Where is Your Data? This is the old site

Its only the 2^nd of the month, but already there is a reported data loss from the government. This time it is from the Department of Work and Pensions.

On this occasion it is not personal details that have been lost but user names and passwords, that allow access to a government site which contains information such as tax returns. So, in many respects it worse than usual.

The details were on a USB drive that was found in a car park.

The Department for Work and Pensions has come out with the same,  tired old lines, stating that there is “No conceivable risk” . As  the user names and passwords are ‘out of date’. While the passwords may be out of data this loss does pose numerous questions and problems, and further exposes government security weaknesses:

How long have the passwords been out of date, a day or a year? Why is this data on a USB drive? How did the USB drive leave the department? Are the current user names and passwords also on USB drives? Why is it so easy for this for this information to be extracted and passed around easily? What else has been stolen?  We know what has been lost, but what has been stolen?

The government claimed that all of the data on the USB drive was encrypted but, if that was the case, then how was the USB drive identified as belonging to the Department of Work and Pensions?

Passwords are stored on most systems in an encrypted format, e.g Windows does not store you actual password but an encrypted version of it, but this encryption is easily cracked. What level of encryption was used? Has it since been changed, because this security has now been compromised?

This single incident again shows the sham that is government security.

The police, this time the Lancashire Police, have lost some more data. This time it is a laptop, containing witness statements and the like.

The laptop, which was, of course, not encrypted, was stolen from a car. To make matters worse the laptop was in the possesion of an off duty police officers when it was stolen. Once again government staff are taking home data, and are being supplied laptops that are not encrypted.

The damage does not look too much in this case, so its not likely to change anything, but what would?

Source

Some of the press are reporting that Deloitte has suffered another data loss, this time for Vodafone, on top of the data lost from BSKYB – which  was reported last week.

This is not strictly accurate; a single laptop was stolen and this contained information from multiple companies: Vodafone, BSKYB,  and Network Rail. i.e there was a single loss not multiple losses.

The difference between this loss and government losses is that the data was secured by strong encryption with strong passwords, and therefore the risk to the data is minimal.

So unsourced “quotes” from concerned victims like this:“It’s pretty disgusting that that information could be left out for anyone to get their hands on. My personal details could be used to open a bank account or a credit card, that’s my greatest concern.” are not entirely helpful.

In the latest round of data loss its been reported that BSKYB data has been lost by Deloitte.

The data contained information about BSKYB’s staff and their pension plans.

Deloitte, who was in possession of the data, presumably because they are BSKYB’s accountants, had stored the information on a laptop. The laptop was then stolen  in what was described as an “opportunistic theft”.

The difference between this data loss and the numerous government losses is that Deloitte take all of the standard security measures you would expect, strong passwords and strong encryption.

So, has Deloitte lost the data? No, they have just had a laptop stolen.