<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: tape]]></title>
    <link>http://securityratty.com/tag/tape</link>
    <description></description>
    <pubDate>Thu, 17 Jul 2008 19:35:59 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[What would you do if you knew the Air Marshal on your plane was smuggling Drugs?]]></title>
      <link>http://securityratty.com/article/6902b40b209c72e9190f6544d2968f20</link>
      <guid>http://securityratty.com/article/6902b40b209c72e9190f6544d2968f20</guid>
      <description><![CDATA[According to a recent USA TODAY article, Federal Air Marshals have been convicted of smuggling drugs, molesting children, abducting a female escort during a layover in Washington D.C., hiring a hitman...]]></description>
      <content:encoded><![CDATA[According to a recent USA TODAY article, Federal Air Marshals have been convicted of smuggling drugs, molesting children, abducting a female escort during a layover in Washington D.C., hiring a hitman to kill a spouse and many other criminal acts. <br /><span id="fullpost"><br />The ex-Air Marshal who was convicted of smuggling drugs apparently used his position to work with a drug dealer to carry cocaine and drug money with him on flights around the country.  He was caught on tape telling an informant that he was "the man with the Golden Badge".<br /></span><br />We should remember though, that with a current force of between 3,000 - 4,000 (exact numbers are confidential), there are bound to be a few bad apples in the bunch - that is the way in every profession.  <br /><br />What makes it much more alarming when we talk about Air Marshals gone bad is the fact that at 30,000 feet in the air - their authority is absolute.  The last thing a passenger in a plane needs to be concerned about is the very person on the plane whose job it is to protect the passengers.<br /><br />The Marshal's decision making skills should be beyond reproach.  If their judgement is clouded over however, due to experimenting with the cocaine they are smuggling, the consequences could prove fatal.<br /><br />Perhaps the fact that prior to 2001, the Air Marshal service had an annual budget of $4.4 million and 33 agents which exploded to $786 million and between 3,000 to 4,000 agents today might have something to do with undesirables falling through the cracks.<br /><br />Not that rapid hiring needs are an excuse for allowing criminal behavior to go unnoticed.  The office of Inspector General or Internal Affairs needs to get actively involved and properly supervise the agency so that rogue Marshals are not allowed to remain in the service.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sat, 15 Nov 2008 20:34:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/air">air</category>
      <category domain="http://securityratty.com/tag/air marshals">air marshals</category>
      <category domain="http://securityratty.com/tag/federal air marshals">federal air marshals</category>
      <category domain="http://securityratty.com/tag/marshal">marshal</category>
      <category domain="http://securityratty.com/tag/air marshal service">air marshal service</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/drugs">drugs</category>
      <category domain="http://securityratty.com/tag/ex-air marshal">ex-air marshal</category>
      <category domain="http://securityratty.com/tag/plane">plane</category>
      <source url="http://www.thebulletproofblog.com/2008/11/what-would-you-do-if-you-knew-air.html">What would you do if you knew the Air Marshal on your plane was smuggling Drugs?</source>
    </item>
    <item>
      <title><![CDATA[How IT Helped Catch the Jewelry Thief]]></title>
      <link>http://securityratty.com/article/2661a868b920f794abd44736f49e39cb</link>
      <guid>http://securityratty.com/article/2661a868b920f794abd44736f49e39cb</guid>
      <description><![CDATA[It used to be that after a robbery, the police would review a surveillance tape for clues into who broke in, at what time and what the bad guys looked like. Since the thieves would be long gone by the...]]></description>
      <content:encoded><![CDATA[It used to be that after a robbery, the police would review a surveillance tape for clues into who broke in, at what time and what the bad guys looked like. Since the thieves would be long gone by the time the tape was reviewed, there would often be little the authorities could do about it.]]></content:encoded>
      <pubDate>Tue, 11 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/surveillance tape">surveillance tape</category>
      <category domain="http://securityratty.com/tag/tape">tape</category>
      <category domain="http://securityratty.com/tag/bad guys">bad guys</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/review">review</category>
      <category domain="http://securityratty.com/tag/clues">clues</category>
      <category domain="http://securityratty.com/tag/police">police</category>
      <category domain="http://securityratty.com/tag/thieves">thieves</category>
      <category domain="http://securityratty.com/tag/robbery">robbery</category>
      <source url="http://www.networkworld.com/news/2008/111208-how-it-helped-catch-the.html?fsrc=rss-security">How IT Helped Catch the Jewelry Thief</source>
    </item>
    <item>
      <title><![CDATA[A New Way to Back Up Digital Files on paper]]></title>
      <link>http://securityratty.com/article/f29b43ae964909cbeacf815e65f8018e</link>
      <guid>http://securityratty.com/article/f29b43ae964909cbeacf815e65f8018e</guid>
      <description><![CDATA[This is pretty funny a free open source application where you can backup your data by printing it, on paper, in a bar code format. A friend of mine says he tried it and that it even works
PaperBack is...]]></description>
      <content:encoded><![CDATA[<p>This is pretty funny &#8212; a free open source application where you can backup your data by printing it, on paper, in a bar code format. A friend of mine says he tried it and that it even works &#8211;</p>
<blockquote><p>PaperBack is a free application that allows you to back up your precious files on the ordinary paper in the form of the oversized bitmaps. If you have a good laser printer with the 600 dpi resolution, you can save up to 500,000 bytes of uncompressed data on the single A4/Letter sheet. Integrated packer allows for much better data density - up to 3,000,000+ (three megabytes) of C code per page.</p>
<p>You may ask - why? Why, for heaven&#8217;s sake, do I need to make paper backups, if there are so many alternative possibilities like CD-R&#8217;s, DVD±R&#8217;s, memory sticks, flash cards, hard disks, streamer tapes, ZIP drives, network storages, magnetooptical cartridges, and even 8-inch double-sided floppy disks formatted for DEC PDP-11? (I still have some). The answer is simple: you don&#8217;t. However, by looking on CD or magnetic tape, you are not able to tell whether your data is readable or not. You must insert your medium into the drive (if you have one!) and try to read it.</p>
<p>Paper is different. Do you remember the punched cards? EBCDIC and all this stuff. For years, cards were the main storage medium for the source code. I agree that 100K+ programs were&#8230; unhandly, but hey, only real programmers dared to write applications of this size. And used cards were good as notepads, too. Punched tapes were also common. And even the most weird codings, like CDC or EBCDIC, were readable by humans (I mean, by real programmers).</p></blockquote>
<p>Read the <a rel="nofollow" target="_blank" href="http://www.ollydbg.de/Paperbak/index.html">whole thing here.<br />
</a></p>]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 04:28:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/paper">paper</category>
      <category domain="http://securityratty.com/tag/code">code</category>
      <category domain="http://securityratty.com/tag/source code">source code</category>
      <category domain="http://securityratty.com/tag/paper backups">paper backups</category>
      <category domain="http://securityratty.com/tag/real programmers dared">real programmers dared</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/data density">data density</category>
      <category domain="http://securityratty.com/tag/real programmers">real programmers</category>
      <category domain="http://securityratty.com/tag/flash cards">flash cards</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/383345885/">A New Way to Back Up Digital Files on paper</source>
    </item>
    <item>
      <title><![CDATA[Don't Panic]]></title>
      <link>http://securityratty.com/article/171b434e504b03e183525367f4118cdd</link>
      <guid>http://securityratty.com/article/171b434e504b03e183525367f4118cdd</guid>
      <description><![CDATA[Sometimes it's easy to believe that every last thing online is going to eat into your PC, burn your house down, kill your cat and so on. The last few days I'd been hearing rumblings about some...]]></description>
      <content:encoded><![CDATA[
        Sometimes it's easy to believe that every last thing online is going to eat into your PC, burn your house down, kill your cat and so on. The last few days I'd been hearing rumblings about some "Youtube rap video" and a file that would start hijacking your PC - well, thanks to a tipoff from a forum-goer at Spywarewarrior, I can hopefully put this one to rest.<br /><br />In short, a video promoting a rap mix-tape supposedly took you to a file that "hijacked your PC with Spywarestop". In actual fact, there's no file to hijack you. Let's take a look - here's the Youtube page in question:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/mixtape1.html" onclick="window.open('http://blog.spywareguide.com/images/mixtape1.html','popup','width=895,height=493,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/mixtape1-thumb-395x217.gif" alt="mixtape1.gif" class="mt-image-none" style="" height="217" width="395" /></a></span><br /><br />Click to Enlarge<br /></div><br />As you can see, there's the mix-tape being advertised and a link to Mediafire, where the mix-tape is hosted. Click the Mediafire link, and all that happens is you'll see an advert for various antispyware tools - some of them on the <a href="http://www.spywarewarrior.com/rogue_anti-spyware.htm">Rogue Antispyware list</a>, some of them not on the list but known to be of little worth to the end-user.<br /><br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/mixtape2.html" onclick="window.open('http://blog.spywareguide.com/images/mixtape2.html','popup','width=757,height=457,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/mixtape2-thumb-357x215.gif" alt="mixtape2.gif" class="mt-image-none" style="" height="215" width="357" /></a></span><br /> </div><div><div align="center"><br />Click to Enlarge<br /></div><br />In this particular case, it's an advert for Adware Alert. It's not hijacking you, or breaking things or making your browser fly around the screen, nor is it a "virus". It's just an (admittedly loud) advert. If you're running a browser compatible with <a href="http://adblockplus.org/en/">Adblock Plus</a>, all you'll see beneath the Mediafire logo is a blank space. Even if you're vaguely alarmed by the advert, all you have to do is click the "Continue to Mediafire.com" message at the top right of the screen (missing from the above screenshot as I cropped the image too small - whoops) and you'll be taken to the file you requested.<br /><br />Like the title says - don't panic. This really isn't something to worry about too much. Even the most obnoxious rogue antispyware advert (the ones that <i>do</i> resize your browser, throw up endless popups and make annoying "Woop woop" noises) can usually be escaped by simply hitting CTRL+ALT+DEL and using Task Manage to close your browser session.<br /></div>
        
    ]]></content:encoded>
      <pubDate>Fri, 29 Aug 2008 13:03:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mediafire link">mediafire link</category>
      <category domain="http://securityratty.com/tag/link">link</category>
      <category domain="http://securityratty.com/tag/browser">browser</category>
      <category domain="http://securityratty.com/tag/mediafire">mediafire</category>
      <category domain="http://securityratty.com/tag/browser session">browser session</category>
      <category domain="http://securityratty.com/tag/rap mix-tape supposedly">rap mix-tape supposedly</category>
      <category domain="http://securityratty.com/tag/mix-tape">mix-tape</category>
      <category domain="http://securityratty.com/tag/mediafire logo">mediafire logo</category>
      <category domain="http://securityratty.com/tag/browser compatible">browser compatible</category>
      <source url="http://blog.spywareguide.com/2008/08/dont-panic.html">Don't Panic</source>
    </item>
    <item>
      <title><![CDATA[IBM Raises The Stakes In Business and IT Continuity Services]]></title>
      <link>http://securityratty.com/article/a92cdf5dd8f2018462a4657fa7e717b8</link>
      <guid>http://securityratty.com/article/a92cdf5dd8f2018462a4657fa7e717b8</guid>
      <description><![CDATA[IBM announced today that it was spending US$300 million to build out 13 data centers in 10 countries in 2008 - IBM refers to these sites as &quot;Business Resilience service delivery centers&quot;. These...]]></description>
      <content:encoded><![CDATA[<p><img title="Stephanie Balaouras" alt="Stephanie Balaouras" src="http://www.forrester.com/role_based/images/author/imported/forresterDotCom/Analyst_Photos/Silhouette/Color/Stephanie-Balaouras.gif" border="0" style="FLOAT: left; MARGIN: 0px 5px 5px 0px" /></p>

<p><a href="http://www-03.ibm.com/press/us/en/pressrelease/24957.wss">IBM announced today that it was spending US$300 million to build out 13 data centers in 10 countries in 2008 - IBM refers to these sites as &quot;Business Resilience service delivery centers&quot;.</a> These centers will certainly help IBM deliver more of its traditional IT recovery services but they will also support the next generation of IT continuity services - repeatable, scalable, productize services such as online backup and virtual recovery.&nbsp; These types of services don't require massive capital investment in an inventory of heterogeneous server and storage platforms, instead the service provider can focus its efforts on building a scalable pool of virtualized servers and shared storage built with industry standard components.</p>

<p><a href="http://www.forrester.com/go?docid=42947">Online backup is an important service because it provides an affordable information protection service for small and medium businesses and it's even useful for enterprises as a means to backup PCs corporate-wide as well as small servers at remote locations.</a> In addition to the $300 million that IBM is spending on its new resiliency centers, late in 2008, it acquired <a href="http://blogs.forrester.com/it_infrastructure/2007/12/online-backup-m.html">Arsenal Digital Solutions</a>, one of the major players in online backup. </p>

<p>In addition to online backup, recovery services using software-based replication to a cloud infrastructure will also open up new opportunities. These services will provide a much a better recovery time and recovery point than tape-based services but won't cost nearly as much as custom services based on storage-based replication and dedicated hardware. The cost of these services is more than most small and medium, even some large enterprises can or are willing to pay for. SunGard was the first to announce such a productized service, <a href="http://blogs.forrester.com/srm/2008/08/traditional-dis.html">Forrester expects all the traditional DR service providers to bring similar offerings to market over time.</a></p>

<p>These cloud-based service offerings are important for several other reasons, first, it could help stem the tide of enterprises who are just so fed up with the traditional disaster recovery services model that they take DR back in house, second, it could convince, more medium size businesses that they can afford more advanced IT continuity solutions and lastly, it will help protect their market against new competitors who can simply partner with cloud providers such as Amazon S3 and Google to offer similar services.</p>

<p>IBM is not only using its expansion and acquisitions to stay competitive, it's also also hoping that customers will recognize the value of IBM expertise, process and best practices in BC. </p>

<p>What do you think? Does the reputation and expertise of BC and IT Continuity service providers like IBM and SunGard critical in your decision-making or can new players enter the market? Do these lower cost services that offer better RTO and RPO renew your interest in service providers or do you still plan to keep DR in-house?</p>

<p>I welcome your thoughts.</p>]]></content:encoded>
      <pubDate>Fri, 22 Aug 2008 11:38:40 +0000</pubDate>
      <category domain="http://securityratty.com/tag/services">services</category>
      <category domain="http://securityratty.com/tag/recovery">recovery</category>
      <category domain="http://securityratty.com/tag/recovery services">recovery services</category>
      <category domain="http://securityratty.com/tag/continuity services">continuity services</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/ibm">ibm</category>
      <category domain="http://securityratty.com/tag/service provider">service provider</category>
      <category domain="http://securityratty.com/tag/service offerings">service offerings</category>
      <category domain="http://securityratty.com/tag/cost">cost</category>
      <source url="http://blogs.forrester.com/srm/2008/08/ibm-raises-the.html">IBM Raises The Stakes In Business and IT Continuity Services</source>
    </item>
    <item>
      <title><![CDATA[Traditional Disaster Recovery Services Are Dead]]></title>
      <link>http://securityratty.com/article/91a8e062482df48ac9d61748458d67d9</link>
      <guid>http://securityratty.com/article/91a8e062482df48ac9d61748458d67d9</guid>
      <description><![CDATA[If you still subscribe to fixed site recovery services using shared IT infrastructure from the likes of HP, IBM BCRS, or SunGard, among others, you will quickly become a dinosaur in the next 1 to 2...]]></description>
      <content:encoded><![CDATA[<p><img border="0" title="Stephanie Balaouras" alt="Stephanie Balaouras" src="http://www.forrester.com/role_based/images/author/imported/forresterDotCom/Analyst_Photos/Silhouette/Color/Stephanie-Balaouras.gif" style="margin: 0px 5px 5px 0px; float: left;" /></p>

<p><span style="font-size: 10pt; font-family: Arial;">If you still subscribe to fixed site recovery services using shared IT infrastructure from the likes of HP, IBM BCRS, or SunGard, among others, you will quickly become a dinosaur in the next 1 to 2 years. </span></p>

<p><span style="font-size: 10pt; font-family: Arial;">These types of shared infrastructure services involve lengthy restores from tape and a recovery time objective of 72 hours, at best. Plus, you'll be lucky if you recover at all because chances are, you've had trouble scheduling a test with your service provider and it's been a LONG time since the last one, if indeed you’ve ever tested. </span></p>

<p><span style="font-size: 10pt; font-family: Arial;"><a href="http://www.forrester.com/go?docid=46270">72 hours recovery just doesn't cut it anymore</a>. And frankly, understanding your provider's oversubscription ratio to shared infrastructure to determine the risk of multiple invocations, or attempting to negotiate exclusions zones and availability guarantees is a time suck. Most companies are either taking DR back in-house or, if they still rely on a DR service provider, they are using dedicated infrastructure.</span></p>

<p><span style="font-size: 10pt; font-family: Arial;">A dedicated infrastructure is attractive as it enables replication to improve recovery objectives. But it’s expensive, and puts advanced IT recovery out of the reach of many companies who can't measure downtime in millions of dollars.</span></p>



<p><span style="font-size: 10pt; font-family: Arial;">But, there are new services on the horizon that will make advanced IT recovery affordable for the masses. This month SunGard announced the availability of its new Virtual Server Replication Service. As I discussed in my most recent <a href="http://www.forrester.com/go?docid=44878">Forrester Wave™ of DR Service Providers</a> and <a href="http://www.forrester.com/go?docid=42944">other reports</a>, server virtualization is transforming IT recovery. With replication to a virtualized server infrastructure and shared storage infrastructure, customers can enjoy improved recovery-time and recovery-point objectives without the cost of dedicated and custom IT recovery solutions from the <span class="hilite">DR</span> services provider.SunGard is the first DR service provider to productize these virtual services. I expect other DR service providers to follow suit. <br /></span></p>

<p><span style="font-size: 10pt; font-family: Arial;">So, the next time your contract is up for renewal, you need to completely rethink your approach to IT recovery. Get off tape and move to these new virtual services. It will improve your recovery capabilities and you don't have to worry about the oversubscription issue with shared virtual infrastructure -- the DR provider can manage capacity much more easily in this environment. In fact, SunGard is offering an RTO SLA of 6 hours as part of the offering. To my knowledge, this is the first time a DR service provider is offering this as part of a standard contract. I'm looking forward to the day when vendors will offer most services with transparent, subscription-based pricing, and standard contract terms that don't take a team of procurement professionals to negotiate.<span face="Times New Roman">&nbsp;</span><span style="font-size: 10pt; font-family: Arial;"><street w:st="on"></street></span></span></p>]]></content:encoded>
      <pubDate>Wed, 06 Aug 2008 13:06:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/recovery">recovery</category>
      <category domain="http://securityratty.com/tag/recovery time objective">recovery time objective</category>
      <category domain="http://securityratty.com/tag/recovery-time">recovery-time</category>
      <category domain="http://securityratty.com/tag/services">services</category>
      <category domain="http://securityratty.com/tag/recovery affordable">recovery affordable</category>
      <category domain="http://securityratty.com/tag/recovery capabilities">recovery capabilities</category>
      <category domain="http://securityratty.com/tag/recovery solutions">recovery solutions</category>
      <category domain="http://securityratty.com/tag/provider">provider</category>
      <category domain="http://securityratty.com/tag/recovery-point objectives">recovery-point objectives</category>
      <source url="http://blogs.forrester.com/srm/2008/08/traditional-dis.html">Traditional Disaster Recovery Services Are Dead</source>
    </item>
    <item>
      <title><![CDATA[Stolen tape puts Bristol-Myers employee data at risk]]></title>
      <link>http://securityratty.com/article/2d32a1f13716753f4c91322fa8204ecb</link>
      <guid>http://securityratty.com/article/2d32a1f13716753f4c91322fa8204ecb</guid>
      <description><![CDATA[Bristol-Myers Squibb confirmed that a backup tape containing personal information on employees, former employees and their families was stolen last month from a third-party transport...]]></description>
      <content:encoded><![CDATA[Bristol-Myers Squibb confirmed that a backup tape containing personal information on employees, former employees and their families was stolen last month from a third-party transport vehicle.
<p><a href="http://feeds.computerworld.com/~a/Computerworld/Security/News?a=v7pF87"><img src="http://feeds.computerworld.com/~a/Computerworld/Security/News?i=v7pF87" border="0"></img></a></p><img src="http://feeds.computerworld.com/~r/Computerworld/Security/News/~4/342950935" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 22 Jul 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/third-party transport vehicle">third-party transport vehicle</category>
      <category domain="http://securityratty.com/tag/employees">employees</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/backup tape">backup tape</category>
      <category domain="http://securityratty.com/tag/bristol-myers squibb">bristol-myers squibb</category>
      <category domain="http://securityratty.com/tag/month">month</category>
      <category domain="http://securityratty.com/tag/families">families</category>
      <source url="http://feeds.computerworld.com/~r/Computerworld/Security/News/~3/342950935/article.do">Stolen tape puts Bristol-Myers employee data at risk</source>
    </item>
    <item>
      <title><![CDATA[Stolen tape puts Bristol-Myers employee data at risk]]></title>
      <link>http://securityratty.com/article/6a4a4f19d77711407bab858843676e0c</link>
      <guid>http://securityratty.com/article/6a4a4f19d77711407bab858843676e0c</guid>
      <description><![CDATA[Bristol-Myers Squibb Co. officials last week confirmed that a non-encrypted backup tape containing the personal data of current and former-employees and their dependents was stolen June 4 from a...]]></description>
      <content:encoded><![CDATA[Bristol-Myers Squibb Co. officials last week confirmed that a non-encrypted backup tape containing the personal data of current and former-employees and their dependents was stolen June 4 from a delivery truck carrying the device.]]></content:encoded>
      <pubDate>Mon, 21 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/personal data">personal data</category>
      <category domain="http://securityratty.com/tag/bristol-myers squibb">bristol-myers squibb</category>
      <category domain="http://securityratty.com/tag/delivery truck">delivery truck</category>
      <category domain="http://securityratty.com/tag/backup tape">backup tape</category>
      <category domain="http://securityratty.com/tag/officials">officials</category>
      <category domain="http://securityratty.com/tag/week">week</category>
      <category domain="http://securityratty.com/tag/dependents">dependents</category>
      <category domain="http://securityratty.com/tag/device">device</category>
      <category domain="http://securityratty.com/tag/june">june</category>
      <source url="http://www.networkworld.com/news/2008/072208-stolen-tape-puts-bristol-myers-employee.html?fsrc=rss-security">Stolen tape puts Bristol-Myers employee data at risk</source>
    </item>
    <item>
      <title><![CDATA[Backup tape is stolen from Bristol-Myers Squibb]]></title>
      <link>http://securityratty.com/article/911478f22f756b8e8513c59d7f720d18</link>
      <guid>http://securityratty.com/article/911478f22f756b8e8513c59d7f720d18</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/17/08

Organization
Bristol-Myers Squibb Co. (&quot;BMS

Contractor/Consultant/Branch
Unknown

Victims
Current and former employees and some dependants
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/bms.jpg" width="198" align="right" height="160"><font size="2"><b>Date Reported: </b><br>7/17/08<br><br><b>Organization: </b><br><a href="http://www.bms.com/landing/data/index.html">Bristol-Myers Squibb Co. ("BMS")</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>Unknown<br><br><span style="font-weight: bold;">Victims:</span><br>Current and former employees and some dependants<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown*<br><br><font size="1">*Bristol-Myers Squibb had "about 42,000 employees as of Dec. 31, the last date for which work force figures were available in regulatory filings.", Source: <a href="http://money.cnn.com/news/newsfeeds/articles/djf500/200807171514DOWJONESDJONLINE000844_FORTUNE5.htm">CNN Money</a></font> <br><br><span style="font-weight: bold;">Types of Data:</span><br>"name, address, date of birth, Social Security number, marital status, gender, salary, hire date, termination date, retirement date, and, in some instances bank account information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"On June 4, 2008, Bristol-Myers Squibb Company ("BMS") learned that a back-up data tape containing BMS-related data was stolen while it was being transported for storage.&nbsp; Through subsequent forensic work, it was determined that the data tape included personal information of current and former BMS employees"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.pharmalot.com/wp-content/uploads/2008/07/bms_letter.pdf">Pharmalot (copy of notification letter)</a> <br><a href="http://www.pharmalot.com/2008/07/bristol-myers-security-breach-hits-untold-thousands/">Pharmalot</a> <br><a href="http://money.cnn.com/news/newsfeeds/articles/djf500/200807171514DOWJONESDJONLINE000844_FORTUNE5.htm">CNNMoney</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Ed Silverman, Pharmalot<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>The drugmaker sent letters over the past week saying a data tape containing reams of personal information was stolen several weeks ago<br><br>On June 4, 2008, Bristol-Myers Squibb Company ("BMS") learned that a back-up data tape containing BMS-related data was stolen while it was being transported for storage. <br><span style="font-style: italic;">[Evan] This statement prompted me to list the contractor as "unknown" instead of "none".&nbsp; I presume that the data tape was being transported by a third-party vendor when it was stolen.&nbsp; I am looking for more information on this.</span><br><br>Through subsequent forensic work, it was determined that the data tape included personal information of current and former BMS employees, such as name, address, date of birth, Social Security number, marital status, gender, salary, hire date, termination date, retirement date, and, in some instances, bank account information.<br><span style="font-style: italic;">[Evan] Ugh, this looks like very sensitive HR and benefits data.</span><br><br>The names, addresses, and Social Security numbers of some employee dependents also were included on the tape.<br><br>an untold number of current and former employees - and their dependents - could be affected<br><br>BMS has initiated an investigation of this incident.<br><br>To date, BMS has no reason to believe that any of your personal information has been inappropriately accessed from the data tape by an unauthorized party, or that any identity theft, fraud or misuse of your personal information has occurred.<br><span style="font-style: italic;">[Evan] I agree with most of this statement except for the "misuse" part.&nbsp; There may be no evidence of misuse post stolen tape, but there may be an argument for misuse by BMS themselves.&nbsp; BMS is the data custodian in this scenario, not the data owner.&nbsp; If a data custodian does not care for the owner's information in a manner that is expected or communicated, does it constitute misuse?</span><br><br>In addition, there is no evidence that the data tape or the information contained on it was the target of the theft.<br><span style="font-style: italic;">[Evan] I am interested in knowing more about who was transporting the tape and whether or not other items were taken.</span><br><br>As a precaution, to help you detect any possible misuse of your data, BMS has arranged for you to enroll in credit monitoring for one full year, at no cost to you.<br><span style="font-style: italic;">[Evan] There is that "misuse" mention again.&nbsp; One year of free credit monitoring does nothing to protect a victim against fraud that occurs after one year, supposing the victim does not renew at his/her own expense.&nbsp; I wonder how many people renew on average.</span><br><br>If you have any questions, you may call the dedicated Privacy Help Line at 1-877-214-0689.&nbsp; Our representatives will be available to assist you Monday through Friday, between 8 a.m. and 5 p.m. ET.<br><br>the drugmaker is issuing this statement: "Bristol-Myers Squibb regrets that this incident occurred and is committed to providing appropriate assistance for affected individuals who had their personal information on the stolen data tape. We are committed to protecting the privacy and security of employee and dependent information. Maintaining the trust and confidence of our employees is paramount to Bristol-Myers Squibb."<br><br>Protecting the privacy and security of your information is extremely important to us.<br><br>In this regard, BMS wishes to reiterate that it does not have any evidence indicating that your personal information has been misused.<br><span style="font-style: italic;">[Evan] Another "misuse" mention.</span><br><br>the company is taking appropriate remedial steps, including enhancing security protocols regarding the handling of personal information and our back-up data tapes.<br><span style="font-style: italic;">[Evan] Like what? Encryption maybe?</span><br><br>On behalf of BMS, I apologize for any inconvenience or concern that this matter may cause for you.<br><br><span style="font-weight: bold;">Commentary:</span><br>I couldn't find any mention about encryption or whether or not police were called.&nbsp; You would think that a large, well-repected company like Bristol-Myers Squibb encrypts confidential data on tape, right? <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/18/bms.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 18 Jul 2008 07:26:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tape">tape</category>
      <category domain="http://securityratty.com/tag/back-up data tape">back-up data tape</category>
      <category domain="http://securityratty.com/tag/data tape">data tape</category>
      <category domain="http://securityratty.com/tag/owner">owner</category>
      <category domain="http://securityratty.com/tag/data owner">data owner</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/bristol-myers squibb">bristol-myers squibb</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <source url="http://breachblog.com/2008/07/18/bms.aspx">Backup tape is stolen from Bristol-Myers Squibb</source>
    </item>
    <item>
      <title><![CDATA[Backup Tape With Private Details Stolen From Greensboro Gynecology Associates]]></title>
      <link>http://securityratty.com/article/7ae3b6b68e5e21daa4a091e5ff7a6fbd</link>
      <guid>http://securityratty.com/article/7ae3b6b68e5e21daa4a091e5ff7a6fbd</guid>
      <description><![CDATA[Patients at a Greensboro doctors office have been notified that their personal information - including Social Security numbers and addresses - was stolen in May. In a letter mailed to patients,...]]></description>
      <content:encoded><![CDATA[Patients at a Greensboro doctors’ office have been notified that their personal information - including Social Security numbers and addresses - was stolen in May. In a letter mailed to patients, Greensboro Gynecology Associates said a backup tape of their computer database was stolen. The letter was dated June 16, but some letters weren&#8217;t postmarked [...]]]></content:encoded>
      <pubDate>Thu, 17 Jul 2008 19:35:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/greensboro gynecology">greensboro gynecology</category>
      <category domain="http://securityratty.com/tag/backup tape">backup tape</category>
      <category domain="http://securityratty.com/tag/greensboro doctors office">greensboro doctors office</category>
      <category domain="http://securityratty.com/tag/computer database">computer database</category>
      <category domain="http://securityratty.com/tag/letter">letter</category>
      <category domain="http://securityratty.com/tag/social security">social security</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/patients">patients</category>
      <category domain="http://securityratty.com/tag/letters">letters</category>
      <source url="http://cyberinsecure.com/backup-tape-with-private-details-stolen-from-greensboro-gynecology-associates/">Backup Tape With Private Details Stolen From Greensboro Gynecology Associates</source>
    </item>
  </channel>
</rss>
