Securing Personal Data in Small Companies?

lohmann asks: "I was recently paying rent in my apartment office when I noticed several of the rental agents frantically shaking a nearby keyboard. Being a geek, I intervened... and plugged the mouse back in. A barrage of performance questions ensued, so I checked their system for any issues. The results were astounding: Windows 95, no firewall, no AV software, and no backup software on a machine containing thousands of individuals personal information (including mine). I ran some utilities and removed dozens of viruses and instances of spyware. I voiced my concerns over security issues, but was told that 'there is no budget for such things' and that 'we haven't had any trouble in the past.' Have any of you run across similar instances of small companies refusing to protect your data? What can I do to convince them to secure the network?"

Comments

IT for rent arrangement?

[mind21_98]

Maybe your landlord will take you on as a system administrator for their network in exchange for a reduction in your rent. Both of you will benefit, and you'll make sure your personal information doesn't fall in the wrong hands. :)

Re:IT for rent arrangement?

[bscott]

Cutting a deal? While I genuinely applaud your impulse towards finding an amicable solution via barter, I don't think you're being anywhere near cynical enough... You didn't read what he quoted them as saying - "We haven't had any trouble in the past" That's a psychology which is very, very difficult to fight against.

If you become a victim of identity theft, it would be difficult if not impossible to trace back to negligence on the part of your landlord (or anyone else in most cases); so unless they are predisposed to worry about it, they're not going to - and they'll probably never really suffer from this attitude. Good luck trying to make a deal with them.

Then again, I live in an area which is just about the most densely populated in the US; it's possible you might find property managers in less expensive areas who have not lost their souls and brains and might be amenable to reasoned argument. I can't count on having hot water, electricity or the hallway outside my front door to be free of homeless people (getting in via the broken security doors), so I've learned a healthy disrespect for landlords.

now you got me worried.

[ForestGrump]

What am I to do? Will a small company (Radio shack down the street) lose my personal info? They must have asked me like 20 times...is that because they lose my info each time and have to get it again?

Help!

Re:now you got me worried.

[Yaztromo]

What am I to do? Will a small company (Radio shack down the street) lose my personal info? They must have asked me like 20 times...is that because they lose my info each time and have to get it again?

Bah. Just do what I do. Everytime they ask me for my name and address, I just give them yours.

Uh, on second thought, maybe you shouldn't do what I do :).

Yaz.

Re:now you got me worried.

[rts008]

Nah, someone on a P2P probably "stole" it

Re:now you got me worried.

[Anonymous Coward]

is that because they lose my info each time and have to get it again?

No, it's just part of standard Radio Shack training. I'm not sure they even record this information, they're just required to ask every time. I once asked them why they needed my name and zip code when I was buying a $1.50 adapter. The only response I could get was "we're just supposed to."

Keep in mind that, while I'm sure there are exceptions somewhere, "Radio Shack employee" is a few steps below "Best Buy tech." They're the joke of the industry.

Re:now you got me worried.

[PCGod]

I am horribly shamed to admit this, but I worked for them for about 8 months. HEY! I was a poor, starving college student, get off me! Anyway, yes, they are required to ask that information. Reasing being that they want to send you their ad in the mail every couple of weeks. Durring one of the corporate management changes several years ago, they did an experiment. They stopped asking for this info for a month. Three months later (their ad cycle is 3 months iirc), their sales had dropped quite a bit.

So, now they really put the pressure on employees to get this information. I think something like 80% names and addresses was considered standard. If you drop below 60% or so, you'll definately hear about it from the manager. Mine threatened to fire me when my N/A dropped to 30%.

So, help the poor employee out while keeping your information out of their system... give the store's address (I saw a manager do this once without even asking me for my info).

gym

[ralphus]

I once went to my gym, where they know me as the local computer geek. Obviously they have all customer information on their computer systems, including their photos and credit card numbers for billing. They were complaining that their computers had gotten slower recently and they didn't know what was going on. I said I would check it out. They didn't have a firewall, they didn't have anti-virus. What they did have was just about every virus and trojan under the sun and their little cable modem was working overtime just sending data to god knows where. I cleaned them up and installed everything they needed to get protection and clean up the mess. Small business is hopeless on a lot of occasions. It isn't their fault IMO. The vendors should be making more secure solutions for them to at least protect against all predictable threats.

Re:gym

[lpontiac]

It isn't their fault IMO. The vendors should be making more secure solutions for them to at least protect against all predictable threats.

IMO, businesses should be exercising due diligence and purchasing products from vendors with good security records. Yes, this may mean paying twice as much to have a local IT consultancy deliver the box and maintain it, rather than mail-ordering from Dell. And it may mean having to put in place and enforce policies such as "no casual web browsing on the computer."

I can imagine many businesses play the "we're not an IT company, why should we care about computers?" line, to which I'd say, "fine, then don't use a computer."

Re:gym

[Spoing]

1. It isn't their fault IMO. The vendors should be making more secure solutions for them to at least protect against all predictable threats.

If the gym bought Nautilus equipment and never maintained it, would they be held liable when it breaks?

They buy products without properly researching them or having experts install and maintain them. The vendors -- I'm guessing the OEMs not a group provides on-site support -- can't design products that are safe in all situations without making the products useless.

It's boring, but it's true;

1. Security is a process, not a product.

Re:gym

[ruckc]

This is why I say Point of Sale software should be sold on older refurbished computers running old software, or new software on old hardware, or some combination there of, because how many point of sale systems need that brand new Pentium 4 processor and GeForce graphics card to run dos based software on a windows xp system connected to the internet. So when they arn't using the machine for purchases, they are probably browsing the internet if not doing other work, guess what gets installed via internet... why ahh... high schools in 4-5 years will be teaching windows software weekly maintenance alongside a typing/keyboarding class if they havn't already ditched that.

Re:gym

[flacco]

I once went to my gym, where they know me as the local computer geek.

undoubtedly because you only went once, weighed 105 or 328 pounds, had a protruding adam's apple and thick black-rimmed glasses, and fell off all the exercise equipment jerry lewis style.

Re:gym

[Johnny Mnemonic]

It isn't their fault IMO.

Yes, it is.

The vendors should be making more secure solutions for them to at least protect against all predictable threats.

There are. Insert standard Apple/Linux security rant here.

The fact that SOHO users like this think that they're too smart to use Macs and/or Linux is a poor business decision that they've made on their own. There are better solutions, but they aren't being used for lots of (bad) reasons. Whose fault is that? More probably, it's really the developer of the vertical application that the gym uses that's too blame--but they are ultimately guided by the choice of OS that the gym owners use. If they demanded a more secure solution, they would eventually get one. And they do exist, so the only fault is for not choosing one.

Re:gym

[TheLink]

"There are. Insert standard Apple/Linux security rant here."

Doh. Then they'd be using an unupdated RedHat 9.0 with openssh vulnerabilities and so on. Same goes for the Apple stuff. No diff.

I don't see a cure in sight - there is no change in the O/S design. Linux/Macs are not much better than Windows securitywise - architecturally[1], especially when you have users that are actually do stupid stuff like _enter_passwords to encrypted zipfiles and run the contents, even though they have been told not to (some people just can't resist).

Small businesses also have other things to do. What they need is to do the equivalent of regularly sending vehicles to professionals for maintenance and servicing.

[1] Architecture is similar:
Stuff runs by default on Mac/Linux/Windows with the user account's full privileges and so has access to the user's data.

Mac/Linux/Windows and most popular user applications are also written in languages that are prone to buffer overflows and similar issues.

Re:gym

[ralphus]

All while wearing a 2600 t-shirt. :)

Re:gym

[ralphus]

If the gym bought Nautilus equipment and never maintained it, would they be held liable when it breaks?

Most often yes.

However when they buy Nautilus equipment and they maintain it in line with the recommendations and it still breaks due to design flaws that the manufacturer isn't talking about and no one but industry insiders in metallurgy really understand, are they liable when it breaks?

However obvious to us all the internet security issues are, to mom and pop shops the issues are far too obscure for them to know the first thing about. They are being sold computers as appliances like TV's or toasters that they can plug in and not worry about. Worse yet, I'm sure many franchises require some sort of network connection and application to hook them into corporate w/o much guidance on security.

I could not agree more that security is a process and not a product, my point is that no one except the experts can effectively deal with the process and that the industry needs to come up with solutions to make all those who are never going to be bothered by security secure by default.

Re:gym

[Spoing]

1. However when they buy Nautilus equipment and they maintain it in line with the recommendations and it still breaks due to design flaws that the manufacturer isn't talking about and no one but industry insiders in metallurgy really understand, are they liable when it breaks?

1. However obvious to us all the internet security issues are, to mom and pop shops the issues are far too obscure for them to know the first thing about.

If they aren't experts in Nautilus repairs, they schedule maintenance on a regular basis. If sued, they show the maintenance records. If they do not schedule maintenance, they can be held liable. It should be no different for corporate records that happen to be on a computer.

As for a franchise operation...the home office is responsible for these types of details. That's why it's a franchise!

It's not just small landlords

[dacarr]

The apartment complex I live at has similar problems - although our management company is the largest in Orange County, CA. All machines are running XP of some variant, however the IT department has seen fit to not restrict internet access and never did bother installing spyware proofing, AdAware, etc. Though they did install a commercial AV package. I wound up installing Spybot and AdAware on one of the boxen, and should check with the complex manager

I think it comes down to an important thing - it's a case of general ignorance of facts, but what's scary is that it's the system adminstrators that seem somehow lacking this key data in some cases. I don't know if it's some bit of arrogance that comes with an MCSE or what - but it's kind of scary how that works at times.

Re:It's not just small landlords

[Mycroft_514]

>it's the system adminstrators that seem somehow lacking this key data in some cases.

It isn't just the MCSE or other such training. There are just way too many people out there who have no business being computer professionals. They haven't got a clue that they are not capable of doign the job.

Re:It's not just small landlords

[GNU(slash)Nickname]

And of course you installed AdAware AFTER they purchased a license, since it's free only for personal use. Right?

Well...

[FooAtWFU]

Imagine what would happen if they opened up their Rent Due spreadsheet and read something like "If you are reading this, than I could have altered the amount I owe. You need better security. Kthxbye."

Re:Well...

[toygeek]

INCONCEIVIBLE!

Re:Well...

[Leibel]

You could do that, but if they found you, what would make you different in the eyes of the law from someone who did alter more sensitive information?

sue?

[Apreche]

IANAL. However it makes sense to me that maybe you can sue. If a doctor doesn't keep your medical records safe and secure, then I imagine they could be held liable. If this is true, then I assume the same can be true of an employer. If they don't keep your personal information safe and secure, then you can sue them for being negligent or some such.

Of course, if you just want to give some convincing give them the old risk benefit analasys. If all our computers got hosed how much would we lose? Then prove how likely it is and how often it happens. Then tell them the solution.

Re:sue?

[Hardwyred]

Dont be so sure about that. Drs are required to keep your health records secure because of things like HIPA, but Im not sure about your financial records. I believe that's just a matter of good buisness, but I could be way wrong.

Re:sue?

[Rick the Red]

Unfortunately you can't sue, because nothing's happened yet. Well, you can sue, but you won't win as they've done nothing wrong. Once their system is hacked and your data is buying boob implants in Paris, then you'll have a case.

That's just how our system works, sorry.

Re:sue?

[james11111]

Under the Data Protection Act (UK) all buisnesses storing personal data must be registered with the Data Comissioner, and take reasonable steps to make that data secure. If they don't they are open to prosecution.

Re:sue?

[ubertemp]

Ahh...America

I'm unhappy so I'll sue

Here's what you can do...

[Spoing]

1. Find a huricaine.
2. Step outside during the hurricane.
3. Scream.

You can't protect people from themselves.

The only thing that works is mentioning that they may be liable -- they could be sued -- if they are found neglegent in not doing something to protect the data they have. Usually, this makes them concerned...and they still do nothing.

Re:Here's what you can do...

[Seraphim_72]

1. Find a huricaine.
2. Step outside during the hurricane.
3. Scream.

If that were Hiaku I would vote you Slashdrone of the Century ...
You are spot on though. You cannot protect people from themselves, - ask any Doctor... :/

Sera

Re:Here's what you can do...

[Ubertech]

For what I am about to do, I humbly apologize, and beg your forgiveness. Now then...

Find a hurricane
Step outside during the storm
Scream like little girl

The last line should, of course, be spoken with a fake Russian accent, like the one from the Rocky and Bullwinkle cartoons of the 1970s.

Re:Here's what you can do...

[Seraphim_72]

I bow before your geekiness

Re:Here's what you can do...

[unitron]

"...like the one from the Rocky and Bullwinkle cartoons of the 1970s."

The '60s, actually, and possibly even the late '50s. A truly excellent show--delicious cold war era satire disguised as a children's cartoon show.

And, just to be picky, if you're going to do it in a Boris Badanov voice it should go like this:

Find hurricane
Step outside during storm
Scream like little girl

Re:Here's what you can do...

[Ubertech]

Thanks for the correction on the date. I should have remembered that the show was older than I am. I just remember watching it as a kid in the early/mid 70s.

I agree that your rendition of the poem fits the voice, but I kept the first 2 lines as is to protect the necessary syllables of the haiku. Given some thought, I could probably rewrite the whole thing for "Boris," but that would be silly.

leave them

[drfrog]

seriously

voice your opinion by leaving

maybe then they will get the message

especially when their competition is getting your money

Re:leave them

[cerberusss]

voice your opinion by leaving

[sarcasm]Good idea. I would definitely move because their PC is unsecured. Moving is fun and it's SO easy to find alternative housing. Of course, my girlfriend really likes moving, too.[/sarcasm]

Why in the holy name of cosmic Chaos is this modded insightful??

Re:leave them

[cyber0ne]

voice your opinion by leaving

I don't know where you live, nor do I know where the poster lives, but I can assure you that such an action is laughable where I live (Boston). There's practically a waiting list for apartments. They'll have you replaced by the end of the day, probably at a higher rate, after they collect their "early lease termination fee" from you.

If you live in an area where the housing market is truly dominated by the customers, be sure to thank $DIETY every day. And never, ever leave that area.

Re:leave them

[SydShamino]

>> If you live in an area where the housing market is truly dominated by the customers, be sure to thank $DIETY every day. And never, ever leave that area.

Of course, you can't leave that area, because you can't sell your house. :)

Re:leave them

[drfrog]

i meant leaving the small company that is unwilling to secure their network, you know ...stop being thier client

Re:leave them

[cerberusss]

LOL sorry, I misunderstood... *slaps forehead*

laws

[Anonymous Coward]

There are laws in place making businesses that handle personal information to make a reasonable effort to keep it secure. Contact your state Attorney General. You could also try suing them if you found out any of your information was compromised. You could probably sue them anyway.

Maybe the best thing to do is just get in yourself and do a format c:. Then, when it breaks, and they know you as the resident geek, you can tell them what they need and make them buy it. Better yet, install Linux with crossover office if they need MS apps. Or, even better so you don't have to support it, make them get a Mac. It's not perfect security, but it's damn well better than windows.

I work in the network security industry, and the current trend is to move away from windows if there are reasonable replacements on other OS's.

Re:laws

[Clover_Kicker]

> Maybe the best thing to do is just get in yourself and do a format c:. ...

> I work in the network security industry

With friends like that, who needs enemies?

Backups, A/V, firewall, and spyware

[darkone]

For windows boxes, there are 4 things I do/suggest to users:
1> Backups - spend the $150 for a Maxtor OneTouch that comes with Retrospect personal. Once a week they press a button, backup done.
2> A/V - If they don't want to spend $70 for Norton or McAfee, then for free you can try AVG ( http://www.grisoft.com/us/us_index.php )
3> Firewall - Avoiding XP SP2's, www.zonealarm.com has a good free firewall.
4> Spyware - AdAware does a great job detecting and removing spyware. ( www.lavasoftusa.com ) Free version requires that you run it manualy once a week/month/day.

Re:Backups, A/V, firewall, and spyware

[binaryspiral]

Spybot does not require manual operation - I have startup scripts to update itself, scan, remove, and close the app without ever showing itself to the user.

AdAware requires commercial licenses when used on non-residential computers. Spybot does not.

I agree AdAware is polished and more refined, but spybot does a great job and has lots of Admin friendly programming.

Re:Backups, A/V, firewall, and spyware

[cyber0ne]

That's all well and good, but the problem is that the business doesn't want to bother with these things. You might as well suggest that they secure the machine by unplugging it. It'll be 100% secure, but the business isn't interested in such measures.

He'd have better luck trying to find a precedent somewhere to show them. Maybe another small business in the area has had serious problems. I know one of the small businesses in my area absolutely refused any kind of protection because "it had never been a problem before." Then they got hit by some trojans, and hit hard. Their entire business was halted for a few days because their data couldn't be accessed. After the dust settled, their data was downright gone.

Your suggestions are good and would help protect them (emphasis on help... someone else said it best earlier that "security is a process, not a product"), but your suggestions can't protect them from not wanting to be protected.

Re:Backups, A/V, firewall, and spyware

[plainclothesgeek]

are these scripts available to the public? i would find these greatly helpful!

You poor USians

[samael]

If you lived in a reasonable part of the world then you could report them under Data Protection law. If only you didn't let your corporations run the country.

Re:You poor USians

[fuzzybunny]

Yes, and in several of those "reasonable" parts of the world you're SOL when it comes to the most effective way of dealing with companies that follow dodgy business practices: vote with your feet and your wallet.

And yes, I do live in one of those "reasonable" parts of the world. We have a strong data protection law. On the other hand, if my rental agents commit horseshit, standard, legally defensible rental contracts here specify a 3 month notice period, 2 months deposit, and only two cancellation dates per year.

I won't argue whether solving these problems by having strong competition or strong legislation is better, but don't make the mistake of thinking that absence of one means absence of the other.

If, as I assume, by "sensible part of the world" you mean "Europe", there are profound cultural differences in how economic responsibility and individual ability to take action outside of recourse to government regulation are viewed.

Re:You poor USians

[simplypeachy]

Heh. The Data Protection Act can be your friend...I recently had my email address along with over 1000 others Cc:ed to a marketing email that a company sent out to it's customers.

Since then I've had 12+ UCE and 10+ non-UCE email from recipients ignoring the little "CC_List" in their Cc: box.

Said company told me categorically that they didn't breach the DPA by disclosing my email address. I'd already talked to the Information Commissioner about it who said otherwise.

I did show the droid that said it wasn't a breach how they could WHOIS my domain name and get my name and home address. Got a standard copied-and-pasted-from-brochure response :-)

Am now pondering if I want to get the Information Commissioner to formally investigate the thing. I don't want to add to the "compensation culture" but do want the idiots to publicly admit they're wrong and say they did screw up. And then prove they're forwarding (and following-up to) abuse complaints to ISPs/hosts of every UCE that comes from it, ever.

End of rant

Re:You poor USians

[Anonymous Coward]

If only you didn't let your corporations run the country.

I assume from your email address that you are from the UK, same as me? Take a look around. Look at the crap that is happening to hospitals, schools and land development. The UK government is handing taxpayer money over to corporations left right and centre. We're not much better than the USA.

Re:You poor USians

[26199]

The UK Data Protection Act is, IMHO, one of the biggest victories for the people in UK law. It's a shame that there's no way to hold non-UK companies you deal with over the internet to the same standards.

It's also costly and annoying for businesses... but reasonably so, I think.

Re:You poor USians

[samael]

Report them - it won't cost them a fine if they cooperate. Make them realise they can't flout a law that's actually good for their customers.

Re:You poor USians

[pbhj]

How come America seems to be able to apply it's law everywhere but we can't ...

I volunteered for a day at a local non-profit

[quintessent]

I was helping them install some digital camera software.

The system was running horribly slow. When I opened a web browser to Google and got a pop-up, I knew exactly what was up. Ad-aware (Not to be confused with Ada-ware, which also claims to be an anti-spyware program) found about 6 different spyware apps. Once I had cleaned those off, the system ran 3 or 4 times as fast. Those apps had really cloggled up its limited RAM.

This was a fairly busy non-profit helping clients pretty much continuously throughout the day.

Re:I volunteered for a day at a local non-profit

[Piquan]

How do you volunteer as a sysadmin for a day? Is there some sort of clearing-house for these things, or do you know somebody at the charity, or what?

I think it'd be great to do... using my talents to help charity in an effective manner.

Re:I volunteered for a day at a local non-profit

[quintessent]

I found them on VolunteerMatch. They were asking for computer help. Turns out, all they really needed were data entry monkeys. But then they asked about doing a one time gig, so I went in for that.

Re:I volunteered for a day at a local non-profit

[exhilaration]

http://www.volunteermatch.org/

What I've seen

[dtfinch]

A lot of multiuser POS/Point Of Sale systems store their data on a network file share, in dbase or some other ISAM format. And on top of that, few do any sort of encryption of customer information, like credit card numbers. The result, anyone at a computer that can access the application can steal sensitive customer information and anything else with minimal effort.

Re:What I've seen

[simplypeachy]

How dare they use such unsecure systems! Why, they could pay a few more pounds/bucks and use a password-protected MS Access database!

</satire>
I've seen that too. Same with back office systems. Worse, actually; some back officies have 5+ years of unencrypted credit card transactions

Re:What I've seen

[mrzaph0d]

heh, completely off-topic, but i was listening to a police scanner late one night and heard two officers talking about a database -

Officer 1: "no, its just an Access Database, you should be able to get to it."
Officer 2: "what's the name?"
Officer 1: "something like [city] prostitution database. the password is 'hooker'"

Annual Inspection for computers

[Gordonjcp]

This is why all computers that are used for commercial purposes should have an annual "MOT" - possibly more often than that.

Think about it - if you run a courier company, how much trouble would you be in if it was discovered that none of your vans were MOTed, and none of your drivers were licensed?

Re:Annual Inspection for computers

[hab136]

This is why all computers that are used for commercial purposes should have an annual "MOT" - possibly more often than that.

• Motorized Operation Transformer?
• Messy Octopus Tree?
• Mulberry Olfactory Trifecta?
• Mildew Orange Train?

What, pray tell, is an MOT? (Aside from Motorola's stock ticker)

Re:Annual Inspection for computers

[Tooky]

What, pray tell, is an MOT?

The MOT was the Ministry of Transport in the UK, sometime in the UK they started annual safety tests for cars over three years old. So the gradparent actually meant an MOT Test, although it is colloquially shortened to MOT.

good idea,

[Unknown Poltroon]

But first, change the amount you owe. THink of it as a "consulting fee"

Re:good idea,

[Marxist Hacker 42]

Better yet- change the ammount that neighbor who has all the loud parties owes- to zero. And see how long it takes managment to notice.

Annual safety inspection for cars.

[Gordonjcp]

Two seconds with Google would tell you that.

Re:Annual safety inspection for cars.

[Lord Dreamshaper]

and you just spent more time being a cryptic ass than you would have spent enlightening us

Re:Annual safety inspection for cars.

[hab136]

Two seconds with Google would tell you that.

I did Google it:

1. Motorola
2. Motorola
3. Museum of Tolerance
4. Larz Anderson Car Museum
5. Motorola again
6. Motorola yet again
7. The Ministry of Trade for Vietnam
8. UKMOT with no explanation from Google on what that is (and thus no reason to investigate that page)
9. Cambodia Tourism
10. Microarray Databases

I finally figured out that "UKMOT" is what you're talking about, but no, it wasn't obvious, even after Googling.

Interestingly, Google UK doesn't even return UKMOT as a result on the first page. Though if you click "Pages from the UK", you get not UKMOT, but this page

With the amount of cross-Atlantic traffic, you could've helped us Yanks (not to mention the non-native English speakers) out with at least the full name .. which, even after reading their FAQ I still don't know what MOT stands for.

You could've also said "annual saftey inspection" in the original post instead of the UK-specific "MOT".

You're obviously trying to express information (by posting), which I applaud; you'll reach many more minds if you make your post self-explanatory, or at least provide a link.

Re:Annual safety inspection for cars.

[Anonymous Coward]

As if you Americans ever feel the need to explain your American terms and references. You usually don't even realise you are using them, you just assume the whole world is America. Well now you know what the rest of the world feels like when you talk.

Re:Annual safety inspection for cars.

[hab136]

As if you Americans ever feel the need to explain your American terms and references. You usually don't even realise you are using them, you just assume the whole world is America. Well now you know what the rest of the world feels like when you talk.

As an American, I do try to explain my terms when speaking to an international audience (the internet). Of course, I have non-American friends, so I'm quite aware of it. On the occasion that I don't fully explain myself, and someone inquires, I try to give them an explanation instead of a snide answer.

Yes, there are stupid, "the world revolves around me" people in the US, as everywhere. If it seems that the US has more idiots, keep in mind that the US has a population that is 4.8 times the UK's (293,027,57 vs 60,270,708), so it's bound to have 4.8 times the idiots that the UK does.

It would be best if everyone explained their terms, Americans included. Imagine if everyone was able to figure out what you were talking about.. we might actually be able to understand each other. :)

Re:Annual safety inspection for cars.

[Exocet]

Since no on really answered it... I believe it stands for "Ministry of Transportation". As in, "MOT test".

The UKMOT page explains what the MOT test is: "The MOT is effectively the examination of a motor vehicle's safety-related systems components to ensure that they have not worn to an excessive level which would otherwise render the vehicle unsafe for use on the road."

As an American, I wouldn't have guessed "Ministry of Transportation" as we don't have Ministries here.

BTW, I searched via google w/o the quotes: "What does MOT mean?" The first result was what I got my info from.

Wireless also a problem

[Thyamine]

My friend's old complex had a similar problem. Living right next to the office and the model, he noticed one day that they had installed a wireless router, but had absolutely no security for their network. All their busines information to any who wandered by.

How do you address problems where the technology is getting easier to use, but where the users aren't spending the time to really learn the technology? I don't want to have to learn how to repair my car just to drive it, so can I expect much more from users who don't understand networking and security?

Re:Wireless also a problem

[jorenko]

If the locks on your car doors fell off, you'd hire a mechanic to install new ones, right? Convince them they need to do the same.

Patient records

[mrph]

Working in Medical IT, I can tell you that that several large vendors of systems holding patient information take second
to no precautions when setting up servers. Software ship with built-in administrative account using default passwords,
installation people use easy-to-guess root passwords and so on.

And we're not talking about Dr. Jones down the street but enterprise-grade installations that can handle really large quantities of patient data.

Re:Patient records

[Anonymous Coward]

As someone who formerly worked for one of these companies... well, you're spot-on. Anyone with two ounces of sense could get the admin and DB passwords that we used. In the two years I deployed/tested the product, they never changed the PWs, even the backdoor password that gets you access to the DB without auditing - very bad for HIPPA.

I could walk into any facility in the world using our product and immediately get access to pretty much anything. I could dial in to any of these facilities and interfere with operations (as in, they have someone cut open) in progress. It's not just me, either. There's probably fifty people out there with the same knowledge I do.

Am I missing something?

[Anonymous Coward]

This looks like the easiest security problem ever. This is what you do. Keep the tenant records on one computer that has no network connections, and let the employees play on the internet using a different computer. Do they even need the internet for their job?

In Canada

[yamla]

In Canada, your personal information is protected by the PIPED Act. Such a situation as you are describing with your rental office would be illegal in Canada. They have no option but to perform due dilligence in securing your personal information. That means antivirus software if they are running Windows, a decent hardware, encrypted records if necessary, no relying on MS Office (older versions) to encrypt documents, no emailing personal information through unsecured channels, etc. etc. If they aren't following through ("no problems in the past", etc.), you can complain to the Privacy Commissioner and there'll be hell to pay. I know a small business that was recently slapped with fines and a public reprimand for accidentally faxing personal records to the wrong fax number.

They Broke The First Rule

[Ed Almos]

Never mind what OS they were running or the state of their firewall, the company broke the first rule. Once somebody has physical access to your machine you're hosed.

I don't care if you're a client of our company or the finest I.T. geek on the planet, if I find that you, as a none-company employee, have been messing around with one of the machines under my care then the cops get called and the hard drive gets wiped.

Ed Almos
Budapest, Hungary

Re:They Broke The First Rule

[AuraSeer]

Does that mean you mean you assume your company employees to be 100% trustworthy, honest, and ethical at all times?

If you answered no, then I wonder why you trust an outside contractor so very much less than your internal people.

If you answered yes, you're not very familiar with human nature.

Talk to Your Neighbors

[kmb]

See how the other people in your building feel about the situation. If enough people are pissed off, er, concerned, then you might be able to put some pressure on your landlord.

Possible repercussions:

1. Your toilet takes longer to get fixed.
2. Everyone's rent goes up to pay for $300 worth of software.

OK, I could have explained the acronym.

[Gordonjcp]

But since most people across Europe seem to call it an "MOT", even if their equivalent of the UK's Ministry of Transport is called something quite different, I just thought that most people would know.

Since, from what I see of cars friends of mine have imported, there does not seem to be any kind of equivalent in the US, maybe it's not a familiar term over there.

Re:OK, I could have explained the acronym.

[hab136]

Since, from what I see of cars friends of mine have imported, there does not seem to be any kind of equivalent in the US, maybe it's not a familiar term over there.

It's normally just called "inspection", no special acronym. Check the headlights, emissions, horn, etc.

The nasty way

[Marxist Hacker 42]

Break into the system. Steal the data. Remove yours. Get a cheap anonymous webmail address. E-mail it to their CEO. Then erase your tracks. Next quarter for sure there will be a budget for security- and since you know ahead of time, send them a resume.

Threaten them

[mattboston]

File a formal complaint/lawsuit saying that they aren't protecting your personal information!!!

Re:Threaten them

[dacarr]

In some places like California, that can earn you a 30-day notice to leave - which can be issued for any reason, including "no reason".

Are Californian cars exempt?

[Gordonjcp]

We've brought over a couple of Mustangs, a couple of Dodge Chargers, and a few others. Apart from signs of the emission controls being carefully adjusted, the rest of the car was in a terrible state - so much so that we had to scrap two. Things like, chassis legs pop-riveted on, bits of biscuit tin sitting on the floor under the carpet (not welded down, not even glued in, just lying over the holes in the floorpan), brake pipes that had been patched with petrol hose, some real suicide merchant horror stories.

Re:Are Californian cars exempt?

[pthisis]

Selling out of state/country is a common way to unload cars that fail inspection.

Re:Are Californian cars exempt?

[hab136]

We've brought over a couple of Mustangs, a couple of Dodge Chargers, and a few others. Apart from signs of the emission controls being carefully adjusted, the rest of the car was in a terrible state - so much so that we had to scrap two. Things like, chassis legs pop-riveted on, bits of biscuit tin sitting on the floor under the carpet (not welded down, not even glued in, just lying over the holes in the floorpan), brake pipes that had been patched with petrol hose, some real suicide merchant horror stories.

Every state in the US has different laws with regards to vehicles.. it's not so much "exempt" as it is "California doesn't have a law like that", much as France isn't "exempt" from Germany's laws; they're different legal systems, even though they're both part of the EU. Indeed, the US is structured much like the EU is, it's just that over the years the central federal government has taken over many more things with sometimes questionable court decisions and things like they give the states money for highways, but only if they set speed limits the federal goverment likes. There's no reason an individual state couldn't decide to have a 200mph speed limit, except the federal government would stop helping them out with highway funds.

As far as I can tell California has smog/emission laws, but not safety inspections. It's illegal to operate an unsafe vehicle on the road in California (as everywhere in the US), but you're not required to prove the car's safety before getting a license plate, as you do in North Carolina.

If one of those cars were stopped by a policeman, they could be given a ticket, and in an accident the driver would be liable due to negligence. Otherwise, it seems there is no penalty for having a broken-down heap of a car.

That is.... terrifying.

[Gordonjcp]

I mean, the "good" Mustang wouldn't even *nearly* pass a UK MOT, and took about six months of work to get it to a stage where we could take it in to find out what it would fail on. None of the "repairs" looked particularly fresh, either...

It's funny, the US has stringent requirements for safety for imported cars (look at the stupid rubber bumpers on late-model MGBs, for instance), but locally-produced cars are, even when in "as new" condition, too fundamentally unsafe to drive on UK roads.

Re:IT 4 rent arrangement - UK data protection act

[pbhj]

The Data Protection Act 1998 (UK) makes it a legal requirement for companies to secure personal data.

http://www.informationcommissioner.gov.uk/

There must be something similar in the US??!

Of course if you say "I'm going to sue you for not protecting my personal data; but you could hire me instead" then that sounds a lot like extortion.

Be careful.

pbhj