Ohio Plans To Encrypt After Data Breach 237
Lucas123 writes "After a backup tape containing sensitive information on 130,000 Ohio residents, current and former employees, and businesses was stolen from the car of a government intern in June, the state government just announced it has purchased 60,000 licenses of encryption software — McAfee's SafeBoot — for state offices to use to protect data. It's estimated that the missing backup tape will cost Ohio $3 million. In September, the state docked a government official about a week of future vacation time for not ensuring that the data would be protected."
hindsight is 20/20 (Score:2, Insightful)
Backups Won't Be Encrypted (Score:5, Insightful)
What is my data doing outside anyway? (Score:1, Insightful)
How do you log and audit access to data to prevent abuses if you just hand out copies of databases?
How Long Before... (Score:2, Insightful)
Brings me back to the question.... (Score:5, Insightful)
It seems logical to me that this kind of information should be on a centralized servers at a state office with managed firewalls and all the rest with only hardwired terminals allowed access with maybe a VPN set up for remote access if absolutely needed out in the field. I know wireless isn't 100% secure and no system is but that just makes logical sense to me.
And? (Score:3, Insightful)
Re:A week's vacation? (Score:3, Insightful)
What are these backup tapes, Kemo Sabe? (Score:3, Insightful)
I Call Bullshit (Score:2, Insightful)
And what happened to Encrypted File System. You know, built-in to NTFS, complete with administrative recovery keys, doesn't cost $3 million? This sounds like just more government waste and McAfee marketing to me.
Isn't going to help (Score:3, Insightful)
If they want to encrypt people's laptops/desktops then fine
personal civilian data from leaking out they're off by a few orders of magnitude on the
extent of their distributed storage.
Belthize
Re:60,000 licenses? (Score:2, Insightful)
taxpayer: "hey you could have prevented this disaster without spending an assload of money? WTF!"
Re:I Call Bullshit (Score:2, Insightful)
We have tried to train our employee's to use these tools so as to be secure but I still catch people sending things via e-mail and using unencrypted USB drives that they bought. It's not a huge percentage of people but it still happens and all it takes is one person not following the rules.
The point I'm trying to drive home is that at best you can only hope to mitigate your exposure to data theft. Encrypting your disks is a step in the right direction. As for your assertions that they use unencrypted USB drives and unencrypted e-mail well please sight a source that tells us for sure that they are unencrypted. Otherwise you're just making assumptions and we all know what happens when you do that...
Re:OpenBSD is the answer. (Score:2, Insightful)
Horse gone - Elephant still in room (Score:4, Insightful)
Care about trojans, keyloggers, viruses, and all the other uncountable ways to lose confidential data, not to mention productivity?
Get rid of Windows as well. You'll never regret it.
Re:A week's vacation? (Score:5, Insightful)
What you need to ask is what was the procedure and was the guy following it?
If it's standard procedure for this guy to carry unencrypted data around in his car, it's the guy setting policy/procedure that should be made responsible.
If it is standard procedure for you to encrypt your data, and you fail to follow that procedure you should be disciplined. Better still would be to find a way to make that little check box for encryption on by default. Even better would be to find a way to restrict export without encryption unless it's authorized by a second person. It shouldn't be easy for you to make a mistake that could cause you or your company massive damage.
Re:Wonder if McAfee payed them (Score:5, Insightful)
The brick being stolen is a security breach, and the information that was carved into it is now to be considered 'out in the open.'
Security through obscurity? Get real.
Re:Backups Won't Be Encrypted (Score:3, Insightful)
1. What are your sources for that assertion?
2. Have you personally used the software?
3. Have you seen this page [safeboot.com]?
Next time, please think before posting. If you're 100% sure your original statement is valid, I'll gladly stand corrected and eat a healthy slice of humble pie.
Re:Wonder if McAfee payed them (Score:3, Insightful)
Truthfully, the only perfect security is a computer that's disconnected from the Internet, underground, in a locked room turned off with all the hard drive cables removed. And even then, "they" can probably read the information from their satellites in space. In the real world, we need to make compromises.
All of our company backups are encrypted using 256-bit AES encryption. If one gets stolen, I can't "guarantee" that the data hasn't been compromised. After all, someone with a few billion^10 CPU cycles to spare could crack the encryption algorithm. Sure, AES is trusted by the Pentagon, but that doesn't mean it's 100% infallible. In fact, there's a calculable mathematical chance that someone could guess the encryption key on the very first try, even without a supercomputer. It's damn unlikely, but certainly not impossible.
So the question comes down to this: what level of risk are you prepared to accept? More importantly, what level of security are you willing to pay for? Security isn't free. "Perfect" security (like nuclear launch codes, where failure is absolutely not an option) is very expensive. Would you be willing to donate a couple thousand dollars of your own money (along with every other taxpayer) to replace all computers in the country with ones that have hardware-level encryption? Is that good enough? Most of our customers are small, non-profit organizations already run on a shoestring budget. Most of them can't afford to hire a proper secretary, let alone an IT specialist who knows how to use TrueCrypt and enforce security policies.
Listen, I'm not arguing against data security. If you knew me personally, you'd know I'm a very security conscious individual, but I'm saying that we need to be realistic. We need to spend a finite amount of money where it will do the most good. Those millions of dollars in Ohio put towards useless credit checks were funneled directly away from our customers' already meager budgets. My boss is a nice guy, but he needs to keep the company running, so he can't donate our services. That money could have been spent on education, or updated hardware, or proper disposal of old equipment. Put in perspective, there are breaches far more egregious than this one that happen every day, and I can say first-hand that they are usually the result of ignorance. Some people don't know it's not OK to save a SQL backup to a USB key and take it home. Some people don't know that you have to DBAN a hard drive before you throw the computer away. These are far more dangerous than a lost (and probably trashed) AS400 backup.
Re:Technological revolution has been far faster... (Score:0, Insightful)
It's not that they can't adjust, it's that they don't want to adjust.
People are becoming stupider and lazier than any other period in modern history.
No one gives a shit how it works, just that it does what it's supposed to.
As our species moves forward into existence either they'll have to learn or be left behind.
It is no longer about survival of the fittest, it's about those who care and do not care.
I'd be happy to say those left behind would perish, but governments worldwide have enacted many laws and safety precautions which protect them from themselves.
We're doomed to cater to the stupidity and worthlessness of the masses well into the spaceage.
Re:And? (Score:3, Insightful)
But they didn't address the problem that actually led to the breach. They're encrypting laptops, but it was backup tapes which were compromised. No mention of those getting encrypted.