MoD prays RAF disk thieves aren't data savvy
Discussion
http://www.theregister.co.uk/2008/09/29/raf_usb_dr...
text
"Personal details of potentially all current and ex-RAF personnel and dependents were stored on three USB-connected storage drives which went missing from a Ministry of Defence establishment at Innsworth, Gloucestershire."
"Two of the drives contained personnel details such as MoD email addresses, appraisal results, and bank details."
text
"Personal details of potentially all current and ex-RAF personnel and dependents were stored on three USB-connected storage drives which went missing from a Ministry of Defence establishment at Innsworth, Gloucestershire."
"Two of the drives contained personnel details such as MoD email addresses, appraisal results, and bank details."
tonyvid said:
We have just had all our USB sticks changed to encrypted ones now - they are a bit of a fag to use but I can really see the point.
Because your company then has a get out clause if you lose one..."But don't worry they're all encrypted"
Edited by SirTainly on Monday 29th September 16:57
I locked down all the USB ports on all company machines. USB sticks/drives are just asking for trouble. If you want to remove data, it's done through an authorised member of staff, on an encrypted device.
People moan, but only because they can't illicitly plug in their USB devices anymore. There was opposition when we encrypted all the laptops, but people got used to that too.
Some companies data auditing and security is shocking. I know of a few places I could simply use a generic login and rip sensitive databases to a portable drive. They simply don't seem to care until it all goes wrong.
People moan, but only because they can't illicitly plug in their USB devices anymore. There was opposition when we encrypted all the laptops, but people got used to that too.
Some companies data auditing and security is shocking. I know of a few places I could simply use a generic login and rip sensitive databases to a portable drive. They simply don't seem to care until it all goes wrong.
grumbledoak said:
This rather seems to amount to the MoD hoping that the thieves aren't as stupid as they were! 
I think they're hoping someone just stole them to have spare harddisk, that could make sense if they were left lying around or on a train but from behind 'secure' locked doors makes it look intentional. Feel sorry for those affected but I guess once national ID system collapses we will all be in the same boat.Badgerboy said:
I locked down all the USB ports on all company machines. USB sticks/drives are just asking for trouble. If you want to remove data, it's done through an authorised member of staff, on an encrypted device.
People moan, but only because they can't illicitly plug in their USB devices anymore. There was opposition when we encrypted all the laptops, but people got used to that too.
Some companies data auditing and security is shocking. I know of a few places I could simply use a generic login and rip sensitive databases to a portable drive. They simply don't seem to care until it all goes wrong.
you would be suprised the number of companies I have visited to impliment Network Management solutions to find default user accounts and snmp strings being used on routers, switches and even firewalls.People moan, but only because they can't illicitly plug in their USB devices anymore. There was opposition when we encrypted all the laptops, but people got used to that too.
Some companies data auditing and security is shocking. I know of a few places I could simply use a generic login and rip sensitive databases to a portable drive. They simply don't seem to care until it all goes wrong.
Want a backdoor .. try cisco / cisco or admin / admin I could name 3 london based Banks, one European telco and around 5 or 6 insurance companies in london who have ahd to be "educated" in simple security.
and dont even start to mention Wifi ...
Ive had to comply with MOD security protocols and, to be honest, they work... ive always said though .. the best data secure network is protected by 30cm of air between the network card and the switch .. ie offline !
Edited by JVaughan on Monday 29th September 17:04
)Ed. said:
I think they're hoping someone just stole them to have spare harddisk, that could make sense if they were left lying around or on a train but from behind 'secure' locked doors makes it look intentional. Feel sorry for those affected but I guess once national ID system collapses we will all be in the same boat.
Their 'hope' seems closer to 'clutching at straws', or 'spin'. Hey-ho, the MoD couldn't find it's arse with both hands, "News at 11".JVaughan said:
Ive had to comply with MOD security protocols and, to be honest, they work... ive always said though .. the best data secure network is protected by 30cm of air between the network card and the switch .. ie offline !
That pretty much is the most secure MOD protocol. I worked at AWE briefly and their network is entirely seperated from the outside world. Email is handled via a server not attatched to the main network and transferred across via tape a couple of times a day.hairykrishna said:
JVaughan said:
Ive had to comply with MOD security protocols and, to be honest, they work... ive always said though .. the best data secure network is protected by 30cm of air between the network card and the switch .. ie offline !
That pretty much is the most secure MOD protocol. I worked at AWE briefly and their network is entirely seperated from the outside world. Email is handled via a server not attatched to the main network and transferred across via tape a couple of times a day. and most security breaches occur when a human doesn't follow protocol, not a hardware or software failure, but a person deciding to do something they shouldn't.SirTainly said:
tonyvid said:
We have just had all our USB sticks changed to encrypted ones now - they are a bit of a fag to use but I can really see the point.
Because your company then has a get out clause if you lose one..."But don't worry they're all encrypted"
I think it has been forced upon us to maintain our secure status, only these USB sticks will work on the network machines and there has been a complete separation of all the different networks now, not even an air gap switch is allowed. Quite right. I also agree that you can have as many procedures as you like but it is usually a muppet flouting the system that causes the problems.
Encrypt laptops and removable hard drives but little can be done to stop cheap,lowlife crooks stealing the hardware and flogging on ebay.
http://uk.news.yahoo.com/pressass/20080930/tuk-mi6...
http://news.bbc.co.uk/1/hi/technology/7635622.stm
http://uk.news.yahoo.com/pressass/20080930/tuk-mi6...
http://news.bbc.co.uk/1/hi/technology/7635622.stm
Gassing Station | The Pie & Piston Archive | Top of Page | What's New | My Stuff