Humans Continue To Be "Weak Link" In Data Security 117
Posted
by
CmdrTaco
from the handcuffs-please dept.
from the handcuffs-please dept.
ChiefMonkeyGrinder writes "Nearly 90 percent of IT workers in the UK have said a laptop in their organization has been reported lost or stolen, new research has found. Sixty-one percent said that this then resulted in a data breach, according to the '2010 Human Factor in Laptop Encryption Study: United Kingdom,' a report produced by the Ponemon Institute for Absolute Software."
Usernames in browsers (Score:4, Interesting)
I noticed that browsers have a neat habit of storing userames that you've used on various sites, and help pre-fill the username field with that information.
It would be much more helpful if those usernames didn't bleed across servers; it would really cut down on potential exploits, and helps me remember which one of my usernames for a given site is correct (especially before I crack open the encrypted volume to lookup the real username/password combo.)
Human is the weak link in anything (Score:5, Interesting)
Any procedure, any system, any protocol, anything fails 9 out of 10 times due to human error. Why we let these insecure parts remain a critical part in anything is beyond me.
Re:Encrypt your sh*t. Or you aren't a professional (Score:2, Interesting)
Like what? The code for the project I'm working on? Or are you suggesting I encrypt my entire production database that I can access over a VPN from my notebook?
If you have shit on your laptop that needs encryption, you aren't a professional.
Re:Security Failings (Score:4, Interesting)
Then have them store it in a more "secure" location like in their wallet or their keyring. Some people can't even look after those adequately of course.. but at least you'll know if you've lost them that you should change your passwords.
Re:Encrypt your sh*t. Or you aren't a professional (Score:5, Interesting)
A question that should be asked more though that it currently is, is why do you need this data on easily stolen device. For example, why do customer records need to be on a laptop, why is this confidential document on a USB stick?
In my work place, no one can transfer anything off our internal network via data transfer. USB sticks will not be detected by machines. There are no open ethernet cables so if you try to connect a laptop to the cable running into your machine, it wont work. If anyone wants anything taken from the network, they need to raise a request and then if its granted, they will get the data encrypted and placed on a USB stick or laptop of their choice. We have a record of where things were taken from, when they were, requested by whom, authorised by whom. Users may find it slightly inconvenient but our data is secure, controlled and even in the event on a lost laptop or USB stick, we know that its encrypted to a high standard
Re:Security Failings (Score:5, Interesting)
If IT departments really would care about password security, and insist on complex passwords AND not writing them down, they should start treating a forgotten password as something normal, and not a chance to ridicule that poor guy who forgot it again.
Whats worse for security? Resetting that poor guys password twice a week or have him trying to avoid is by using a post it under his keyboard?
Re:Hmmm ... (Score:4, Interesting)
Re:Not a great thing. (Score:2, Interesting)
Get a longer password. Get a bigger matrix with more noise.