Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security IT

Ohio Plans To Encrypt After Data Breach 237

Posted by kdawson from the shutting-the-barn-door-after-the-horses dept.
Lucas123 writes "After a backup tape containing sensitive information on 130,000 Ohio residents, current and former employees, and businesses was stolen from the car of a government intern in June, the state government just announced it has purchased 60,000 licenses of encryption software — McAfee's SafeBoot — for state offices to use to protect data. It's estimated that the missing backup tape will cost Ohio $3 million. In September, the state docked a government official about a week of future vacation time for not ensuring that the data would be protected."
This discussion has been archived. No new comments can be posted.

Ohio Plans To Encrypt After Data Breach More

Ohio Plans To Encrypt After Data Breach

Comments Filter:

  • hindsight is 20/20 (Score:2, Insightful)

    by Endloser ( 1170279 )
    People just won't learn that security should be proactive. Society is a very slow learner.
    • Especially when senesitive data is given to an intern. Doesn't anyone read Dilbert?

  • Backups Won't Be Encrypted (Score:5, Insightful)

    by nuxx ( 10153 ) on Tuesday December 11, 2007 @05:28PM (#21663663) Homepage
    Er, while this software encrypts data on the disk, it doesn't encrypt the backups. These will still be cleanly read from the disks and written out to tape.

    • And? (Score:3, Insightful)

      by Colin Smith ( 2679 )
      Your problem is? They have been seen to have done something.
       

      • Re: (Score:3, Insightful)

        by barzok ( 26681 )
        Sure, they did "something."

        But they didn't address the problem that actually led to the breach. They're encrypting laptops, but it was backup tapes which were compromised. No mention of those getting encrypted.

    • Re: (Score:2)

      by afidel ( 530433 )
      I would bet they are also going to use encryption in their backup procedure, either in the backup software (inexpensive licensing but expensive in CPU time and hitting backup windows) or by purchasing new tape libraries/drives with crypto modules (not so cheap, though a few vendors offer it at little extra cost once you've already bought the expensive library).

    • Re: (Score:3, Insightful)

      by palegray.net ( 1195047 )
      You make the assertion that this software won't encrypt the backups. Please answer the following questions:

      1. What are your sources for that assertion?

      2. Have you personally used the software?

      3. Have you seen this page [safeboot.com]?

      Next time, please think before posting. If you're 100% sure your original statement is valid, I'll gladly stand corrected and eat a healthy slice of humble pie.
      • I just checked that page, and while I may be jumping the gun a bit, I see no mention of "backup" or "tape". Thus, I can only conclude that unless their backup software itself separately encrypts the backup, or unless the backups are full disk images (taken while the OS is shut down), the backups will not be encrypted.

        Of course, those are a couple of assumptions, but they're pretty likely ones.

        Disclaimer: I'm not the grandparent poster.

  • 60,000 licenses? (Score:4, Interesting)

    by Knara ( 9377 ) on Tuesday December 11, 2007 @05:29PM (#21663673)
    Couldn't they have found an OSS solution that would have, y'know, saved the state an assload of money? I'm not an "OSS can do everything commercial software can, but better!" zealot, but that's a big bit of pocket change to be throwin' out for a solution, there.
    • There are no Open Source FDE solutions, although some of the commercial products use OpenSSL.
      • Explain what the requirement of FDE is.

        I currently boot my laptop off a USB stick. While I have only configured it to use every single partition encrypted (Linux root, swap, and shared NTFS with Windows), it would be a small step to encrypt the whole disk. (Of course, then I couldn't boot Windows.) I don't currently have passphrases on the key files on that USB stick, but I don't use it for anything else, and, again, that would be a small step.

        Obviously, the USB stick cannot itself be encrypted. Must there
    • Hmm, www.safeboot.com [safeboot.com] seems real secure. What's not to like? ;-)

    • Re: (Score:2, Insightful)

      by account_deleted ( 4530225 )
      Comment removed based on user account deletion

      • I know this is a terrible excuse, but paying for a solution *may* make the ignorant masses feel better.

        taxpayer: "hey you could have prevented this disaster without spending an assload of money? WTF!"

        More to the point, if there's another incident after they buy the software, they can blame McAffee...

        Free Software Fails: "Thrifty" fellow who decided to use it gets burned ("Why did you cut corners on important security stuff? Why didn't you shell out some money for a real solution?")
        McAffee Software Fails: Buyer takes some heat ("why did you buy that crap?") but seller takes more heat (their product is demonstrated ineffective in a widely published story...)

        The fact that there's a software company moti

        • "Why did you cut corners on important security stuff? Why didn't you shell out some money for a real solution?" ...``Now you'll lose a whole week of future vacation time due to this multimillion dollar screwup!''
    • The only semi-mature opensource disk encryption product is TrueCrypt, and that completely lacks centralized management and the ability to encrypt boot partitions.

      Also, as is obvious to anyone who has been watching the news in the past year, the state of Ohio does not exactly have a stellar, top-talent IT program. It would not be a good idea for the to forge a new path with unsupported software.
      • What makes TrueCrypt less "mature" than, say, LUKS or good ol' Cryptoloop?

        And no software can give you the ability to encrypt boot partitions. Where do you suppose the software itself is stored, then? Maybe the Magical Crypto Fairies will decrypt it from the hard disk first thing? (Of course, I can always throw my boot partition on another device -- I currently boot my laptop off a USB stick.)
      • Central management is the key. Where I work, we would really like to switch from PGP to GPG but we can't because of the lack of ADK (Additional Decryption Key) functionality. This is a sort of master key which is held by the institution in case someone forgets their password or gets hit by a bus or some such thing. ADK is absolutely necessary because we have to ensure availability of data as well as confidentiality.

        On the Mac side, FileVault is good because it has central management but it has the one dr
    • It seems to me that unless they need or want whole disk encryption of the boot partition, which still doesn't answer the unencrypted backup tape question, that TrueCrypt [truecrypt.org] would have been perfect for them.

    • Re: (Score:3, Informative)

      by Chanc_Gorkon ( 94133 )
      Clueless state officials would say I need a nic ecushy service contract. It's called indemnification. If they buy software, they THINK that they can absolve themselves of anything if they have that service contract. I keep telling my friends who work at the state that even though something is techically their fault, it's still the their responsibility to keep the data safe. This encryption software will fix diddly if people:

      Share passwords
      Share logins
      Print stuff off on paper, take it home and lose it.

      and
  • Someone tell them they were supposed to encrypt the data before the breach!

  • Calling all Buckeyes! (Score:5, Funny)

    by pegr ( 46683 ) * on Tuesday December 11, 2007 @05:30PM (#21663705) Homepage Journal
    Help me close this barn door, would ya?
    • Right now there's either zero, one, or a small number of scammers who've got a copy of that one data set and the skills to sell it to somebody who can abuse it. It's obviously not good, but there are millions of scammers out there and thousands who've got the skill sets to do something with it who don't have it yet, and many other sets of data that the state has which are even easier to abuse.

      Of course, if you parse the Slashdot article title, you'd think that Ohio plans to do lots of remedial encryption *

  • Gotta love government jobs... (Score:5, Funny)

    by Stanislav_J ( 947290 ) on Tuesday December 11, 2007 @05:30PM (#21663709)
    The state loses $3 million bucks, and the guy responsible gets the punishment of a whole week of lost vacation time? Wow....I want to find me a job where I can screw up so badly and get off so lightly. I mean....other than the Presidency.

    • Re: (Score:2)

      by syousef ( 465911 )
      If it wasn't standard practice to encrypt the data, and if it was standard practice for this guy to be required to carry the tape in his car, I'd argue he was made a scapegoat even if it is just a week's vacation that he lost. Unless of course the guy is responsible for setting policy/procedure (but even then someone should be reviewing that and signing off).
    • Not only that, but his job is already practically vacation!

      • Re: (Score:2)

        by Minwee ( 522556 )
        "If anything can go wrong, it will." - Murphy

        Finagle [wikipedia.org], actually. Murphy's Law has a subtly different meaning.

        Interestingly enough, referring to Finagle's Law as Murphy's is itself an example of Murphy's Law in action.

  • What ya want to bet... (Score:4, Funny)

    by lax-goalie ( 730970 ) on Tuesday December 11, 2007 @05:34PM (#21663763)
    ...that the next time they get a backup tape stolen, it'll have a post-it note stuck to the tape with the password on it?
    • You'll also be aware of the various rows here in England as the government displays its new networking technology: CDs and a courier. Most of us with medium-sized data farms (I herd about 50TB) are getting out of removable media as fast as we can. I've got 20TB of disk at the far end end of 30 miles of GigE, which with compression (all hail ZFS!) provides me enough space to keep copies of all the critical data, plus a few weeks of daily snapshots. My RPO is ``that day's work'' and my RTO is essentially z

      • Re: (Score:2)

        by SendBot ( 29932 )
        Wow, I wrangle a good bit of data for my personal use, but you're obviously in a league well above mine.

        So how does MAID compare to RAID?

  • A week's vacation? (Score:5, Interesting)

    by Jester998 ( 156179 ) on Tuesday December 11, 2007 @05:36PM (#21663773) Homepage
    the state docked a government official about a week of future vacation time for not ensuring that the data would be protected

    I work as a DBA in a nonprofit healthcare organization. If our backup guys lost a tape, and I hadn't bothered to check off the box in our database backup software that says "Encrypt: 256-bit AES", I would lose my job.

    This guy got dinged a whopping 1 week of vacation time. That's not even '1 week suspended without pay'. It's the equivalent of having to stay in detention after school.

    I need to move over to the public sector or something.

    • Re: (Score:3, Insightful)

      by GodfatherofSoul ( 174979 )
      Oh please. We've seen mistakes FAR bigger than this in the private sector with less or no consequences. And, if every software outfit canned its employees after a single mistake of whatever scale, there'd be a heck of a lot more turnover in IT.
      • And, if every software outfit canned its employees after a single mistake of whatever scale, there'd be a heck of a lot more turnover in IT.

        They frequently do. It's just that it usually isn't the person that's actually responsible because they found a scapegoat.

    • Re:A week's vacation? (Score:5, Insightful)

      by syousef ( 465911 ) on Tuesday December 11, 2007 @07:41PM (#21665223) Journal
      I work as a DBA in a nonprofit healthcare organization. If our backup guys lost a tape, and I hadn't bothered to check off the box in our database backup software that says "Encrypt: 256-bit AES", I would lose my job.

      What you need to ask is what was the procedure and was the guy following it?

      If it's standard procedure for this guy to carry unencrypted data around in his car, it's the guy setting policy/procedure that should be made responsible.

      If it is standard procedure for you to encrypt your data, and you fail to follow that procedure you should be disciplined. Better still would be to find a way to make that little check box for encryption on by default. Even better would be to find a way to restrict export without encryption unless it's authorized by a second person. It shouldn't be easy for you to make a mistake that could cause you or your company massive damage.
      • Very good points, actually. At my place of employment, we're a fairly small IT department -- I'm the sole DBA, so by default any policy relating to database operation/security/etc originate with me anyways (although formal policies get approved by the department's director). So, at least in my case, whether it's from lack of policy or breach of policy, it's all on my head anyways. :p

        In larger shops, I definitely agree with you. There should be both policies *and* technology in place to prevent violations
  • Instead of using software, I wonder whether an IDE or SATA connector could be developed that encrypts and decrypts the data going to and from the drive. Basically your organisation would enter a key into the connector and the encryption would happen without the OS knowing. If you remove the drive then you wouldn't be able to use the drive without the connector.

  • WTF (Score:3, Interesting)

    by zappepcs ( 820751 ) on Tuesday December 11, 2007 @05:44PM (#21663895) Journal
    I saw four horrifying words...

    Intern, backup tape, car

    encryption is probably low on the list of security concerns here... just WOW

    I absolutely know that I don't want to hear the story of how those four words got used in the same sentence until happy hour is nearly over.

    Those 4 words should never be needed in the same sentence. Process is just as important as encryption. That should have been 'backup tape', security company, armored transport, iron mountain in the sentence... oh wait, then there would be no story.

    • Re:WTF (Score:5, Funny)

      by fireboy1919 ( 257783 ) <rustyp@@@freeshell...org> on Tuesday December 11, 2007 @06:01PM (#21664137) Homepage Journal
      I absolutely know that I don't want to hear the story of how those four words got used in the same sentence until happy hour is nearly over.

      Yeah? Well, I wouldn't mind. Not the sentence they added.

      Perhaps this one:

      "After I checked the backup tapes to ensure that 512-bit AES encryption was working, and that the tapes were still readable, I closed and deadbolted the tape room, and then went out to my car to go to lunch with the new (darn good looking) intern from the art department."
    • Maybe the Ohio department has such MI-5-like employees that they need interns as decoys?

  • How Long Before... (Score:2, Insightful)

    by Anonymous Coward
    ...we see a story about 130,000 residence records locked and unavailable due to lost encryption passwords?

  • Brings me back to the question.... (Score:5, Insightful)

    by ducomputergeek ( 595742 ) on Tuesday December 11, 2007 @05:49PM (#21663945)
    WTF is this stuff doing on laptops in the first place?

    It seems logical to me that this kind of information should be on a centralized servers at a state office with managed firewalls and all the rest with only hardwired terminals allowed access with maybe a VPN set up for remote access if absolutely needed out in the field. I know wireless isn't 100% secure and no system is but that just makes logical sense to me.

    • Re: (Score:3)

      by afidel ( 530433 )
      Yeah a county agency (in Ohio) I had as a client was one of the most paranoid I've ever dealt with. The dealt with personally identifiable information of a very sensitive nature and they did things right. Everything was static IP with all LAN information captured to a secure auditing station with IP, MAC and port info recorded. The website their clients (service providers) connected to was behind a good firewall that had rules allowing only a single registered IP to connect from each provider and then used
    • O-Hai-Yo Arrrht... Etch-Uhhh-Sketch...

      Maybe they think laptops are high-tech Etch-A-Sketches and cannot be networked?

      I guess in the end, the department head will be "shaken", but not "stirred", happy hour or not.
  • Great, now they have a tool to encrypt! Let's hope they thought about key management before implementing it. It's great for vendors that some have no idea of security - more sales. Next we will read all the keys stolen by an employee (usually high in hierarchy, just my experience) and have to start all over again. Or am I too pessimistic / skeptical when it comes to security?

  • They led the horse to water... (Score:5, Interesting)

    by Darth Muffin ( 781947 ) on Tuesday December 11, 2007 @05:55PM (#21664041) Homepage
    ... but can't make it drink. Encryption is only a partial solution. You still need to keep your backup tapes secure (they won't be encrypted by this software, but most higher end backup software will), and you need to keep people from copying files to USB sticks or burning to CD.

  • I Call Bullshit (Score:2, Insightful)

    by pseudorand ( 603231 )
    Encryption is crap unless it's used by those trained to understand how it works and what it's limitations are, which I'm sure 60,000 employees will not be. What happens when an employee copies data to a USB disk or e-mails it to someone. If the software prevents this, it will be a major pain in the arse that will cost a lot more than $3 million in lost productivity. If it doesn't, then data will get stolen and everyone will say "no problem, it was encrypted", until massive identity theft cases force them to

    • Re: (Score:2, Insightful)

      by Starteck81 ( 917280 )
      Have you ever tired to teach a lot of non-technical people to follow security procedures? I work for a CPA firm that takes security pretty seriously. All of our hard drives encrypted. We have a secure webportal to transfer files instead of sending them via e-mail. We have encrypted usb thumb drives.

      We have tried to train our employee's to use these tools so as to be secure but I still catch people sending things via e-mail and using unencrypted USB drives that they bought. It's not a huge percentage of

  • SafeBoot? The poor bastards. (Score:5, Informative)

    by jrronimo ( 978486 ) on Tuesday December 11, 2007 @05:59PM (#21664109)
    Part of my job involves working on laptops owned by an agency that uses SafeBoot to encrypt data on laptops. Gather children, let me tell you of SafeBoot...

    1. SafeBoot is whole-disk encryption, but Windows-partitions-only. If you dual-boot or use Linux, there is no solution for you except "Please don't lose your laptop".
    2. SafeBoot requires a login before you can boot Windows. If you get your password wrong, you must wait a certain amount of time before you can re-enter your passwords. At first, it's not that bad -- a few seconds. But each successive failure increases the time... eventually, you're waiting minutes.
    3. SafeBoot encrypts the drive so that you can't access the drive from another machine -- which is what it's designed for, of course. Try being an IT guy in this scenario: You can't perform ANY troubleshooting that doesn't involve booting Windows. If Windows fails to boot, you have to have your hard-drive decrypted (which, for us happens off-site and is a MAJOR pain in the ass). I cannot boot off a Windows CD to use the recovery console to replace damaged registry files. I cannot do a 'repair' install. I could wipe the drive and re-install Windows...
    4. The password policy in place requires users to change their password periodically and be of a certain complexity level. Most users have their SafeBoot password written on a piece of paper and taped to their machine, now...

    There's a line between security and usability. When SafeBoot works, it appears great -- it doesn't impact system performance *that* much and it encrypts the contents of the entire drive, woo. But when something goes wrong, it becomes a big pain.

    To be honest, though, I think the bigger problems for the work *I* run into with SafeBoot is the policies in place, rather than SafeBoot itself.
    • Interesting.

      In the Unix world, you could just encrypt the $HOME directory of all the users and simply not give them the rights to write outside of that directory. Make sure you don't deploy applications which both keep sensitive data and run as root ... and success!

      Unless Ohio is doing something top-secret with the OS their users are running, I guess I only see the need for encrypting the entire drive when there aren't sufficient security policies in the first place.

      Then again, I can do plenty of developme

      • Re: (Score:3, Informative)

        by Locklin ( 1074657 )
        you forgot /tmp and the swap partition. You might want /var as well if there is sensitive data in the logs. Realistically, you probably need to prevent mounting of disks or USB drives as R/W. Than again, theres probably a few other vulnerable spots on a Unix computer.

        Unix great, but it's not as simple as you put to secure it from threats that have physical access to the machine.

        • Yeah, I assumed there were a couple of directories I was overlooking.

          Point is that you ought to be able to easily separate "these are the directories users can touch" from the "these are the directories which users can't touch". In fact, RedHat did some work on this (look up Stateless Linux). I suspect you can come up with a list of N directories (where N 10 or so) which must be encrypted, and let the OS portions be un-encrypted.

          Set up a rat's nest of soft-links to an encrypted partition, make sure the i
  • The way it's worded seems a little ambiguous to me. Did the theft alone cost the state $3 million or did the theft cause the state to spend $3 on licensing a product from mcafee? Both sound like reasonable figures when dealing with the public sector and taxpayer money.

  • Isn't going to help (Score:3, Insightful)

    by belthize ( 990217 ) on Tuesday December 11, 2007 @06:04PM (#21664191)
    If they have 60,000 computers with 'sensitive' data on it then they're borked already.

          If they want to encrypt people's laptops/desktops then fine ... if they want to prevent
    personal civilian data from leaking out they're off by a few orders of magnitude on the
    extent of their distributed storage.

    Belthize

  • TrueCrypt (Score:2, Informative)

    by bruno.fatia ( 989391 )
    TrueCrypt is a very nice free solution and I've been using it for months, haven't had a single problem with it. I guess they were not aware of that software, maybe because they simply didn't look for ANY other products beside McMoney's..
    • I was going to post the same thing but I searched for your post first (hey, apparently I'm smarter than Ohio govt :P )

      My guess is that after the breach, McAffee contacted the guys, who, obviously, haven't got a clue, and in a knee-jerk reaction said "yes, please!".

      All those tax dollars... what a waste.
  • The government has a software package they use for such things already. The Macafe stuff it's weak in comparison.
  • You can joke about this being a case of closing the barn door long after the horses have gone scurrying into the country side but......someone got punished and a preventative measure is being taken. You can't hope for a whole lot more than that, especially from a government agency.
    • We are the ones who are constantly telling people to implement things like encryption.

      They either think we're paranoid, or... I don't know what the fuck they think. Probably just don't want to deal with it...

      So now they've been bitten, and now they "get it".

      Any time someone finally admits you've been right all along, especially when it's a bit too late to prevent the damage, is cause for both glee and frustration.

      Now, I'm not saying that them adopting encryption now is a bad thing, though maybe the particul
  • What's the use to encrypt your hard drive just to make a nice decrypted backup later? Conversely, this particular problem can be probably solved cheaper, since I doubt that they have 60000 tape drives in the office. Any decent backup software should already support encryption anyway.

    I am not saying workstation security is not important, but here it sounds like someone doesn't even understand the problem that they had.

  • ..one gpg command in between tar and the output device.

    Why, oh why, didn't I become a government contractor?!?

    • Why, oh why, didn't I become a government contractor?!?

      Have you looked at what the government pays lately? There is a reason that this stuff happens. In Washington State, at least, government pay grades are about 1/2 to 2/3 of what you can make in the private sector for the same work. If you consult, you can easily make 3 times what the government pays.

      You get what you pay for.
      • Look at the subject, though.

        Apparently, they're willing to pay for 60,000 licenses, rather than one slightly more intelligent admin?

  • Horse gone - Elephant still in room (Score:4, Insightful)

    by toby ( 759 ) * on Tuesday December 11, 2007 @07:06PM (#21664909) Homepage Journal
    Hmm... I wonder if they give a damn that their state-wide reliance on Windows is another accident waiting to happen.

    Care about trojans, keyloggers, viruses, and all the other uncountable ways to lose confidential data, not to mention productivity?

    Get rid of Windows as well. You'll never regret it.
  • hmmm My money is at stake so what do they do? They pay for this solution with my money!
  • It was due to general incompetence and cutting corners, and the lack of security on the entire OAKS project, which was virtually nonexistant. A shared drive was left open during project development, and it had been discovered many times that people who weren't involved in the project could log in download personal info. My cousin in law interviewed various employees and wrote a good article for the Cleveland Free times: http://www.freetimes.com/stories/15/28/system-failure [freetimes.com] .
  • The data shouldn't be stored on the local machines. It should be in a centralized database that supports encryption at least at the table level, if not the specific field level. That database should be accessed by a client workstation that doesn't cache the data locally. Then the backups should be password protected and encrypted. This isn't exactly rocket science here.
  • We'll have data utterly lost. "We lost the piece of paper with the password." Whee!

  • Some clarifications (Score:4, Informative)

    by RJurden ( 1201957 ) on Tuesday December 11, 2007 @11:12PM (#21667095)
    First 2 factual clarifications on this story: The stolen "tape" was actually a "device" that has not been officially disclosed as to what type. Some speculate a laptop while others say it was a USB Flash Drive. Second, nearly 1 million people are estimated to be affected by the theft, not 130,000 as the story states.

    Well....okay. I live in Ohio and therefore could be in the group of State of Ohio employees, state taxpayers, Ohio lottery winners, and others and since it regarded social security numbers bank account information and such, along with the fact that the theft happened in my hometown of Hilliard, I paid close attention to the story.

    What ACTUALLY happened was an INTERN took the device home for whatever reason. Some speculate to have an off-site backup of the data. The intern left it in their car and their car was broken into and the device was stolen.

    To clarify the cost: Ohio is providing, free of charge, 1 year of credit monitoring service to each Ohioan that was affected by the theft. That cost estimate is very high. Even at a bargain basement price of $2 per year per taxpayer, that would be about $2 million. The lowest price you can find online is $4.95 per MONTH and about $60 per year.

    Further: The official that lost vacation time was not the intern that took the drive home. That official lost the time because they were responsible for ensuring the safety of the data to begin with. Although the intern is the person in possession of the data and should have verified its safety, they were following the procedure that official set up. The intern is not the only one responsible for the theft.
  • but whoever was responsible for a breach of that magnitude should be also be encrypted, right after he's properly embalmed.
  • Here's what I think really happened, folks:

    1. Government official gets idea to make a bit of money.
    2. Official gives intern important tape, knowing it will be left in the car.
    3. Official knows where intern lives, and goes and steals tape from car.
    4. Official sells data on the black market for a dollar value far in excess of a week's vacation time.
    5. Official gets to keep his job.

    There is no "???" step here.

    Really, what are the chances that this intern gets his car broken into on the VERY SAME DAY he happens

Slashdot Top Deals

Term, holidays, term, holidays, till we leave school, and then work, work, work till we die. -- C.S. Lewis

Close