It’s bad enough that there are hackers and other evil doers out there trying to break into your IT infrastructure to get their hands on data that they can use for whatever evil purposes that they have in mind. But what’s worse is when you lose some form of removable media with sensitive data on it and you have no idea where it might be. Here’s a case in point served up from the Office Of The Auditor General here in Canada who lost a bunch of encrypted USB drives:
An internal investigation at the Office of the Auditor General found that about 22 per cent of the encrypted USB drives entrusted to employees were lost, according to newly released documents.
The Star obtained a briefing note through an access to information request that details how the encrypted portable data storage devices were handled by workers at the office of the federal government watchdog, with little done to ensure information technology security measures were followed.
“The management of these USB drives was not strictly enforced. Employees were given IT Security information sessions on how to report stolen or lost devices but there was never any real accountability if a USB drive was lost,” says the Sept. 22, 2014 memo prepared by Jean-Charles Parisé, chief information officer and departmental security officer with the Office of the Auditor General.
The Office Of The Auditor General for their part says there’s nothing to see here:
“We have always encrypted (since 2008), so we were not worried about losing the data. We couldn’t lose data, but it became a bit troublesome to have to manage those (devices). They’re easy to lose . . . . So, we decided we had to do away with (them),” Parisé said in a telephone interview Wednesday.
The institution has since moved mostly to using a secure file transfer (secure FTP) site to exchange information with outside institutions and has recalled all the USB devices, except for those currently being used in ongoing audits, such as the investigation into Senate expense claims.
Well, at least the drives are encrypted. That will stop the casual user from getting access to that data. But a more skilled user may have a shot at getting to that data. After all, nothing is hacker proof. And according to the story, the data on those drives is likely information containing identifying information about individuals or institutions that is not secret or classified. That’s not good. As for them moving to methods like secure file transfer services, at least there’s no physical media to lose. But it leaves them wide open to social engineering attacks and password cracking attempts unless they use some form of two factor authentication to stop that from happening. That’s because all that usually stands between a hacker and the data is a password. Thus I’m implying that they might have traded one problem for another.
Clearly there needs to be a major shift in terms of how data is handled and secured to stop situations like this from happening. Hopefully, it doesn’t take a major negative event for that shift to take place.
CRTC Makes Cable Companies Adopt “Pick & Pay” Option And Caps Basic Cable
Posted in Commentary with tags CRTC, TV on March 19, 2015 by itnerdThe CRTC today did something groundbreaking today. Actually they did three things that are groundbreaking. They made the cable companies and anyone else who delivers TV in Canada do the following things:
That’s all groundbreaking. I have to admit that. But I question if consumers will actually save money. I say that because bundles allow specialty channels to exist because of the fact that they’re force fed to you. Thus because a lot of people get them, you pay less for each channel which means that economy of scale kicks in and it allows them to stay afloat. Take that option away and you may end up paying the real cost what these channels cost. So you may only get the channels you want, but you may pay more. Or the channels that don’t do as well will disappear. Having said that, cable TV costs are insanely expensive in Canada. So you have to try something to see if it will lower costs for consumers. Seeing that cable companies will have until March 2016 to offer the $25 basic package, and December 2016 to offer up “pick and pay”, we’re a long way from getting an answer to that.
File this under “to be continued.”
1 Comment »