b>Date Reported: </b><br>7/4/08<br><br><b>Organization: </b><br><a href="http://www.tnsglobal.com/">Taylor Nelson Sofres plc (TNS)</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.tns-infratest.com/">TNS Infratest</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Survey participants<br><br><span style="font-weight: bold;">Number Affected:</span><br>41,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"Name and address, date of birth, email address and phone numbers", "Some of the data included monthly income, education, bank account information, health insurance data, and which credit cards are used"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The scientific journal of the Chaos Computer Club (CCC), Die Datenschleuder, reports that market research firm TNS Infratest/Emnid has lost 41,000 private data records of their survey participants."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.ccc.de/updates/2008/umfragetief?language=en">Chaos Computer Club e.V.</a> <br><a href="http://www.theinquirer.net/gb/inquirer/news/2008/07/07/hackers-claim-survey-outfit">The Inquirer</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Chaos Computer Club e.V.<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>TOP MARKET RESEARCH firm TNS Infratest/Emnid has 'lost' 41,000 private data records of its survey participants, the Chaos Computer Club (CCC) has revealed in its official organ Die Datenschleuder.<br><br>As the magazine reports [1], it was possible for participants to read master data records and consumer profiles without bypassing even basic security measures.<br><br>Access to the comprehensive survey results could be gained by simply changing the customer ID number in the browser's address bar.<br><span style="font-style: italic;">[Evan] This type of development mistake too common.&nbsp; The vulnerability is very easy to find by good pen testers and the bad guys.&nbsp; Actually, I am surprised that we don't hear about more of these types of breaches.</span><br><br>Besides name and address, the data records included date of birth, email address and phone number.<br><br>Many records also included very sensitive information: monthly income, education, bank account information, health insurance data, if and which credit cards are used, which electronic devices are used in the household, children's ages and yet more private data.<br><span style="font-style: italic;">[Evan] Clearly this is some very sensitive information, all provided by people completing surveys.</span><br><br>"TNS Infratest made a beginner's mistake in their software development. This is unprofessional, grossly negligent and above all deeply worrying," commented CCC spokesman Dirk Engling regarding the incident.<br><span style="font-style: italic;">[Evan] Mr. Engling is dead on.&nbsp; I couldn't have said it better myself.</span><br><br>"As this information is very sensitive, where abuse such as identity theft or its use in connection with burglary cannot be excluded, THS Infratest needs to inform the victims immediately," he continued<br><br>This case continues a disastrous, never-ending series of information leaks of data held by public and private sector organisations.<br><br>The need for more strict control of sensitive data collections is evidenced by the recent snooping affairs by German Telecom as well as the data leaks from the "Meldeämtern" (registration of address offices). <br><br>It is obvious here that data security only plays a minor role in companies.<br><span style="font-style: italic;">[Evan] Very sad, but very true.&nbsp; Too many organizations still take the wrong view of information security as a "cost center" instead of a business driver.&nbsp; Well designed and managed information security programs, the ones that are aligned with the business and not IT, can actually provide value to the business.</span><br><br>"Especially for companies surveying the most confidential data, the highest security standards have to apply," said Engling.<br><br>The press team of the Chaos Computer Club is available for questions at the following addresses: <br></font><ul><li><font size="2">presse@ccc.de (preferred)</font></li><li>0700-CHAOSFON (0700 - 24267366)<br></li></ul><font size="2"><br><span style="font-weight: bold;">Commentary:</span><br>TNS is a large company, a large company with resources to hire good management, programmers, and information security personnel.&nbsp; What is the excuse for making such a significant, yet simple oversight?&nbsp; There are a number of controls that could have reduced the risk of this occurring.<br><br>One a secondary note, but no less important in my opinion.&nbsp; It seems that people (in general) provide too much information willingly, without understanding what the risks could be.&nbsp; Personally, I rarely complete surveys that ask me for personally identifiable information (name, address, etc.).&nbsp; I suggest that you give some serious thought to providing any of your personal information.&nbsp; Ask yourself if you trust the organization collecting your information.&nbsp; If so, question what your trust is based on.&nbsp; Do NOT hesitate to ask questions and err on the side of caution. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br><br><script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/09/tns.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 09 Jul 2008 19:37:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/records">records</category>
      <category domain="http://securityratty.com/tag/master data records">master data records</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/sensitive">sensitive</category>
      <category domain="http://securityratty.com/tag/information leaks">information leaks</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/bank account information">bank account information</category>
      <source url="http://breachblog.com/2008/07/09/tns.aspx">Simple oversight at TNS Infratest exposes participant information</source>
    </item>
    <item>
      <title><![CDATA[Laptop stolen from a Quest Diagnostics employee]]></title>
      <link>http://securityratty.com/article/007ebcc90080dba869c5db4e5fdaab4b</link>
      <guid>http://securityratty.com/article/007ebcc90080dba869c5db4e5fdaab4b</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/30/08

Organization
Quest Diagnostics

Contractor/Consultant/Branch
None

Victims
Patients

assumed

Number Affected
Unknown

Types of Data
name,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/quest.jpg" align="right" height="92" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/30/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.questdiagnostics.com/">Quest Diagnostics</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Patients*<br><br><font size="1">*assumed</font><br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"name, address, and social security number"<br><br><span style="font-weight: bold;">Breach Description:</span><br>On May 1, 2008 a Quest Diagnostics employee's password protected laptop computer, which contained certain personally identifiable information, was stolen.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.oag.state.md.us/idtheft/Breach%20Notices/ITU-153105.pdf">Maryland State Attorney General breach notification</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The Maryland State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>This letter is being sent to you in accordance with the requirements of the Maryland Personal Information Protection Act to advise you of the breach of security of personal data of certain Maryland residents.<br><br>The breach arose out of the theft of a password protected laptop computer of one of our employees on May 1, 2008.<br><span style="font-style: italic;">[Evan] Really, what does the "password protected" mention have to do with anything other than to convince someone into thinking that the laptop was more protected than it actually is/was?&nbsp; Password protection (alone) is just not adequate for sensitive confidential information, unless of course an organization has deemed the risk to be not significant enough to warrant further protection such as encryption coupled with strong authentication.&nbsp; I presume that the laptop was not protected with encryption due to the fact that there is no mention of it.&nbsp; To me, the risk seems significant enough.</span><br><br>The personal data includes the name, address and social security number<br><br>At this time we have no reason to believe this incident will lead to fraudulent credit applications or other identity theft crimes.<br><span style="font-style: italic;">[Evan] Yep, but the company DID unnecessarily increase the risk of this happening to someone now and in the future.</span><br><br>Nevertheless, because the laptop which includes this information cannot be located, we want to notify you about this incident.<br><br>To further reduce the risk of any harm to you we are offering you a credit monitoring product to identify any potential misuse of your personal information.<br><br>Quest Diagnostics takes the issue of safeguarding private information very seriously.&nbsp; For this reason, our data privacy and security policies incorporate comprehensive physical, technical and administrative processes and employee training designed to protect the privacy and security of data and minimize the risk of inappropriate access to sensitive information.<br><span style="font-style: italic;">[Evan] Nice!&nbsp; This statement sounds very impressive and uses some common information security best practices lingo.&nbsp; Did any of these "data privacy and security policies" that "incorporate comprehensive physical, technical and administrative processes and employee training designed to protect the privacy and security of data and minimize the risk of inappropriate access to sensitive information" protect the information on the laptop?&nbsp; Do any of these things include restrictions on confidential information stored on mobile devices or encryption of data at rest?</span><br><br>We deeply regret any inconvenience caused by this incident and appreciate your understanding.<br><br>If you have any questions, please feel free to call Lisa Mullaly, Information Technology Compliance Director at (800)877-8824, extension 6147 at your convenience.<br><br><span style="font-weight: bold;">Commentary:</span><br>I may have been a little harsh in my comments, but I think I was justified.&nbsp; Breaches like these are so preventable.&nbsp; Hey, there's another best practice security lingo term, preventative controls.&nbsp; This breach only affected three Maryland residents, according to the breach notification.&nbsp; It is not known if the breach only affects these three people. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/17/quest.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 17 Jun 2008 08:09:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/sensitive confidential information">sensitive confidential information</category>
      <category domain="http://securityratty.com/tag/identifiable information">identifiable information</category>
      <category domain="http://securityratty.com/tag/breach arose">breach arose</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <category domain="http://securityratty.com/tag/security breach">security breach</category>
      <source url="http://breachblog.com/2008/06/17/quest.aspx">Laptop stolen from a Quest Diagnostics employee</source>
    </item>
    <item>
      <title><![CDATA[Laptop stolen from R.E. Moulton may affect 19,000]]></title>
      <link>http://securityratty.com/article/744fcc25f693c4e344c22b9023c6e318</link>
      <guid>http://securityratty.com/article/744fcc25f693c4e344c22b9023c6e318</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/23/08

Organization
OneAmerica

Contractor/Consultant/Branch
R.E. Moulton, Inc

Victims
Customers

Number Affected
19,000

Types of Data
names in...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/oneamerica.jpg" align="right" height="102" width="102"><span style="font-weight: bold;">Date Reported: </span><br>5/23/08<br><br><span style="font-weight: bold;">Organization:</span> <br><a href="http://www.oneamerica.com/wps/wcm/connect/oa/OneAmerica/Home/">OneAmerica</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.oneamerica.com/wps/wcm/connect/oa/REMoulton">R.E. Moulton, Inc.</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>~19,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names in combination with social security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>A laptop computer containing sensitive personal information belonging to approximately 19,000 individuals was stolen from the Irving, Texas offices of R.E. Moulton on or around March 7th, 2008.<br><br><span style="font-weight: bold;">Reference URL:</span><br>New Hampshire State Attorney General breach notification<br><br><span style="font-weight: bold;">Report Credit:</span><br>The New Hampshire State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>R.E. Moulton is a leader in the medical stop-loss insurance industry and the stop-loss insurance products administered by it are available nation-wide.<br><span style="font-style: italic;">[Evan] The notification to the New Hampshire State Attorney General starts with this sentence.&nbsp; It's nice if you can add a little marketing to your breach notification.</span><br><br>We are writing to inform you of an incident involving the possible disclosure of personal information.<br><br>Specifically, on or around March 7, 2008, thieves broke into our Irving, Texas regional office and stole a laptop computer containing personally identifiable information of numerous individuals, including names in combination with social security numbers.<br><span style="font-style: italic;">[Evan] We don't know much about the physical security controls protecting the office and laptop, but we do have a clue.&nbsp; The fact that R.E. Moulton states "on or around March 7" leads me to believe that the physical controls were not sophisticated enough to detect the theft when it occurred.&nbsp; The practice or storing confidential information on a laptop is not a good idea in most cases and there is also no mention of encryption, so I assume it was not used.&nbsp; Bad, bad, and bad.</span><br><br>A police report was filed and the police are actively investigating this crime.<br><br>Personal information was on the stolen laptop because R.E. Moulton receives requests to provide quotes for stop-loss insurance coverage.<br><span style="font-style: italic;">[Evan] In my opinion, this may be justification for collecting personal information, but certainly not a justification for storing it on a laptop.</span><br><br>Approximately 19,000 individuals were affected, although there may be duplicates on our master list; this means that the list of affected individuals may be smaller.<br><br>At this time. we are unable to determine the number of New Hampshire residents, if any, who will be notified of this incident because the information maintained on the laptop did not include addresses, but we will provide a list at a later date if we find that New Hampshire residents were affected.<br><br>Letters will be sent to these individuals as soon as we receive their addresses from their employers or the third parties who arranged for the insurance quotes.<br><span style="font-style: italic;">[Evan] It seems to me that the "employers or the third parties" have a significant role in this breach also.&nbsp; I wonder if information security personnel at the "employers or the third parties" were aware and approved of the sharing of personal information with R.E. Moulton.&nbsp; If they were, then I wonder if they followed good protocol and evaluated the information security practices of R.E. Moulton.</span><br><br>Those employers and third parties were notified of this incident during the week of May 5, 2008 and are currently collecting the needed addresses.<br><span style="font-style: italic;">[Evan] Employers and third parties were notified almost 2 months after the theft.</span><br><br>Depending on the length of time needed to collect addresses, we hope to start sending letters to the affected individuals in June.<br><span style="font-style: italic;">[Evan] Add the amount of time referred to in this sentence to the ~2 months that have already passed and then add this to the time to address letters and you get a long time before victims are notified.&nbsp; I presume some victims will never be notified.</span><br><br>Please know that we have taken this incident very seriously.<br><span style="font-style: italic;">[Evan] Action speaks louder than words.</span><br><br>While we do not anticipate that any of the information will be used for unauthorized or malicious purposes, to help those whose information was involved, we have engaged ConsumerInfo.com, Inc., an Experian company, to provide those individuals with one year of credit monitoring at no cost to them.<br><br>Please note that we are committed to protecting our customer and that we are constantly improving our processes to avoid any further reoccurrences.<br><br>In addition, appropriate steps have been take to prevent future disclosures of this information.<br><span style="font-style: italic;">[Evan] What steps have been taken?&nbsp; It seems to me that data owners deserve more detail and explanation.</span><br><br>We sincerely apologize for any inconvenience or worry this may have caused you.<br><br>We encourage you to contact the company at 800-553-5318 with any questions or concerns.<br><br><span style="font-weight: bold;">From the FAQs:</span><br>Q.&nbsp; What is being done by R.E. Moulton to prevent a similar incident from occurring?<br>A.&nbsp; R.E. Moulton had procedures in place to protect customer information and is constantly reviewing those procedures in light of developments in information security and the evolution of criminal activity.<br><span style="font-style: italic;">[Evan] What do you think of this answer?</span><br><br><span style="font-weight: bold;">Commentary:</span><br>I get especially frustrated by breaches that involve confidential information on a stolen laptop.&nbsp; Stolen laptops are one of, if not the most common types of breaches that we read about, yet the frequency of reports does not seem to be subsiding.&nbsp; Can an organization claim that they didn't know any better?&nbsp; At what point does risky information security behavior become negligent?<br><br>I suspect that most victims don't even know that R.E. Moulton had their personal information.&nbsp; This make the breach a little more troubling.<br><br>I accept mistakes because we all make them.&nbsp; I also accept security incidents that occur despite an organization's best efforts at protection.&nbsp; I don't accept poor behavior that seems to go against common sense. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/15/oneamerica.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sun, 15 Jun 2008 18:15:45 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security practices">information security practices</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/moulton">moulton</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/information security personnel">information security personnel</category>
      <source url="http://breachblog.com/2008/06/15/oneamerica.aspx">Laptop stolen from R.E. Moulton may affect 19,000</source>
    </item>
    <item>
      <title><![CDATA[University of South Carolina Moore School of Business breach]]></title>
      <link>http://securityratty.com/article/337e47e0083fbc5d019fe4ba710c6c76</link>
      <guid>http://securityratty.com/article/337e47e0083fbc5d019fe4ba710c6c76</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/9/08

Organization
University of South Carolina

Contractor/Consultant/Branch
Moore School of Business

Victims
faculty, staff and students

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/usouthcarolina.jpg" align="right" height="75" width="78"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/9/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.sc.edu/">University of South Carolina</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://mooreschool.sc.edu/moore/index.htm">Moore School of Business</a> <br><br><span style="font-weight: bold;">Victims:</span><br>"faculty, staff and students"<br><br><span style="font-weight: bold;">Number Affected:</span><br>~7,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"some personally identifiable data"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The University of South Carolina is warning about 7,000 faculty, staff and students that some of their personal information was on a desktop computer stolen from an office at the business school."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.thestate.com/breaking/story/428754.html">The State</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The State<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>The University of South Carolina is warning about 7,000 faculty, staff and students that some of their personal information was on a desktop computer stolen from an office at the business school.<br><br>Monday evening, May 26th, 2008 computer hardware containing data files was stolen from the Dean’s Office<br><br>"Among the items was a desktop computer belonging to Deputy Dean Dr. Scott Koerwer,"<br><span style="font-style: italic;">[Evan] I am semi-sure that a business case could be made to allow Dr. Scott access to confidential information, but there should be NO business case allowing for the storage of this information on the desktop computer he uses.&nbsp; I also doubt that he needs access to Social Security numbers.</span><br><br>"As a result of the computer being stolen, we feel it is possible that some personally identifiable data could have been compromised."<br><br>There is a possibility that some personal information such as social security numbers, annual pay, and term of service at the University may have been compromised.<br><br>As soon as the unauthorized access was discovered (May 27, 2008), USC initiated its incident handling procedures, which includes notification of affected individuals.<br><span style="font-style: italic;">[Evan] I am glad to read that USC has incident handling procedures.&nbsp; Many organizations do not.</span><br><br>university officials have no evidence anyone's personal information was accessed<br><span style="font-style: italic;">[Evan] It's probably too soon for evidence.</span><br><br>"We feel the responsible thing for us to do is to notify those persons whose data was contained in the computer, and advise them of the fact, and share with them some useful steps they may want to take for additional protection,"<br><br>the university is notifying about 130 faculty and staff at the Moore School, and just under 7,000 students who took business courses in the last academic year<br><br>the university’s Division of Law Enforcement and Safety and Office of Information Technology are investigating the matter<br><br>The Moore School of Business has taken precautions to minimize future security risks.<br><span style="font-style: italic;">[Evan] Like what?&nbsp; Anybody can make a statement like this.&nbsp; People should be provided with some details.&nbsp; Details that don't give away too much, but enough to instill confidence.&nbsp; This statement means little to me.</span><br><br>Deputy Dean Koerwer circulated a letter to students dated June 6 that suggested some steps they might take to protect themselves from identity theft.<br><br>Guidance regarding the burglary, including answers to frequently asked questions that we anticipate on identity protection, identity theft, and precautionary measures is available at the University’s website: <a href="http://www.sc.edu/identity/index.shtml<br><br>We">www.sc.edu/identity/index.shtml<br><br>We</a> deeply regret any inconvenience or concern that this incident may cause. We assure you that the University, along with the Dean’s Office, is working diligently to prevent this type of incident from recurring.<br><br>Please know that the university faculty and staff are committed to protecting all personal information. <br><br><span style="font-weight: bold;">Commentary:</span><br>This is a physical, administrative and potentially logical information security breach.&nbsp; There is no information provided about what physical controls were present to prevent an intruder from stealing the desktop computer, so it is difficult to comment.&nbsp; There is little information provided around the administrative controls in place, but we can imply some things.&nbsp; Due to the fact that the school did not state that the storage of confidential information on client computers is prohibited, maybe we can assume that it is permitted.&nbsp; There was no mention of encryption, so I question whether or not this is a logical control that may have been lacking.<br><br>Information security is a holistic discipline and the controls I mention above are a very, very small part of the big picture. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>September, 2007 - <a href="http://breachblog.com/2007/09/06/university-of-south-carolina-mistake-leads-to-breach-of-3199-records.aspx">University of South Carolina Mistake Leads to Breach of 3,199 Records</a></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/09/usouthcarolina.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 09 Jun 2008 09:38:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/school">school</category>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/business school">business school</category>
      <category domain="http://securityratty.com/tag/university officials">university officials</category>
      <category domain="http://securityratty.com/tag/computer">computer</category>
      <category domain="http://securityratty.com/tag/moore school">moore school</category>
      <source url="http://breachblog.com/2008/06/09/usouthcarolina.aspx">University of South Carolina Moore School of Business breach</source>
    </item>
  </channel>
</rss>
