The strange tale of a ladyman and your data
By Davey Winder in Editorial
Posted in Data Protection, Blog, Security on
Here we go again.
This time it is the Driver and Vehicle Agency in Northern Ireland that has been playing fast and loose with your data, or at least that of some three million would be drivers whose details have gone missing. This time the data disappeared not in transit between a couple of government departments in the UK, but somewhere in Iowa apparently. According to a statement by the Transport Secretary, Ruth Kelly, the data was sent electronically to an outfit called Pearson Driving Assessments in Iowa, US one has to assume for processing purposes, and the hard drive containing the names, addresses and telephone numbers of those applicants was then passed off to someone at some company (the details are far from clear as to who or why) in another state before getting lost either on the way back or on arrival in Iowa.
It should come as no surprise that all this happened back in May, or that the government knew about it in June when the then transport minister was informed but deemed it not important enough to worry the public about. The transport minister at the time was one Stephen Ladyman, which is ironic because I always think of Ruth Kelly as being something of a manlady. However, that’s another story entirely.
Back to the main plot then.
Once again this has to come not so much as a wake up call, but rather a bloody great slap in the face, for any business which handles data to get their finger out and ensure they have a proper policy in place for the encryption of that data whenever it is being moved. If the government had considered our personal information valuable enough to encrypt before throwing in the internal mail system or chucking at some company in Iowa, then there would have been much less of a scandal to get heated about. Yes, we could have got hot under the collar about process and procedural failings, but at least the data would have been worthless to whoever it ended up with.
That said, the whole ‘use encryption you idiot’ debate does throw up another interesting aside: what happens if you lose the key that unlocks your own data?
Geoffrey Finlay, CEO of nCipher puts it quite nicely when he says “encryption is a powerful tool, but getting it wrong can at best result in a false sense of security and even worse leave data scrambled for ever - the equivalent of a corporate document shredder. A well-planned deployment of encryption, supported by strong key management and access controls will eliminate further HMRC, DVA and Driving Standards Agency catastrophes and result in better protected data that is available to the right people at the right time. The idea of end-to-end encryption may still be a long way off but cryptography is increasingly playing a vital role as the last line of defence.”
And that means both encryption and key management have to be a must get for all organisations with sensitive data, end of story…
Rated: 100% (1 votes)
Loading ...Comment by - January 28, 2008 on 8:54 pm
I just can’t get over how sloppy thes guys are with our confidential details. Are they totally clueless? I suppose that the answer is: yes they are totaly clueless.
The level of access that junior staff have to the whole shooting match is beyond belief.
Laptop drives should be routinely encrypted if they contain confidential data and not left in cars overnight.
Access to data should be segmented so unless there is a good reason one person can’t get at it all. This is what happened in health centres because systems were not linked. But not once the new NHS system is working.
Madness.
Interesting question. If an encrypted disk develops s fault is it possible to recover any files? Or is it as you say a document shredder?
Nick
Make a comment
Tag cloud
Archives
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
- August 2006
Most commented posts
- 80 percent of viruses love Windows 7
165 comments
- Has Microsoft gone mental?
- Has the US Army declared war on Windows 7?
- Cuil frozen out: market share drops to next to nothing
- Xbox 360 FAIL
- The 24GB RAM Desktop is born
- Use old version of Windows instead of Linux, says teacher
- Microsoft reveals time-based licensing model
- How Marblecake Hacked Time
- Nexus Two - The Next Generation
Highest Rated Blog Posts
- Why ecommerce fails (100%)
- Google Chrome stands alone at PWN2OWN (100%)
- Betting on Hubdub technology (100%)
- Has Google gone insane as GMail goes back to beta? (100%)
- Chinese whispers as government implicated in UK hack attacks (100%)
- Crimeware toolkit targets 10,000 trusted sites (100%)
- Black Hat risk to migrating VMs (100%)
- Tough on cyber crime, tough on the causes of cyber crime (100%)
- Firefox 3, Beta 4, Enhancements 900, Tested 5 (100%)
- Has the US Army declared war on Windows 7? (100%)
