Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security IT

When Data Goes Missing Will You Even Know? 327

Posted by ScuttleMonkey from the average-joe-in-a-clean-room dept.
Lam1969 writes "Jack Gold says IT shops may have a huge problem on their hands, and probably don't know even know about it. The problem is USB flash drives, which he predicts will probably reach 10 GB in capacity in three years, and the lack of policies to guide use of them by employees. From the article: 'With more and more employees using flash drives, smart phones with Secure Digital memory cards, portable hard drives, etc., the likelihood of companies actually knowing about all instances of data loss is declining rapidly. And as a result, the possibility of companies breaking laws, whether for data-loss disclosure or regulatory compliance, is growing dramatically.' Gold predicts 'at least one publicized major case of unencrypted data loss from a portable device' in the next year, which will result in many companies banning these kinds of devices."
This discussion has been archived. No new comments can be posted.

When Data Goes Missing Will You Even Know? More

When Data Goes Missing Will You Even Know?

Comments Filter:

  • data has walked out the door before. (Score:5, Insightful)

    by yagu ( 721525 ) * <yayaguNO@SPAMgmail.com> on Tuesday January 24, 2006 @12:36AM (#14546363) Journal

    From the slashdot post:

    The problem is USB flash drives
    While there is truth to this, it is not a new truth and it is not the complete truth. It's one more mechanism for "losing" data but it's not the first and it won't be the last.

    It's an effective mechanism for moving large volumes of data, but it's not the only mechanism.

    Corporate espionage and theft has and will continue to exist. USB drives are just one more aspect. While there may be some "exposure" and scandal soon about some USB drive falling into the wrong hands I doubt it will surpass any of the recent scandals (lost tapes and customer data).

    Unfortunately, I'm guessing the article is correct in its prediction: "It is highly likely that within the next year, we will see at least one publicized major case of unencrypted data loss from a portable device. Afterward, a lot of companies will ban such devices". That would be a knee jerk reaction and counter productive but I'm already seeing it on so many other levels, e.g.,

    • restricted e-mail (filtered to death)
    • blocked IM
    • key logging

    among many others. I still think the greatest exposures are social engineering... and the paranoia around security policies don't address that. Sigh

    (And, besides, isn't the RIAA is working on a solution to apply DRM to USB drives too? ) ;-)

    • Re:data has walked out the door before. (Score:3, Interesting)

      by Anonymous Coward
      My company already has a policy banning them. Using a USB drive at work w/o permission will get your ass fired.

      • Re:data has walked out the door before. (Score:2, Funny)

        by Anonymous Coward
        What about the rest of your body?
      • ...and your computer doesn't have a CDRW/DVDRW on it of some form or another? You haven't secretly set up an ssh tunnel to an outside computer?

        You religiously put all your sensitive docs into the to-be-shredded container instead of the usual recycle bin (but people will still inadvertently put critical info in the regular recycle bins from time to time)?

    • We already hear about it (Score:5, Informative)

      by TheAxeMaster ( 762000 ) on Tuesday January 24, 2006 @12:43AM (#14546405)
      The company that I work for recently had a laptop stolen. It had personnel information for a large large number of employees (greater than ten thousand) and may or may not have been properly protected. I think that qualifies as pretty serious data loss, and it didn't need a flash drive to happen.

      Will it be more prevalent? Maybe. But it already happens. Now, the question is, is there a program that can encrypt/decrypt an entire (relatively) small drive with some sort of key system or something? I think that will be the most logical step to protect small drives like these.

      • Re:We already hear about it (Score:5, Insightful)

        by networkBoy ( 774728 ) on Tuesday January 24, 2006 @12:47AM (#14546416) Journal
        That is data loss (the notebook), assuming no backup. The idea of removing a _copy_ of the data is not loss, it is theft. A bit of distinction but important. I will notice data loss, not likely to notice the theft though.
        -nB

        • Re:We already hear about it (Score:4, Insightful)

          by anagama ( 611277 ) <obamaisaneocon@nothingchanged.org> on Tuesday January 24, 2006 @01:43AM (#14546626) Homepage
          I see it not so much as "loss" or "theft". Both terms imply that the data no longer exists where it is supposed to be. Loss means it's gone completely, theft that it has been taken in a "move" like scenario rather than merely copied. It seems a more appropriate term for this type of situation would imply the existence of the data in it's original location, and an unauthorized copy in an unknown location. This is much harder to detect because obviously, the original is still in tact -- absence of the data is a big clue something is amiss. Maybe the best term is simply "unathorized copy". In any case, the title mislead me -- I was thinking about HD corruption of small areas leaving me unaware that some of my data may go missing.

    • Re:data has walked out the door before. (Score:5, Informative)

      by xiphoris ( 839465 ) on Tuesday January 24, 2006 @12:49AM (#14546425) Homepage
      "It is highly likely that within the next year, we will see at least one publicized major case of unencrypted data loss from a portable device. Afterward, a lot of companies will ban such devices"

      No need for "afterward". Most companies that are extremely interested in protecting data (such as a large .com in Seattle for which I have worked) have banned such devices for years. No media may be used to transport company data except that which is explicitly allowed. In addition, no computer wireless devices of any sort (keyboard, mouse) may be used on company machines for security reasons. I'm sure that there are a lot of other similar rules, too, and all for good reason.

      It doesn't take a smart company to figure out that you don't want Billing.mdb on a floppy. USB is really no different. :)

      • Columnists Rehashing Old Scaremongering (Score:5, Insightful)

        by billstewart ( 78916 ) on Tuesday January 24, 2006 @05:13AM (#14547224) Journal
        Ok, Jack Gold's put a slightly more useful spin on it by talking about accidentally lost data as opposed to deliberately stolen data, but it's still the same old hash with scaremongering about USBs.
        • Briefcases get lost all the time, and briefcases have been large enough to contain sensitive information for decades now. Keychains also get lost on occasion, and especially for small businesses that's often enough to get in the building at night or steal a company truck.
        • Yellow Sticky Notes with your IP address and VPN password fit in your pocket just fine, and DSL means that people can suck up your data even faster than when we used to use Yellow Sticky Notes to carry modem phone numbers and dialup passwords.
        • Documents that are actually important are usually 1-100 pages long. You can store them on mashed-up dead trees if you avoid spilling coffee on them. Them newfangled USB thingies hold a lot of data, but back when we carried 3.5" floppy disks 20 miles through the snow uphill both ways , Microsoft Office wasn't as bloated, so a zipfile of The Secret Plans still usually fit in your pocket. That's not the same as carrying out the whole blueprints for your next chip in your pocket, but mini-CDs do pretty well - they're certainly enough to carry the HR personnel database home.
        • DVDs and CDROMs fit pretty neatly into briefcases, and most newer PCs have at least a CD burner, so you can still carry the chip blueprints home.
        • Laptops are easy to carry, and go missing all the time. The San Francisco Police aren't very good at recovering them even when they've got them in their evidence room and the thief in custody; your mileage may vary :-) And unlike keyrings and regular briefcases, laptops have obvious resale value so they're more attractive to thieves.
        • RM-05 removable disk packs are a bit big to fit in your briefcase, but magtapes fit just fine, and before magtapes we had ASR-33 paper-tape, which works just fine for carrying the Numerical Control tape that tells the milling machine how to cut your submarine-propeller plans.
        • Mainframes with Greenscreen 3270s are much less portable, but back when I worked for The Big Phone Company they were worried about people carrying computer printouts home, and they checked our briefcases on the way out the door of buildings that handled sensitive information.
        But yes, within the next couple of years, somebody's going to have a USB keyring/wristwatch/Walkperson/iPod/Pseudopod/somet hing get lost or stolen with sensitive information on it, and the press probably will fly off the handle telling us they told us so, and that we need to take precautions we've never taken before with laptops or CDROMs or whatever, and that's probably going to include silly bureaucrat tricks instead of getting major operating systems to have convenient encrypted file system support (and remember, "major operating systems" includes the OS's for portable music players and not just the computers they plug into.

  • Wow! (Score:2, Insightful)

    by Bobdoer ( 727516 )
    To think that malicious employees waited until flash drives to steal data! Dear god, what about paper printouts, hard drives, e-mail, and (dare I say it?) floppy disks?!?

    • Re:It's not the theft they're worried about (Score:5, Insightful)

      by halcyon1234 ( 834388 ) <halcyon1234@hotmail.com> on Tuesday January 24, 2006 @12:54AM (#14546453) Journal
      To think that malicious employees waited until flash drives to steal data! Dear god, what about paper printouts, hard drives, e-mail, and (dare I say it?) floppy disks?!?

      It isn't the theft of data that TFA is really concerend about.

      The real threat comes from actual LOST data. With portable storage media getting bigger and bigger, more and more data can be put on it. Including massive amounts of spread sheets and even databases. (I worked for one company that insisted on keeping a sensitive database on USB keys, to be sneaker-netted around to whoever needed it).

      Top that off with more and more USB keys floating around the office. Sure, right now, not every employee has one. Or, at best, every employee has just one. But it is becoming more and more prevellant to have "unowned" keys. In other words, a company buys a crapload, and people just grab whichever key is available at the moment to use.

      Soon, people will treat USB keys like they treat floppy disks; there'll be a big pile of them, and employees will just grab one as they need it.

      Because of this causal attitude towards USB keys, it'll become near impossible to track all the data. Employee X copies Spread Sheet A onto a key, takes it home to work on it, brings it back, and tosses the key back in the pile. You now have an unaccounted for instance of that data. Each time an employee does that, you have more and more instances of data that are unaccounted for.

      There's no guarentee that the employee will blank out the key. There's no way of tracking which data is on which key. So an employee might check out a key that has data on it that isn't theirs. There might be hundred of files on the key. Who knows. They don't. They won't care, either. They'll just copy thier files over, work on them, copy them back.

      So, each key has tons of data on it. If someone were to ask the CFO "Show me all copies of Sensitive Spread Sheet 5", they couldn't.

      Now, one employee checks out a key. They treat it just as casually as they would a floppy disk. They lose it somewhere. (Falls out of their pocket, gets left on the bus, etc). Now, a floppy disk might have just a tiny amount of information on it. A few documents. A couple spreadsheets. A USB key could have an entire database! Someone picks it up, and suddenly has the bank information for all the company's employees...

      That's the big issue there. Not that employees will sneak data away on USB keys (though that is a concern, too), but that employees will be too casual with large amounts of data and quite literally LOSE it.

      • As a company I think it would be no less then a wise investment to have a manufacturer make up a whack of keys that are write once - read once. The data can be verrfied (read) once within the same time frame as the write via onboard logic. After the next read logic kills the memory to garbage and start again.

        As well you could hardwire each employees biometric sig/reader into each key and have a couple boxes made up that only they can use. Let them use them as needed and let them know that each one is
      • The real threat comes from actual LOST data. With portable storage media getting bigger and bigger, more and more data can be put on it. Including massive amounts of spread sheets and even databases. (I worked for one company that insisted on keeping a sensitive database on USB keys, to be sneaker-netted around to whoever needed it).

        Was it their ONLY copy? Because if it was, they were dumber than a ton of bricks, end of story. And it was no fault of the media itself (flash or otherwise), it was human stupid
      • "That's the big issue there. Not that employees will sneak data away on USB keys (though that is a concern, too), but that employees will be too casual with large amounts of data and quite literally LOSE it."

        I don't see what the big deal is. Huge companies have had really really really important data stolen with no real effect or punishment. I mean things like social security numbers, credit cards, personal information, credit records etc. Do people even remember what happened with choicepoint? Does anybody
  • Dang, that reminds me, I need to figure out where my USB flash drive is....

  • Watch the log files! (Score:5, Insightful)

    by rcpitt ( 711863 ) on Tuesday January 24, 2006 @12:38AM (#14546371) Homepage Journal
    When I see the fact that a USB storage device has been inserted into a workstation or server, I question what (and who) did what.

    The log files don't lie!

    Of course if you can't find them, then it doesn't matter, does it? Does WinXX create a log file of USB insertion - damned if I know!

    • The log question may be legitimate. With all the questions about trusted computing, etc., from the business perspective, what about trusted components.

      As I am sitting here, I have come up a scheme that might work. 1) Each USB device has a unique key. 2.) Each key has to be registered at a central USB key server. 3.) When a USB device is plugged into a computer, the client machine queries the server to seek for authorization for the USB device to work, if the device is not authorized. 4.) Denied devices trig
      • OK - so you've invented DRM - Digital Rights Management - and it mandates that each portable digital container has a unique signature.

        My personal hacker (12 years old, immune from prosecution) just duplicated your key-fob's ID. What are you going to do about it?

        Check - and Mate!

        • Easy. I don't hold the key in plaintext.

          It gets held in a tamper proof SIM card.

          The key never actually gets transported nor is it known to anyone outside the USB key and the server.
          • "tamper proof SIM card

            That'll work. Just like all the other consumer devices that were marketed as secure -- and were cracked in two days after release. If the key is in the device, it will be known.

      • you could also just remove the USB mass storage device drivers from your standard disk image and have certain workstations with USB storage enabled which require a sogin as well as monitor which files are being sent to a USB drive.

  • Might not want to admit that... (Score:5, Insightful)

    by Red Flayer ( 890720 ) on Tuesday January 24, 2006 @12:39AM (#14546373) Journal
    "I had to invade the owner's privacy to see what I could discover from the content of the files."

    Wouldn't this be accessing files that you were not granted access to? Isn't this a crime in several US states, and is it really a good idea to admit to it in a column with your picture and name at the top?

    Just curious if the 'Good Samaritan' is putting himself at risk (and if it was curiosity or a desire to return the property that was the motivation).
    • i guess it's like going through a lost wallet to try to identify the owner.

  • dumb approach. (Score:5, Insightful)

    by Vellmont ( 569020 ) on Tuesday January 24, 2006 @12:40AM (#14546379) Homepage

    Gold predicts 'at least one publicized major case of unencrypted data loss from a portable device' in the next year, which will result in many companies banning these kinds of devices."

    Which will solve exactly nothing. What are you going to do, search everyone as they enter and leave the building? If you want to limit data theft, limit access to huge amount of data in the first place. That eliminates the risk to any new technology to get the data offsite.

    • Re:dumb approach. (Score:3, Insightful)

      by Descalzo ( 898339 )
      So if they do end up banning these things, what will they use instead. We use them because they are so handy. What other good options do we have?

    • At the place where I work, I have access to confdential data (and I need that access to do my job). If I wanted to (and wanted to get fired) which I dont (because I would get fired), I could steal this confidential information and post it to the internet. Fact is, large amounts of corporate data theft comes when dishonest people deliberatly copy data they have access to for their jobs and distribute it or when honest people copy data to e.g. work on it at home and then that data goes missing.

      What I (and I a
      • Your ideas make sense

        Where I work:

        They are removing cd drives and floppies from the leased PCs.

        No cameras are permitted on site

        No cameras in phones permitted.

        Users are users, not admins, generally. No access to bios menus.

        You can still email small files out, but those are traceable.

        Not allowed to use personal email (eg gmail) at work.

        They haven't figured out memory sticks yet

        Biggest problem I see is the theft of laptops from cars.

      • What I (and I am sure many companies) would like to see is a range of computers from a big name OEM like DELL that use PS2 for mouse and keyboard and then have a jumper on the motherboard or a software switch hidden in the BIOS behind a BIOS password that will completly disable all use of USB.

        Well I don't know about Dell and I'm not about to go search their website as I already wrecked my uptime by rebooting, checking my BIOS, and seeing that under "integrated peripherals" one can disable USB 1.1 and 2.0

        • So actually I did check Dell's site because I couldn't really believe there were no PS2 ports ... it looks to be true amazingly enough, although on some systems you can get them as an option. I don't see a serial port or par. port either on this cheapish model [dell.com].

      • (they would need to open the machine or get past the BIOS password and re-enable USB and then they would need to install the windows XP USB drivers or somehow boot an alternative OS (e.g. a Live CD) that would be able to read whatever sensative data they wanted
        And this is something that's particularly difficult? You don't have to even have very specialized knowledge to open up a computer, jumper the BIOS reset jumper, and boot a Live CD to get USB support. An interface jockey can do all of that.

        What you S
  • Geez. It isn't lost, it is copied. Maybe you don't want it copied, great, but it is not lost, not misplaced, not missing. Some people will quibble about it being stolen or pirated, but it is not lost.

  • A little epoxy will fix that right up. (Score:5, Interesting)

    by LurkerXXX ( 667952 ) on Tuesday January 24, 2006 @12:42AM (#14546395)
    I know of several companies which have filled in all the USB/firewire ports on most of the computers with epoxy. Only people who actually have a real need for devices using those ports have working USB/firewire (there are no floppies or CD/DVD burners in 'regular' staff machines either)

    • Re:A little epoxy will fix that right up. (Score:5, Insightful)

      by networkBoy ( 774728 ) on Tuesday January 24, 2006 @12:59AM (#14546469) Journal
      Funny,
      As a dev (and with tons of confidential and privlidged info on my computer) I am specifically instructed to take my notebook home every night. It is considered part of our business continuity plan. Not only that but this is a large multinational corp, not a mom and pop shop. That said, the drive is encrypted, and security policies are in place for communication back to the office when I'm away (2048 bit RSA VPN).

      What it boils down to is this:
      My employer knows that if I want to steal data I can do it. Even if it comes down to hand transcription of one memorized line of code per day. So they trust me and provide me a hardened notebook to do my work on. Even if it is lost the data will not be compromized till it's likely to be useless anyway.
      -nB
      • My manager at the last place I worked at used to work at a bank, and he was rather against my taking my laptop to work. But this was not a well funded IT department, and about once a month we'd need to do something that we didn't have the capability to do. (like clone a 20mb proprietary formatted SCSI-2 HD from the phone switch) Then I'd bring back in the laptop and I'd be good for hassel-free laptop use for about another month before he'd start grumbling again. And then something else would come up and r

        • Re:A little epoxy will fix that right up. (Score:4, Interesting)

          by jimicus ( 737525 ) on Tuesday January 24, 2006 @09:15AM (#14547922)
          Not that we had anything that critical or sensitive where I worked, but I always found it silly to bar someone from bringing in their laptop.

          There is logic in it, if you think about it from a "corporate IT putting out a blanket rule" perspective.

          That rule that applies to you also applies to Sharon, a blonde hairdresser by trade who's just taken a second job in the bank to supplement her income.

          Sharon has a laptop of her own, and wants to bring it on so she can get on the Internet in her lunch hour - after all, she's not allowed to use company computers for personal web surfing.

          Unlike yourself, Sharon's never heard of virus scanning (well, she has, but she was checked by her doctor when she started seeing her new boyfriend, so that's all right). She thinks spyware is the name of the next James Bond film.

          Now the bank has a number of business critical systems running Windows. Perhaps unsurprisingly, Auto Update is disabled. This is because, despite Microsoft's best efforts, such updates occasionally break things. Instead, updates are trialled on a test network and then, following a change control procedure, are applied. This procedure takes a while, so at any one time most of the critical Windows systems can be a good few weeks behind on patches. This rises when testing reveals problems, and it rises even further when the system in question was built and maintained by an outside company - their update, assuming they provide one in a reasonable timescale, is subject to the same test requirements and change control as a Microsoft update.

          Meanwhile, Sharon's PC, which is swimming in spyware, trojans and viruses, is merrily scanning the network for vulnerabilities.

          I don't think I need to spell out the rest...
    • It's been a while since I've peeked into a PC's BIOS... Can't you disable USB in the BIOS setup? Or is that dependant on the particular BIOS? Then you can just set a password to prevent access to the BIOS setup menus.

    • Better hope your computer isn't "legacy free" or a Mac. You won't have any place left to plug in your keyboard and mouse. Also, don't forget to plug up the parrallel port. I still have a ZIP drive!
    • Wouldn't it just be easier to disable the USB via the BIOS or open up the case and disable or remove the USB?
      Seems like physically ruining a device with Epoxy is a lazy way to disable something.

  • Uh, you can turn off USB drive access in Windows.. (Score:5, Informative)

    by EvilMagnus ( 32878 ) on Tuesday January 24, 2006 @12:44AM (#14546409)
    It's been present ever since Windows 2000 - if a company is worried about data loss via USB drives and the like, it's possible to disable access to USB drives using regular Windows security templates.

    What the article probably meant to say is that sloppy security practices, combined with increasing personal storage, increases the risk of unknown data loss.

    You can lock down a Windows box just fine against casual and accidental leaks if you know what you're doing, and you have a corporate policy to enforce. You can even prevent deliberate attempts at data theft, if you really want to be a hardass.

    • It's been present ever since Windows 2000 - if a company is worried about data loss via USB drives and the like, it's possible to disable access to USB drives using regular Windows security templates.


      Wouldn't it be simpler to deny write access to the source media so that nobody can deprive the owner of the data? Disabling USB would only inhibit copying but what we are talking about here is theft.
  • Does the author think "data loss" is a synonym for "unauthorized copying"? These companies had better hire some data recovery experts [dogthebountyhunter.com]!
  • Giving employees laptops is very normal now considering it helps them to work from home / while in travel.

    Can't they move huge amounts of data with these things?

    What else can you ban? Enforcing policy != banning stuff.

  • Encryption (Score:3, Interesting)

    by nolife ( 233813 ) on Tuesday January 24, 2006 @12:55AM (#14546458) Homepage Journal
    Of course getting the users to actually use encryption is another story...

    TrueCrypt [truecrypt.org] works pretty good for these situations and it comes with an open source license [truecrypt.org]. The forums contain a lot of tips and tricks for using the application in odd ball situations.

    Not affiliated at all, just a satisfied user.

  • not just USBs.. (Score:4, Informative)

    by dotpavan ( 829804 ) on Tuesday January 24, 2006 @12:59AM (#14546472) Homepage
    I remember a similar article here discussing the usage of portable gadgets at workplace, like iPod, camera cell phones, etc and many stated that their workplace does not allow such gadgets in "certain" areas, and they had to actually check them out before entering the premises..
  • IMNAProfessional IT guy but ... My prediction is more and more companies will physically segregate their networks, from the interweb and from their internal systems. Of course the Peter Principle implies that a lot of stupid stuff will happen before during and after.

  • And in Soviet Russia (Score:3, Funny)

    by Anonymous Coward on Tuesday January 24, 2006 @01:01AM (#14546479)
    And in Soviet Russia...
    When you go missing, will your data even know?

  • auditing (Score:5, Interesting)

    by BrynM ( 217883 ) * on Tuesday January 24, 2006 @01:08AM (#14546511) Homepage Journal
    Auditing of a filesystem is the best way to go here, IMHO. Drives are getting bigger, so capacity for log storage grows too. Currently you can set most filesystems that have granular security to audit file access, writing, creation and deletion. Perhaps there is some way to adit target actions ("copied to removable drive X", "opened by Microsoft Word") that will be developed eventually. Personally, I log access to important files as a matter of habit (mostly with NTFS). I've also found that the bigwig execs love it when you tell them you can see who tried to look in their directory.

  • Minox Baby!!! (Score:5, Funny)

    by RexRhino ( 769423 ) on Tuesday January 24, 2006 @01:17AM (#14546538)
    No one is gonna stop us from taking pictures of our computer screens with little East German cameras! Old school style!

  • Security through Stupidity (Score:3, Insightful)

    by Detritus ( 11846 ) on Tuesday January 24, 2006 @01:23AM (#14546569) Homepage
    Let's ban the automobile, 9 out of 10 bank robbers use them to escape from the scene of the crime.

  • Since 3/4 of you aren't going to RTFA... (Score:4, Informative)

    by mh101 ( 620659 ) on Tuesday January 24, 2006 @01:28AM (#14546585)
    From reading the comments, it's obvious that most of the posters haven't RTFAed. But what's new - this is Slashdot after all...

    So to clue you all in:

    The article is not about people stealing sensitive data from their workplace using their USB drives. The article is about people losing data, because they've lost the USB drive they had it stored on.

    • The article is not about people stealing sensitive data from their workplace using their USB drives. The article is about people losing data, because they've lost the USB drive they had it stored on.

      I don't think the author of the article understands the difference. In all the environments I have worked in people keep their data primarily on servers with regular backups.

      Is there another world where important data is kept only on individual USB drives? Maybe, but that's news to me.

  • No, Nope, Nada.

    The U.S. Military has pretty direct rules for dealing with these things, don't bring them. While I would never want to see that enforced everywhere the simple fact of the matter is, that is the only foolproof policy (and even it isn't perfect). Unless companies are willing to be draconian, and can find people who'll a) put up with that and b) obey, then they will lose some data.

    While I fully expect some companies to try it I expect that some of them (the smaller, nimbler more sensible ones)
    • that is a terrible policy, it solves the problem by assuming rules will be followed. except the problem comes from people not following the rules and therefore solves nothing.

  • The real issue leading to confused reporters (Score:4, Interesting)

    by MikShapi ( 681808 ) on Tuesday January 24, 2006 @01:30AM (#14546594) Journal
    Is the issue called trust. Specifically, towards people on the inside of your organization.

    It all boils down to "Do you trust your employees"?

    There are businesses that do, and there are those that don't.

    Those that do work on the assumption an employee will not do anything to harm the business intentionally - take a file he is exposed to during work and transfer it somewhere outside the organization.

    Hence, it will not take all measures required to prevent him from doing so.

    A business that does worry about such things will - What you carry will be checked at the door. Your PC will be locked (the case, physically locked). No Floppy, CD-R, USB, no means to connect media you bring from home. Internet access will be so restricted you wouldn't even be able to encapsulate an SSH tunnel over DNS packets you kindly ask your DNS server/proxy to send for you. And so forth.

    Pointing at a business where everyone has web access and a dell sitting on his desk with 2 USB ports looking at him and saying "Hey, this guy can copy a confidential word document on the USB key" is hardly news, doesn't bother anyone in the first type of organization, and usually a non-issue in the second (which would have taken excessive measures to prevent exactly this kind of thing).

    Nothing to see here, move along.
    • [Is the issue called trust. Specifically, towards people on the [inside of your organization.
      [
      [It all boils down to "Do you trust your employees"?
      [
      [There are businesses that do, and there are those that don't.

      And then there are the smarter ones that recognize reality - that regardless of how much trust one gives, statistically speaking, someone will abuse that trust and walk off with data. The smarter businesses put appropriate mechanisms in place that both recognize and attempt appropriately minimize the o

  • Good idea. (Score:2, Funny)

    by deep44 ( 891922 )
    Hmm, interesting. I've always used my USB flash drive for sharing and copying music from major record labels; maybe I should pick up another one.

    keywords: P2P music napster free music

  • Devices (Score:3, Insightful)

    by gmuslera ( 3436 ) on Tuesday January 24, 2006 @01:51AM (#14546656) Homepage Journal
    Ok, could be banned to bring an (very hard to see) USB drive... what about cell phones? banned too? PDAs? MP3/CD players? 10 years is a lot of time and even whatever will be used to carry what could be your "personal id" could potentially used to copy sensitive data i bet.

    Also, the network is everything, there are not so much totally isolated computers with critical data, and most networks have some or several points of touch with internet, encripted traffic and then hard to trace what is happening with the information.

    • Am I the only one here think thinks it might be kind of cool to work in a paranoid place requires you to check cell phones at the door? Now if only they could eliminate my pesky desk phone and email (um, in the name of security leaks, of course) I might actually have time to productive!

      Would anybody beleive me if I made the case that status meetings and rambling, pointless telecons with 3rd parties are risky security leaks too?
  • Funny, a few hours ago my Fiance called me upset cuz she broke the USB drive i gave her for her b-day while she was vaccuming. Brushrollers caught the strap and yanked it right out, destroyed the usb port and smashing the drive itself. I guess it took out the vaccum to and that managed to set off the smoke alarm. Wish i coulda seen that, it sounded spectacular...

  • Data loss (no backup) or data theft (stolen disk)? (Score:3, Informative)

    by paultwang ( 946947 ) * on Tuesday January 24, 2006 @02:38AM (#14546777)

    For the first problem (Data loss due to lost or corrupted disks), which seems to occupy the majority of the article, the solution is easy. Back up your data from your portable storage as soon as you can easily access the mainframe. How long does a differential/incremental backup take? 10 seconds? 2 minutes? A piece of data existing in the portable disk, the mainframe, and the backup tapes, is much harder to be lost.

    For the second problem (Data theft due to lost disks), encryption works well. To discourage data theft due to lost disks, a simple, easy-to-use on-the-fly encryption on the portable storage device can help tremendously. The solution has to be simple because if it is a few mouse clicks too many, employees will try to circumvent the hassle.

  • Data goes "missing" when it gets deleted. What we're talking about here is when it gets copied, right? Captain obvious says hello!
  • One can always consider that the data shared may also soon be obsolete. Stolen sourcecode is soon outdated, business plans change day by day etc.

    The amount of critical data in a company is often very limited and can be kept under control. If more energy is put into research and less into legal battles any data loss will soon be rendered useless.

    Of course - this does not apply to all data.
    Movie and music copying is a more direct impact where the data is the product. However - it all comes down to the is

  • Too late! (Score:2, Insightful)

    by burne ( 686114 )

    The Dutch 'Secret' Service (AIVD) recenlty lost a memorystick containing 'secret' documents:

    in Dutch: http://www.webwereld.nl/articles/39418 [webwereld.nl]
    from an Italian newspaper: ( http://www.intesatrade.it/IntesaTrade/News/Dettagl ioNotizieOggi/1,3243,2@1332658,00.html [intesatrade.it] )

    The report comes a day after the Defense Ministry said it had lost a computer memory stick containing confidential Military Intelligence Agency data. In December, a Dutch district court sentenced a former AIVD translator to four and a half yea

  • And when I posted this as an Ask Slashdot [slashdot.org], I was told not to worry about it.
  • Your workplace is either a secure location, in which case this has already been addressed, like every technology before it, or it isn't a secure location, in which case a little USB Flash drive is only one of many ways for data to leak offsite.

  • Company Data: theft , copy or backup? (Score:3, Insightful)

    by VincenzoRomano ( 881055 ) on Tuesday January 24, 2006 @04:00AM (#14547005) Homepage Journal
    Nowadays it is almost impossible to avoid people from copying company data, also because it is becoming a spread practice to bring some work at home.
    Not to mention the vast usage of laptops, especially among ICT workers.
    Removable media with high capacity is only the "latest" technology to do this.
    In the past we have used printers, floppy disks, email and web disks in order to bring data and documents home (or wherever else).
    You can lock floppy drives, USB ports, bluetooth features and so on. You can filter web accesses and other publishing media and protocols.
    But what about email and printers?
    Are you really planning to make work harder and slower?
    And I'm pretty sure that in some cases, especially in small companies, the private copy saved the day in more than one case!
  • I carry a 100gb external USB drive and three memory sticks everywhere I go. They contain multiple diff backups, HD ghosts, etc. I'm a novelist and programmer, and my data is my livelihood.

    If I had a job where they banned me from carrying my own backups around I'd have to resign, because I'm not about to leave them in my car and I'm not going to open a safety deposit box for daily switchover visits.

    Surely it's up to the company to manage their hardware so that employees can't simply copy data to remov

  • Douglas Adams talked about this (Score:3, Funny)

    by andrewagill ( 700624 ) on Tuesday January 24, 2006 @04:40AM (#14547108) Homepage
    The higher level supervising program went to consult one of its own look-up tables to find out what the low level supervising program was meant to be supervising.
    It couldn't find the look-up table.
    Odd.
    It looked again. All it got was an error message. It tried to look up the error message in its error message look-up table and couldn't find that either. It allowed a couple of nanoseconds to go by while it went through all this again. Then it woke up its sector function supervisor.
    The sector function supervisor hit immediate problems. It called its supervising agent which hit problems too. Within a few millionths of a second virtual circuits that had lain dormant, some for years, some for centuries, were flaring into life throughout the ship. Something, somewhere, had gone terribly wrong, but none of the supervising programs could tell what it was. At every level, vital instructions were missing, and the instructions about what to do in the event of discovering that vital instructions were missing, were also missing.

  • To executives, concerned about this: guess what? (Score:5, Interesting)

    by Alex Belits ( 437 ) * on Tuesday January 24, 2006 @05:39AM (#14547281) Homepage
    For a company to function, many employees of the company have to have access to the company's data. All of them, if they are inclined to do so, can copy it. Heck, many of them can sabotage it, and destroy the company.

    Guess what the company can do about it? It can stop treating the employees as shit. Especially stop pretending that the company is some amorphous entity that makes its owners/shareholders entitled to profit, and can impose idiotic demands and shitty conditions and pitiful pay on everyone else in it. Employees do their work, this is why they have access to company's things. Nothing, ever, happened in a company without some employees making it happen, so if any of you wonder, why people can destroy your precious company, keep it in minds -- THIS IS BECAUSE THOSE PEOPLE ARE THE COMPANY.

    There is nothing wrong with avoiding overbroad access where it isn't necessary for things to work, however there is no way to make any company "secure" from the very people whose only responsibility is to keep things running. Don't piss them off, and remember that you didn't become Presidents, CEOs and VPs by understanding how to operate anything that makes your company what it is. Every time you eat your lunch, think how many people you have abused today, and what will happen if any of them will press a few buttons.

  • He's mixing two different things (Score:3, Insightful)

    by Ernesto Alvarez ( 750678 ) on Tuesday January 24, 2006 @09:33AM (#14548038) Homepage Journal
    There are two different things mentioned in the article that I think make the article less than what it should have been.

    The first one is data being compromised. There's a clear example when the author found a USB drive in an airport. (He could read it without problems). The second one is data loss, also mentioned. The author mixes both concepts when he compares the loss of a USB drive (assuming it's not backed up) with the loss of records by a big company (that would probably be compromise).

    Even though they look like the same problem (if I put all my important data in a standard USB drive, if I lose it the data gets lost and compromised at the same time), they're not. These risks are mitigated with different methods. When you start taking steps against either data loss or compromise, it is shown that the author's definition of "data loss" is not that clear.

    Imagine I had all my important data on a USB drive, encrypted (but without backups). If I lost said drive, I would be left without some important data, but it would have not been compromised.

    The opposite would have happened if I had backups, but no encryption.

    If both encryption and backups were available, if would be (under most circumstances) a non-issue (except for the loss of a USD 20 drive).

    All of that assuming the drive owner is honest, and not using it to smuggle data out of a secured area.

    The author seems to treat data as a physical object, which is not.

  • So, disable the USB port (Score:4, Interesting)

    by Zerbey ( 15536 ) * on Tuesday January 24, 2006 @09:41AM (#14548103) Homepage Journal
    We had a client at one of my previous jobs who explicity banned USB jump drives from the workstations they would be using. So, after a few seconds of head scratching on how to do this I:

    * Disconnected the USB ports and,
    * Disabled them in the OS and,
    * Removed the USB flash device .inf file that Windows provides and,
    * Padlocked the case shut.

    It takes a few moments per machine and should be part of the standard build for any business that cares about their data.

    • Er. Uh.

      How are you to use your USB printer?

      Or:

      Your USB keyboard and mouse?

      PS/2 and parallel ports seem to be disappearing in a hurry. Your supposed fix for the USB key problem is, well, somewhat flawed if it makes the whole rest of the workstation unusable at the same time...

  • Thin Clients (Score:3, Insightful)

    by HighOrbit ( 631451 ) on Tuesday January 24, 2006 @11:17AM (#14548827)
    If a business division is working with especially sensitive data, perhaps they should not be working on PC's at all. That might be a job for a thin-client/dumb terminal with no drives or ports (other than ethernet, video, and ps-2 keyboard/mouse).

    Sun has been pushing thin clients for years and some of their major selling points have been security both from the data sensitive aspect and security from the user-can't-break-it aspect.

Slashdot Top Deals

There is no opinion so absurd that some philosopher will not express it. -- Marcus Tullius Cicero, "Ad familiares"

Close