Slashdot Mirror
Marriott Discloses Missing Data Files
An anonymous reader writes "Marriott International has admitted that it is missing backup computer tapes containing credit card account information and the Social Security numbers of about 206,000 time-share owners and customers, as well as employees of the company." From the Washington Post story: "Officials at Marriott Vacation Club International said it is not clear whether the tapes, missing since mid-November, were stolen from the company's Orlando headquarters or whether they were simply lost. An internal investigation produced no clear answer. The company notified the Secret Service over the past two weeks, and has also told credit card companies and other financial institutions about the loss of the tapes."
Can anyone tell me why Marriot has the SSNs of Customers?
Time-share owners, maybe, employees definately, but customers? Why?
-Ryan
AUWYHSTOT (Acronyms are Useless When You Have to Spell Them Out Too)
I stayed in a Holiday Inn Express last night.
With $105 billion in this type of crime in 2005, I'm glad the Department of Homeland Security has had their budget cut to $16 million. That should stop those crooks!
The theory of relativity doesn't work right in Arkansas.
Now wifey will never know.
Back in ancient days (pre-500 AD for example), it was not a rare thing for vaguely look-alike, or not even look-alike people, to claim to be someone famous/important in a village or town where nobody could invalidate the claim (or those who would validate it were being duped or willing participants).
This is a quite old crime. The difference is that now identity theft of everyday people can be lucrative, and you don't even need to look like them or deal with tricking others. And you don't have to worry about being lynched or stoned, just going to jail.
Hunt your preferred prey at Aliens vs Predator MUD. Join the war at avpmud.com port 4000
Let me ask a simple question: Why don't they encrypt this stuff?
Be afraid. Be very afraid.
Considering the time of year, no doubt some Marriott PHB who was looking for some extra X-Mas cash decided to "sell their list". While many companies have absolutely no qualms about selling customer information (AKA creating a new "profit center"),
I am more inclided to believe that the backup tapes were lost or stolen, rather than a conscious effort to create a new corporate profit center.
Then again, John Poindexter's "Total Information Awareness" project (entirely DoD databases) was morphed into "MATRIX", which was designed to make use of multiple commercial (and commercially available) databases. So, perhaps, it was was merely an "extra patriotic" Marriott employee.
Considering recent events in the news (non-FISA approved wiretapping), perhaps one possibility is just as scary as the other...
Many companies out there wouldn't even know if their tapes had been misplaced or lost. At 3 companies I've worked for, we've had tapes lying around in managers' offices and server rooms, many that contain information that could be used for identity theft.
Marriott has handled this correctly and deserves some credit for doing so. At least they're not trying to cover it up like some companies would.
You have enemies? Good. That means you've stood up for something, sometime in your life. --Winston Churchill
I'm glad to read Marriot is offering credit fraud monitoring to the affected people like how Ford offered to its employees when they recently lost 70,000 employee/retiree SSNs. Unless it is lifetime monitoring I fail to see the long term value.
Wait a second, why don't the credit bureaus offer free lifetime credit fraud monitoring to everyone in the first place?
Speak truth to power.
Forgive me for being uninformed, but why would the Secret Service be the agency responsible for investigating this type of incident?
Unless Valerie Plame had a timeshare.....
-- If you try to fail and succeed, which have you done? - Uli's moose
Security through obscurity in not a reliable form of security. You have to pay for that obscurity by having a one off system that is not supported and you pay through the nose to keep it running reliably in your enterprise. A standard LTO3 backup tape is almost $100, imagine what some specialized tape would cost when your company is the only one buying them.
Basically, you pay a lot of money for some unknown amount of obscurity and reliability that has not been tested by more then a few people. Not cost effective at all when compared to standard equipment coupled with good security practices like accounting, tracking, and encryption. Is there even an enterprise backup system sold in the last few years that does not support some type of encryption?
IT is a cost center, not a revenue generator. Trying to squeeze security hardware, software, or better practices into IT budgets and manpower is a hard and normally plays out some combination of two ways.
Proactive and shot down -
IT managers have a hard time getting others outside of IT to listen to potential issues. This changes rapidly after a breach and IT managers may be replaced.
Coast and milk -
IT managers do not even want to bring up or even know about things like security because doing things the way they have always been has worked so far and makes the technical part of the manager job easier. Why rock the boat? That system was in place when I got here and we've been doing it this way for years and certainly "they" up there no about it so I'll go with the flow. That method of brown nosing and coasting with your other manager peers for a while typcially leads to the unemployment line with a knife in your back after a security breach! As it should IMHO.
Bad boys rape our young girls but Violet gives willingly.
AC for obvious reasons...
;-)). Anyway, the first day, FIRST DAY! I was working there I had access to all the back-up tapes for the past month with every guests name, address, phone number, what government agency/corporation they work for, and CC#'s/expiration dates. The tapes are all sitting in a filing cabinet in the front office.
I work the front desk at a competing 4-star hotel chain. I work the night shift ($10/hr to sit there babysitting the desk and reading/fiddling on my laptop, great job for students
So many people touch the tapes, front desk staff/accounting/reservations/IT, that if one went missing it would be impossible to track back to an individual. What's more, if I just picked up my own tape and made a dupe at night in 35 minutes while I'm there alone nobody would ever know.
This is a 400 room hotel in a major U.S. city, access to literally tens of thousands of names, addresses and associating credit card numbers, all for filling out a standard job application that I may or may not have filled out accurately. Unbelievable.
that if these large corporations can't be trusted to play with their computers safely, maybe they should have them taken away. At the very least, I think some adult supervision should be required by law. And if that doesn't work, send them back to using typewriters and filing cabinets.
The higher the technology, the sharper that two-edged sword.
A report (with pretty graphs) from a recent financial engineering class. Data was from Feb to Sep 2005...
The 83 recorded loss events were categorized by loss event type and by industry sector. The data is relevant over 232 days. This yields a probability of a loss event occurring in any sector on any given day 35.7%. If only events affecting financial services institutions are counted, the probability is 7.5%.
http://privacydata.michaelaiello.com/paper.pdf
Bring forth the math corrections
and maybe I'm just ignorant, but WHY DON'T THEY ENCRYPT ALL THAT INFORMATION WHEN IT LEAVES THE MAIN DATA WAREHOUSE? It seems to me that by encrypting its contents, you put some security around it should it be lost/stolen/etc. Can anyone explain why this isn't done?
We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
In a previous job we did all our backups on nine track tape. Older backups were impossible to read because the magnetic coating would just stick to the read head.
Nobody was going to steal that data!
http://michaelsmith.id.au
They don't do free monitoring, but if you're willing to do the legwork of monitoring yourself, you can monitor your credit file yourself, free of charge. clicky
"Avoid employing unlucky people - throw half of the pile of CVs in the bin without reading them." -- David Brent
It's realistic to expect that there is sensitive data out there - the answer is not to say "don't store my SSN", although that should certainly be restricted.
It seems to me that the answer is ENCRYPTION! Encrypt the data and you can back it up on fucking postcards and send it to my grandmother for all I care..
When backing up, generate a random "tape" key. Encrypt this "tape key" using a block cipher and your official key. Store the encrypted tape key several times at several locations on the tape. The locations of the key must be known without needing to read the tape to find them.
With that set up, encrypt the main contents of the tape with a stream cipher (say, RC4) with the tape key.
This way, damage to a certain area of the tape will not result in a complete loss of data. Using a random key for each tape eliminates the big cryptographic no-no of using a stream cipher key twice.
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Marriott soon-to-be-ex SA: "Um, didn't they already come this week?"