Ohio Plans To Encrypt After Data Breach

Lucas123 writes "After a backup tape containing sensitive information on 130,000 Ohio residents, current and former employees, and businesses was stolen from the car of a government intern in June, the state government just announced it has purchased 60,000 licenses of encryption software — McAfee's SafeBoot — for state offices to use to protect data. It's estimated that the missing backup tape will cost Ohio $3 million. In September, the state docked a government official about a week of future vacation time for not ensuring that the data would be protected."

Comments

hindsight is 20/20

[Endloser]

People just won't learn that security should be proactive. Society is a very slow learner.

Re:hindsight is 20/20

[__aaclcg7560]

Especially when senesitive data is given to an intern. Doesn't anyone read Dilbert?

Wonder if McAfee payed them

[orclevegam]

Would not be surprised to find out that a McAfee representative payed them to use their software. Still even if that's the case it's good that they're doing something.

Re:Wonder if McAfee payed them

[geekoid]

If that was true, somebody would find out, and that would get people fired.
Probably a quick purchase based on needing something now.

Re:Wonder if McAfee payed them

[doas777]

exactly! safeboot does a good job. I can't say i like mcaffee, but the product comparision is most favorable.

Re:Wonder if McAfee payed them

[a_nonamiss]

As an IT professional in Ohio who works in a field very close in both location and function to what this company did, I just want to say that this whole thing has been blown so far out of proportion it's not even funny. Yes, there was some sloppiness going on. Yes, someone, maybe a few people, deserved to lose their jobs over this. However, the amount of time and money that has been spent on this is so far overboard it's ridiculous.

No actual loss has ever been reported as a result of this breach. The tape that was stolen was in a relatively obscure tape format. (I don't believe it's ever been reported, but I work with similar systems, and I would guess it's probably 5 1/4 inch format, likely not even in ASCII. Most of the data backups we get are EBCDIC.) It was unencrypted, but in order for someone to get anything off this, they would need the correct hardware, the correct software and they'd really need to know that they were looking for something. Add to that it wasn't reported until weeks after the loss, by which time the thug who broke into the car had log since ditched the useless cassette tape that he stole.

Meanwhile, Ohio taxpayers are spending millions of dollars doing credit checks on every person whose information was potentially on that tape.

I'm not advocating that we forgo due diligence. I take great care in making sure that all backups from my company are encrypted. I hound everyone in the office to make sure their passwords are secure. However, the fact that we're still speding money on this makes me irate. If there was any indication whatsoever that this data was compromised, I'd be OK, but there's a 99% chance that this tape is in a landfill in southern Columbus right now.

Re:Wonder if McAfee payed them

[Anonymous Coward]

Yea, one disaster after another. And I was taught lightning never hits the same spot twice... 60 fucking thousand licenses must've cost them some sweet greenbacks! And some people wonder why ohio is seen as backwards red neck country... oh boy!

Re:Wonder if McAfee payed them

[WhatAmIDoingHere]

Doesn't matter if it's carved into a brick of lead weighing 4 tons and can only be read by a half blind midget who is kept locked in a dungeon under the guard of five dragons.

The brick being stolen is a security breach, and the information that was carved into it is now to be considered 'out in the open.'

Security through obscurity? Get real.

Re:Wonder if McAfee payed them

[a_nonamiss]

According to your definition, there is a whole hell of a lot of data "out in the open." In Windows 2000/XP, it's reasonably difficult to encrypt your system drive and your pagefile. Even if you diligently keep 100% of your data on an encrypted volume, can you guarantee that no social security numbers were written to your pagefile? That data can be scraped, you know. Plus, if your computer is stolen, can you tell with any degree of confidence which records were in that pagefile? No? Then you have to assume that all of them were compromised.

Truthfully, the only perfect security is a computer that's disconnected from the Internet, underground, in a locked room turned off with all the hard drive cables removed. And even then, "they" can probably read the information from their satellites in space. In the real world, we need to make compromises.

All of our company backups are encrypted using 256-bit AES encryption. If one gets stolen, I can't "guarantee" that the data hasn't been compromised. After all, someone with a few billion^10 CPU cycles to spare could crack the encryption algorithm. Sure, AES is trusted by the Pentagon, but that doesn't mean it's 100% infallible. In fact, there's a calculable mathematical chance that someone could guess the encryption key on the very first try, even without a supercomputer. It's damn unlikely, but certainly not impossible.

So the question comes down to this: what level of risk are you prepared to accept? More importantly, what level of security are you willing to pay for? Security isn't free. "Perfect" security (like nuclear launch codes, where failure is absolutely not an option) is very expensive. Would you be willing to donate a couple thousand dollars of your own money (along with every other taxpayer) to replace all computers in the country with ones that have hardware-level encryption? Is that good enough? Most of our customers are small, non-profit organizations already run on a shoestring budget. Most of them can't afford to hire a proper secretary, let alone an IT specialist who knows how to use TrueCrypt and enforce security policies.

Listen, I'm not arguing against data security. If you knew me personally, you'd know I'm a very security conscious individual, but I'm saying that we need to be realistic. We need to spend a finite amount of money where it will do the most good. Those millions of dollars in Ohio put towards useless credit checks were funneled directly away from our customers' already meager budgets. My boss is a nice guy, but he needs to keep the company running, so he can't donate our services. That money could have been spent on education, or updated hardware, or proper disposal of old equipment. Put in perspective, there are breaches far more egregious than this one that happen every day, and I can say first-hand that they are usually the result of ignorance. Some people don't know it's not OK to save a SQL backup to a USB key and take it home. Some people don't know that you have to DBAN a hard drive before you throw the computer away. These are far more dangerous than a lost (and probably trashed) AS400 backup.

Re:Wonder if McAfee payed them

[jimicus]

Doesn't matter if it's carved into a brick of lead weighing 4 tons and can only be read by a half blind midget who is kept locked in a dungeon under the guard of five dragons.

Where can I get such a brick?

Re:Wonder if McAfee payed them

[Bill_the_Engineer]

It's amazing what you can find at state auctions, and maybe even eBay.

My point being don't count on the cassette tape from being completely useless, and EBCDIC to ASCII translation is not that big a deal.

Re:Wonder if McAfee payed them

[Anonymous Coward]

whats the point of hounding everyone for password security if its just windows? i can blank out any windows password with a linux boot disk.

Re:Wonder if McAfee payed them

[a_nonamiss]

whats the point of hounding everyone for password security if its just windows? i can blank out any windows password with a linux boot disk. I doubt it. Someone who doesn't know how to use the shift key doesn't present a threat to my network. You probably say things like this because you think it'll makes you sound cool, but it just shows your ignorance. I love Linux. I use it for a lot of things. But if you want to make a living in the software industry, you can't avoid Windows.

A competent sysadmin with good understanding of encrypted volumes, Kerberos, NTLMv2 and group policy can enforce good security, even in Windows. There are definitely risks that I live in fear of, but some kid with a LiveCD isn't one of them.

Re:Wonder if McAfee payed them

[a_nonamiss]

I know that EBCDIC -> ASCII isn't a big deal to geeks like us, but any person that even knows what those words mean can make more money in the IT industry than stealing car stereos.

I like your other point, too. There are far more serious breaches being made every day auctioning off equipment at state auctions and on eBay. A cash-strapped homeless shelter might auction off a Pentium 200MMX to pay for another hot meal, not realizing that a list of indigent names and social security numbers could be a gold mine for an identity thief. The only way to fight ignorance is with education, not with credit monitoring.

Re:Wonder if McAfee payed them

[Bill_the_Engineer]

I know that EBCDIC -> ASCII isn't a big deal to geeks like us, but any person that even knows what those words mean can make more money in the IT industry than stealing car stereos.

You assume the car thief is the same person doing the ID theft. Chances are good that the thief passed the cassette to someone else, and the press unwittingly authenticated the cassette to the potential buyer.

I like your other point, too. There are far more serious breaches being made every day auctioning off equipment at state auctions and on eBay.

Well that wasn't really my point. My point was that a reader for the cassette is not that hard to come by. State governments are always auctioning off excess or out-of-date equipment.

You make some assumptions of the technical abilities of a "common" thief. I remember when there were a rash of credit card number thefts from unscrupulous waiters/waitresses swiping credit cards in a portable card reader and selling the stored numbers on the internet. There a lot of unauthorized cable and satellite viewers who are not in the I.T. business. Let's not forget about the script kiddies!

Besides why can't I.T. professionals be car thieves? They could be recently unemployed from the last round of outsourcing to India.

At any case, it was a very bad thing to have a backup tape in an employee's car. It is also a very bad thing to assume that the cassette tape is safe because it may be obscured.

Re:Wonder if McAfee payed them

[a_nonamiss]

Chances are good that the thief passed the cassette to someone else, and the press unwittingly authenticated the cassette to the potential buyer. Had this made the news immediately, I would agree with you, but the news outlets didn't report it for months. If I were an intelligent ID thief, the smart move would have been to exploit this information as soon as possible, preferably before it was reported.

At any case, it was a very bad thing to have a backup tape in an employee's car. You and I don't disagree there. That employee should have been terminated. His superior should have been terminated. The person who came up with this hare-brained backup idea should be terminated. In all honesty, the consulting company itself is probably no longer getting state contracts. This is all just.

It is also a very bad thing to assume that the cassette tape is safe because it may be obscured. I don't assume it's safe. But I don't assume anything is safe. I assume that every machine in my office is going to be stolen tomorrow, and I try to imagine what would be in my report to the state if that were to happen. Is our security airtight? Not by a longshot. Anyone telling you that their security is airtight either works at the Pentagon, or has a dangerously sad understanding of security. (or both) However, I can say that we've used the best technology available and practical to assure that the data on our networks doesn't fall into the wrong hands.

Re:Wonder if McAfee payed them

[Bill_the_Engineer]

I don't assume it's safe. But I don't assume anything is safe. I assume that every machine in my office is going to be stolen tomorrow, and I try to imagine what would be in my report to the state if that were to happen. Is our security airtight? Not by a longshot. Anyone telling you that their security is airtight either works at the Pentagon, or has a dangerously sad understanding of security. (or both) However, I can say that we've used the best technology available and practical to assure that the data on our networks doesn't fall into the wrong hands.

I agree. It's never a matter of if, it's a matter of when. The idea behind encryption is to try to delay the information from being interpreted until after it is no longer valuable.

Backups Won't Be Encrypted

[nuxx]

Er, while this software encrypts data on the disk, it doesn't encrypt the backups. These will still be cleanly read from the disks and written out to tape.

Re:Backups Won't Be Encrypted

[LiquidCoooled]

I had this thought as well.
In the UK, lots of government agencies seem to enjoy posting random cds of data around and news is getting out they are being lost.

I have no technical problem with the data being unencrypted onsite as long as adequate access controls are in place, I am more worried about the backups.

Re:Backups Won't Be Encrypted

[afidel]

I would bet they are also going to use encryption in their backup procedure, either in the backup software (inexpensive licensing but expensive in CPU time and hitting backup windows) or by purchasing new tape libraries/drives with crypto modules (not so cheap, though a few vendors offer it at little extra cost once you've already bought the expensive library).

Re:Backups Won't Be Encrypted

[palegray.net]

You make the assertion that this software won't encrypt the backups. Please answer the following questions:

1. What are your sources for that assertion?

2. Have you personally used the software?

3. Have you seen this page?

Next time, please think before posting. If you're 100% sure your original statement is valid, I'll gladly stand corrected and eat a healthy slice of humble pie.

Re:Backups Won't Be Encrypted

[Anonymous Coward]

I have no technical problem with the data being unencrypted onsite as long as adequate access controls are in place, I am more worried about the backups.

Really? I'm more worried about the fact that apparently thousands of random low level Civil Servants have DBA level access to sensitive data, can burn copies of this data to CD easily and no one at these sites seems to pay much attention to where these CDs go once they've been burnt.

Who else do you think has access to all that data?

Re:Backups Won't Be Encrypted

[Colin Smith]

Next time, please think before posting. If you're 100% sure your original statement is valid, I'll gladly stand corrected and eat a healthy slice of humble pie. I sincerely hope you are not in charge of security in your organisation. With security you have to take the position that you are not secure. That is the default hypothesis.

It doesn't mention tape drives... It mentions laptops, USB disks, hard disks, PDAs. It doesn't mention tape drives or backups, anywhere. Unless the site, application specifically state that they support backup systems, I have to assume that it doesn't and the system doesn't actually solve the original problem of backup tapes being lost at all.

60,000 licenses?

[Knara]

Couldn't they have found an OSS solution that would have, y'know, saved the state an assload of money? I'm not an "OSS can do everything commercial software can, but better!" zealot, but that's a big bit of pocket change to be throwin' out for a solution, there.

Re:60,000 licenses?

[duffbeer703]

There are no Open Source FDE solutions, although some of the commercial products use OpenSSL.

Re:60,000 licenses?

[JimDaGeek]

Hmm, www.safeboot.com seems real secure. What's not to like? ;-)

Re:60,000 licenses?

[Beat The Odds]

Couldn't they have found an OSS solution that would have, y'know, saved the state an assload of money?

A pantload maybe.......

Re:60,000 licenses?

[schneidafunk]

I know this is a terrible excuse, but paying for a solution *may* make the ignorant masses feel better.

taxpayer: "hey you could have prevented this disaster without spending an assload of money? WTF!"

Re:60,000 licenses?

[Lord Ender]

The only semi-mature opensource disk encryption product is TrueCrypt, and that completely lacks centralized management and the ability to encrypt boot partitions.

Also, as is obvious to anyone who has been watching the news in the past year, the state of Ohio does not exactly have a stellar, top-talent IT program. It would not be a good idea for the to forge a new path with unsupported software.

Re:60,000 licenses?

[Anonymous Coward]

Just have a data drive thats fully encrypted and it always makes sense to have your OS on a separate drive.
Open source encryption can do that for free.

But then again its only saving thier money and encryption is encryption.
I cant belive im saying this but i hope that we (UK) learn from America on this one

Re:60,000 licenses?

[CodeBuster]

It seems to me that unless they need or want whole disk encryption of the boot partition, which still doesn't answer the unencrypted backup tape question, that TrueCrypt would have been perfect for them.

Re:60,000 licenses?

[Anonymous Coward]

You don't make it big in the business of government by NOT creating more and more agencies, programs, and laws, and unnecessary expenses -- and certainly not by declaring you already have enough tax dollars to feed your agenda.

You're not in the business of government, are you? ;)

Re:60,000 licenses?

[Chanc_Gorkon]

Clueless state officials would say I need a nic ecushy service contract. It's called indemnification. If they buy software, they THINK that they can absolve themselves of anything if they have that service contract. I keep telling my friends who work at the state that even though something is techically their fault, it's still the their responsibility to keep the data safe. This encryption software will fix diddly if people:

Share passwords
Share logins
Print stuff off on paper, take it home and lose it.

and more.

Re:60,000 licenses?

[Anonymous Coward]

"So and so lost our data" doesn't seem as bad as "So and so didn't follow 'procedure'". With procedure defined as following our encryption process. The later can be used in the following: "So and so didn't follow our encryption process so we fired them." The former: "so and so had data stolen from them", well stuff happens, better luck next time.

Re:60,000 licenses?

[Tetsujin]

I know this is a terrible excuse, but paying for a solution *may* make the ignorant masses feel better.

taxpayer: "hey you could have prevented this disaster without spending an assload of money? WTF!" More to the point, if there's another incident after they buy the software, they can blame McAffee...

Free Software Fails: "Thrifty" fellow who decided to use it gets burned ("Why did you cut corners on important security stuff? Why didn't you shell out some money for a real solution?")
McAffee Software Fails: Buyer takes some heat ("why did you buy that crap?") but seller takes more heat (their product is demonstrated ineffective in a widely published story...)

The fact that there's a software company motivated to not have a failure of their security product become a national news story, and motivated to get more licensing fees in the future is an asset, basically. That company will answer questions, and if solutions are needed they'll provide solutions - because the person asking has already thrown a metric buttload of money their way and likely will again in the future...

Re:60,000 licenses?

[Anonymous Coward]

Not only that, by not spending a lot of money, departments will often face budget cuts. Now they can get more money to spend each year because they have software licenses (some 60K) to renew .... or if not they get the same amount allocated to spend on something else. Waste of money, IMO, but this is the only evidence of a perpetual motion machine.

Re:60,000 licenses?

[Prof.Phreak]

"Why did you cut corners on important security stuff? Why didn't you shell out some money for a real solution?" ...``Now you'll lose a whole week of future vacation time due to this multimillion dollar screwup!''

Re:60,000 licenses?

[Anonymous Coward]

It seems to me that unless they need or want whole disk encryption of the boot partition, which still doesn't answer the unencrypted backup tape question, that TrueCrypt would have been perfect for them.

I work for a state university in Ohio, and I've actually been using TrueCrypt at work. They want centralized key management, so at least our fiefdom is going with a PGP full disk encryption product.

Re:60,000 licenses?

[Anonymous Coward]

Sure but where's the shrink wrapped package in OSS?

Mcaffee comes with a warm fuzzy feeling too.

Couldn't they have found an OSS solution that would have, y'know, saved the state an assload of money? I'm not an "OSS can do everything commercial software can, but better!" zealot, but that's a big bit of pocket change to be throwin' out for a solution, there.

Re:60,000 licenses?

[H310iSe]

truecrypt.

sigh

Re:60,000 licenses?

[Anonymous Coward]

Diligent state officials need to be able to mitigate the risks arising from purchasing a piece of software. Is it fit for purpose? Will it remain fit for purpose for a reasonable period?

OSS is fantastic and some products have proven themselves serviceable at a point in time AND for a considerable length of time. Apache, Samba and PHP some imediately to mind.

Others have no such provenance and in those cases OSS evangelists (as opposed to advocates) usually point to the established OSS projects and say "See? OSS is as reliable as rocks!". Now, dollars aside, if I am going to commit my agency to a technology and a way of doing things that may demand a change in existing processes that is just about worthless.
If all that expensive contract gives me is a way to sue the arse of a vendor if they let me down then so be it. It is better than stumbling on a blog post by Joe OSSdeveloper saying "I'm tired of this, I'm moving on, feel free to develop it yourself".

I honestly get sick of people accusing public officials of covering their arses when they are the first to call for their arses when ANYTHING goes wrong. Its the damned public they are indemnifying in the first place.

If you really want OSS to have a strong role in public administration you need to lobby for a whole-of-government response that provides a central clearing house for investigating endorsing and maybe even enhancing OSS products for governmental use. Then public officials dont need to ask "who the hell is Joe OSSdeveloper and can we migrate our whole infrastructure to his product??" - they just need to know that OSS project X has been endorsed to deliver FDE and the clearing house will provide up to, say, 12 months of support if it is suddenly EOL'd by its developer. Otherwise you have to wait until your OSS products build the sort of reputation that Apache and Samba have and that takes years of excellent work.

As far as poor implementation goes, that is a software neutral problem and that is all about responsibility - clear and unambiguous, from head of government all the way down to the lowest grunt. Leave one tiny niche for someone to begin to think "I thought XYZ was handling that" and the system falls down. Make people's responsibilities clear. Empower them to handle those responsibilities. Hold them accountable for their actions, fairly and reasonably.

Just stop kicking the agency guys for doing their damned job.

Re:60,000 licenses?

[SanityInAnarchy]

What makes TrueCrypt less "mature" than, say, LUKS or good ol' Cryptoloop?

And no software can give you the ability to encrypt boot partitions. Where do you suppose the software itself is stored, then? Maybe the Magical Crypto Fairies will decrypt it from the hard disk first thing? (Of course, I can always throw my boot partition on another device -- I currently boot my laptop off a USB stick.)

Re:60,000 licenses?

[Aram Fingal]

Central management is the key. Where I work, we would really like to switch from PGP to GPG but we can't because of the lack of ADK (Additional Decryption Key) functionality. This is a sort of master key which is held by the institution in case someone forgets their password or gets hit by a bus or some such thing. ADK is absolutely necessary because we have to ensure availability of data as well as confidentiality.

On the Mac side, FileVault is good because it has central management but it has the one drawback that you have to make sure that clueless users are restricted from saving sensitive data outside of their home folders since FileVault only protects the home folder.

Re:60,000 licenses?

[Minwee]

"So, in light of this embarassing breach, what have you done to ensure the security of Ohio residents' personal information?"

"Well, we spent three million dollars on the best encryption software that we could find. We haven't actually installed any of it, and it is causes some incompatibilities with our existing procedures so we probably never will take it out of the box, and if we do chances are that we will just do a half-assed installation which leaves most of the key features disabled, but gosh darn it we got a budget to address this issue and we sure spent it."

"Good job. I'm sure that the voters will sleep well tonight."

Yeah, doing a better job with free software that just works would have been nice, but it doesn't put high enough numbers on the spreadsheets. That's what happens when your job becomes more about covering your butt than getting things done.

Re:60,000 licenses?

[Anonymous Coward]

I believe that GPG can encrypt items for multiple recipients. As long as items are encrypted with the institution's public key, as well as any other required keys then the institution should always be able to decrypt the data.

Of course this would fail if someone omitted the institution's public key as a recipient when encrypting.

Since GPG is open source wouldn't your institution be able to modify GPG so that the institution's public key was always used when encrypting in addition to any other keys specified?

Re:60,000 licenses?

[couchslug]

Having a company to blame for failure is more important than doing a good job or being a steward of taxpayer money. Using OSS would never garner any positive feedback from people who matter, while using commercial solution is comforting to the tech-illiterate.

I can understand the incentives to use commercial software in that situation, and I'd cover my ass the same way. There is no ethical obligation to risk your own ass in the workplace for no personal benefit.

If my employer does not reward intelligent behavior, MY intelligent response will be to do what benefits me the most. Fuck 'em.

Re:60,000 licenses?

[jimicus]

I don't see why not. Stick a hypervisor with the software in unencrypted form on the first partition on the disk, stick everything else on another encrypted partition and boot the OS from the hypervisor.

It'll hammer performance, but most modern desktop PCs have more performance than they're ever going to need anyway.

Re:60,000 licenses?

[Breakfast Cereal]

the state of Ohio does not exactly have a stellar, top-talent IT program

That's a rather unfair and sweeping statement. Government agencies are relatively independent of each other, even within state government, and usually have their own IT programs because they have very different needs. Some of them are better than others.

Re:60,000 licenses?

[brunes69]

Not only this but the EULA that comes with basically all software makes service agreements a moot point.

When have you ever reported a bug in Office to have MS Say "oh yeah, our bad. We'll send you out a fix for that within the week". Yeah RIGHT.

At least if the product is open source you have the chance to hire any random contractor (or even one of the authors themselves) to fix the bug if it is important to you. No such chance with commercial software.

Re:60,000 licenses?

[Anonymous Coward]

Ya, 640K of memory ought to be enough for everyone, as it still is to this day!
Oh wait...

Re:60,000 licenses?

[nfsilkey]

Three words: enterprise key escrow.

Dont misread me. .edu and .gov _should_ leverage F/OSS as best as they can. But infosec folks are looking for a well-rounded solution that scales. Unfortunately, vendorware is the only thing that meets that need so it appears ...

Re:60,000 licenses?

[nfsilkey]

got escrow?

Re:60,000 licenses?

[Anonymous Coward]

Ohio valley is poor and should have had a university whip something up.

Re:60,000 licenses?

[Aram Fingal]

Since GPG is open source wouldn't your institution be able to modify GPG so that the institution's public key was always used when encrypting in addition to any other keys specified?

Last I heard, there is (or was) a project to add ADK functionality to GPG in a similar way to what PGP has but it's being hosted at another university. I'm not sure what the status of the project is but I should ask, now that you mention it. We are a large university and our governance is hardly monolithic. At the last meeting I attended on the topic, there were differing opinions and differing levels of understanding on what we really need, how much to trust end users and how much to try and enforce policy by technical means. The point is that there are political issues as well as technical ones. We have many needs for encryption technology, with confidentiality of files, emails, digital signatures, etc. If we hope to ever have a standard which can be used across the whole university, it will have to run on many different platforms and it will have to be free, as in beer, because of the fragmented funding structure we have. I think that all makes a strong case for an open source solution but there's too much resistance from IT management for us to officially take the lead on such a project (even if it's as simple as a modification to always include the institution's public key, as you suggest). That situation will probably change dramatically once a few top IT executives retire.

Re:60,000 licenses?

[Anonymous Coward]

No No NO NO NO.

I love TrueCrypt. I really do. But it is *NOT* a full disk encryption product. It relies on the USER to do the work. If I could rely on the USER to actually keep their data encrypted, we wouldn't be in this mess.

They got it wrong.

[Poromenos1]

Someone tell them they were supposed to encrypt the data before the breach!

Re:They got it wrong.

[Anonymous Coward]

Give them a break, they're americans afterall.

Re:They got it wrong.

[Anonymous Coward]

Yeah because you guys across the pond sure know how to manage data. Elitist euro-fags.

Re:They got it wrong.

[akita]

Maybe he's from the OTHER side of the pond, you might as well insult the asians too.

Calling all Buckeyes!

[pegr]

Help me close this barn door, would ya?

Re:Calling all Buckeyes!

[batquux]

OH

Re:Calling all Buckeyes!

[sethstorm]

IO

Re:Calling all Buckeyes!

[HiggsBison]

Oh, way to go.

Gotta love government jobs...

[Stanislav_J]

The state loses $3 million bucks, and the guy responsible gets the punishment of a whole week of lost vacation time? Wow....I want to find me a job where I can screw up so badly and get off so lightly. I mean....other than the Presidency.

Re:Gotta love government jobs...

[pixelpusher220]

Personally I'd let him keep his vacation time.... just rebook his flight to Guantanamo complete with drugs, bombs and lots of arabic writings in his suitcase....

Re:Gotta love government jobs...

[batquux]

But they only lost 130,000 bucks...

Re:Gotta love government jobs...

[Anonymous Coward]

In America, it's typical (even for high-tech workers) to only get 5 to 7 vacation days each year. So losing out on a week is actually pretty significant.

Re:Gotta love government jobs...

[Anonymous Coward]

Maybe it's different in different parts of America, or you're not of this country and speaking out of your arse, but...

Every place I've worked and everyone I know starts at 2 weeks of vacation per year. I've only seen small companies offer less and these are companies that don't have any on staff IT personnel so they are pretty small, less than 50 employees and usually less than $25 million in revenue per year.

At any medium sized and larger company it's 2 weeks for the first 5 years, 3 weeks for the 5-10 year stretch, 4 weeks for the 10-15 year stretch and 5 weeks after 15 years of service.

Re:Gotta love government jobs...

[dgatwood]

Raise your hand if you've ever accrued less than one day per month vacation time. Anybody? Seriously? Heck, most retail employees get at least one day a month.... If you're getting less than that in high-tech, you should seriously find a better job... one that doesn't involve pushing buttons on a highly specialized computing device and asking people if they would like fries with that.... Five days a year is just one tier above "burger flipper".

According to Wikipedia, "According to a report by the Families and Work Institute, the average vacation time that Americans took each year averaged 14.6 days."

Re:Gotta love government jobs...

[Anonymous Coward]

I mean....other than the Presidency. Yeah, like Clinton getting sucked off by a fat Jew girl in the Oval Office?

Re:Gotta love government jobs...

[syousef]

If it wasn't standard practice to encrypt the data, and if it was standard practice for this guy to be required to carry the tape in his car, I'd argue he was made a scapegoat even if it is just a week's vacation that he lost. Unless of course the guy is responsible for setting policy/procedure (but even then someone should be reviewing that and signing off).

Re:Gotta love government jobs...

[Mean Variance]

8.34 hrs per semi-monthly pay period == 25 days PTO per year. At my 9th anniv. (just hitting 8), it's 30 days. PTO = sick = vacation = personal days. We're a venture funded company in its 11th year - still waiting to go public.

I have my complaints about my job and where I work, but the PTO is a gem and I think has helped retain many of the software engineers when jobs in Silicon Valley are semi abundant.

In tech I think 15 days is a quite common starting point.

Re:Gotta love government jobs...

[Prof.Phreak]

Not only that, but his job is already practically vacation!

Re:Gotta love government jobs...

[Anonymous Coward]

How about CEO of a major corporation.

If you screw up they still fire you, but they pay you millions in severance pay!

Re:Gotta love government jobs...

[Anonymous Coward]

This has been the best account I've heard thus far: http://watchdog.ohio.gov/investigations/2007190.pdf your right problem lies far higher than an intern. the real problem was an overuse and failure to appropriately oversee third party contractors. the govonor at the time (theres a much better one now), wanted to use the project as a demonstration that outsourcing state jobs is a good idea. if it had been done under the auspices of the office of information technology, it likely would not have occured.

Re:Gotta love government jobs...

[Minwee]

"If anything can go wrong, it will." - Murphy

Finagle, actually. Murphy's Law has a subtly different meaning.

Interestingly enough, referring to Finagle's Law as Murphy's is itself an example of Murphy's Law in action.

Re:Gotta love government jobs...

[The Man]

In America, it's typical (even for high-tech workers) to only get 5 to 7 vacation days each year. So losing out on a week is actually pretty significant.

I guess you must be talking about somewhere in Central or South America. In the United States most legal employees receive 2 weeks of vacation or more. At my large private tech employer, 11 days a year is the minimum for ALL new employees; it rises with seniority and does not depend on your classification or title. California state employees get more, as do most unionised workers. It's not Europe, but 5 days would be pretty stingy for any job that doesn't involve asking about fries with that.

Anyway, the value of 5 days of vacation is probably less than $1000 after taxes (a US worker who takes home $52000 a year has a gross salary of over $75000). I don't consider that much of a penalty for a $3m mistake. At minimum, if he were really to blame for it, he should have been fired and a bit set in his personnel file precluding any state agency from hiring him ever again. A civil lawsuit wouldn't be unreasonable, either. All this, as I said, assumes he was actually responsible for the error. I'm not sold on that.

Re:Gotta love government jobs...

[Anonymous Coward]

I'm not defending what happened or the people who made it happen, or anyone who can't do a job, but let's see--as a lazy, inefficient, inept (have I covered enough stereotypes?) government IT worker, if I do something that SAVES $3 million, I get--NOTHING! Zero, nada, nothing above my regular pay. Probably not even a higher raise next year. Sure, some places allow for bonuses, but every time anyone dares give one out, it makes the news, usually with a "government waste" headline plastered all over it.

For those who can't get your brains around it, who just can't understand why government pay (lower than average) and benefits (allegedly higher than average, but not really, though there is usually good variety) are the way they are, it's because the system is designed so that people are not supposed to have a personal financial stake in the outcome of their work. That may seem odd, and it's kind of frustrating, but there's a method to the madness. You eliminate the rewards, and you have to eliminate (some of) the risk, or else nobody would do this work except the truly incapable. Think what you want, but I've met far more useless, brainless, vapid, self-serving airheads in the private sector than I ever have in government. I've also met some extremely talented, creative people of the type you won't usually find in government. Government work is designed to smooth out those extremes. It's what attracts some personalities, while others like yours truly kind of put up with it.

The problem is that it's not very self-correcting, it requires supervision, controls, documentation, etc. and when it breaks down, it gets very ugly. Mostly that happens with actual politicians and people close to them, but it always seems to be the regular workers who get the bad press, the extra rules, and not very well thought out postings like the one I'm replying to. This is what you get with a public that always demands there be someone to blame, and that somebody DO SOMETHING about anything that might possibly happen, even if that something costs more money and makes things worse. How much useless crap, along with legitimate data, is about to be encrypted in Ohio because of this?

Government work is different. Not better, not worse, just different than the private sector.

Here's a thought, though: rather than complain about what other people have, why don't you try to get it for yourselves? That might require (gasp!) working for change in the workplace, etc., rather than being the big bad rugged individualist, but the alternative is to watch your jobs go overseas and your lifestyles go down the toilet. Just a concept...

Re:Gotta love government jobs...

[mpe]

the real problem was an overuse and failure to appropriately oversee third party contractors.

Which is the kind of thing buying lots of encryption software (especially proprietary) is unlikely to help with much.

Re:Gotta love government jobs...

[Anonymous Coward]

For fucks sake, how can you live like that working yourselves to death? At my current company, I started at 6 weeks. When I become 30 I can expect to get 7, where I'll then remain. And I didn't take a pay-cut or anything, they just realized that happy employee = productive employee.

Re:Gotta love government jobs...

[Anonymous Coward]

a whole week sometime in the future (like 30 years) - fixed at the equivalent of today's pay rate

There is no accountability (I mean personal fines and prison sentences) in functional government.

Re:Gotta love government jobs...

[beached310]

The fired the intern

$3 million?

[warrior_s]

Okay, I am having difficulty in understanding $3 million figure... So they bought 60,000 licenses. If we consider the complete $3 million towards licenses, it will be $500 per license, which I think is way too much. However I could not find the cost of the encryption software anywhere on the web (anyone with links????)

anyone care to explain approximately from where $3 million figure came?

Re:$3 million?

[Ohio Calvinist]

Probably the cost of the investigation in lost hours, the price of notifying all those whom where among the 130,000 and all that comes with it (lawsuits, credit checking, the cost of the corrective actions...) I went to a university of 11,000 at first that paid for 90 days of credit monitoring for all effected students after someone hacked into the student information system that stored SSNs. I'm sure the state had to deal with some more heat than a small university.

Re:$3 million?

[Anonymous Coward]

It's estimated that the missing backup tape will cost Ohio $3 million.

No price given for software

Re:$3 million?

[MSDos-486]

Thats not just the cost of new license. It is the cost of the fiasco as a whole. Including paying everyone the overtime to fix the glitch.

Re:$3 million?

[asills]

Last I checked $3,000,000 divided by 60,000 equals $50, not $500.

Math issues aside, if you RTFA (and follow TF link to the original article) you'll see the breakdown:

"The incident is expected to cost the state almost $3 million. Of that total, $2.3 million covers projected and existing enrollment in Debix Inc. credit protection services. Debix enrollment paid for by the state for affected individuals will remain open until Oct. 31. Debix protection will not be extended toward any businesses with information on the lost backup tape."

I highly doubt those licenses are figured into the $3 million estimate.

Re:$3 million?

[Penguinshit]

$500 for a site-license, $2.5M for "educational services" and "support"...

Re:$3 million?

[Anonymous Coward]

The license costs should not be considered a cost *of* the breach -- it's a cost of doing business that they just deferred until they had egg on their faces. The three million (I hope) refers instead to direct costs of the data loss, such as credit reports for victims, PR to cover up the mess and investigation of the circumstances. Again, I *hope* that's all they consider costs stemming from the breach...

This just in....

[Anonymous Coward]

...that same government official's boss has allotted him another week of vacation for not losing the REST of the data that all of Ohio stored.

Losing a week of vacation for a data breach that large is ridiculous; like a slap on the wrists. I bet he's going to get paid overtime for working that extra week.

What ya want to bet...

[lax-goalie]

...that the next time they get a backup tape stolen, it'll have a post-it note stuck to the tape with the password on it?

Re:What ya want to bet...

[thewiz]

That the password to the tape is "password"?

Re:What ya want to bet...

[GregNorc]

Maybe not that bad, but it will probably be a dictionary word, thus making said encryption useless when some script kiddie cracks it in 5 minutes.

A week's vacation?

[Jester998]

the state docked a government official about a week of future vacation time for not ensuring that the data would be protected

I work as a DBA in a nonprofit healthcare organization. If our backup guys lost a tape, and I hadn't bothered to check off the box in our database backup software that says "Encrypt: 256-bit AES", I would lose my job.

This guy got dinged a whopping 1 week of vacation time. That's not even '1 week suspended without pay'. It's the equivalent of having to stay in detention after school.

I need to move over to the public sector or something.

Re:A week's vacation?

[GodfatherofSoul]

Oh please. We've seen mistakes FAR bigger than this in the private sector with less or no consequences. And, if every software outfit canned its employees after a single mistake of whatever scale, there'd be a heck of a lot more turnover in IT.

Re:A week's vacation?

[bladesjester]

And, if every software outfit canned its employees after a single mistake of whatever scale, there'd be a heck of a lot more turnover in IT.

They frequently do. It's just that it usually isn't the person that's actually responsible because they found a scapegoat.

Re:A week's vacation?

[Anonymous Coward]

Jester998, go back to the original /. thread if you're actually curious about this. Putting a few posts together made the much more reasonable explanation that this was a minor cover-up. Looks like a long-time employee trapped in Dilbertland was make to take the public fall to cover-up ongoing management incompetance. If he didn't, they'd probably have make it rough for him to reach his approaching retirement. Instead he gets an insignificant financial ding & a reprimand that doesn't matter because he dosn't intend to seek another job in future, or much more promotion within Ohio's public sector.

Re:A week's vacation?

[syousef]

I work as a DBA in a nonprofit healthcare organization. If our backup guys lost a tape, and I hadn't bothered to check off the box in our database backup software that says "Encrypt: 256-bit AES", I would lose my job.

What you need to ask is what was the procedure and was the guy following it?

If it's standard procedure for this guy to carry unencrypted data around in his car, it's the guy setting policy/procedure that should be made responsible.

If it is standard procedure for you to encrypt your data, and you fail to follow that procedure you should be disciplined. Better still would be to find a way to make that little check box for encryption on by default. Even better would be to find a way to restrict export without encryption unless it's authorized by a second person. It shouldn't be easy for you to make a mistake that could cause you or your company massive damage.

Re:A week's vacation?

[Jester998]

Very good points, actually. At my place of employment, we're a fairly small IT department -- I'm the sole DBA, so by default any policy relating to database operation/security/etc originate with me anyways (although formal policies get approved by the department's director). So, at least in my case, whether it's from lack of policy or breach of policy, it's all on my head anyways. :p

In larger shops, I definitely agree with you. There should be both policies *and* technology in place to prevent violations that could result in damage.

Re:A week's vacation?

[DNS-and-BIND]

Well, it's a government job - there are racial issues that crop up. Those can influence how severely employees are punished, or indeed if they are to be punished at all.

Re:A week's vacation?

[JD-1027]

You would work for an employer that would fire you because you might have forgotten to check a box?
Must be a stressful place to work.

Re:A week's vacation?

[owlstead]

"If it's standard procedure for this guy to carry unencrypted data around in his car, it's the guy setting policy/procedure that should be made responsible."

Yes, although I would also argue that if your job is keeping the data safe, you'll have some responsibility to notify bad procedures to the one creating them. Of course if the organization makes this impossible or ignores your notification, then they are screwed. In that case, make sure you're not the one that's going to receive the blame if shit hits the fan. Hey, maybe the guy did already report this and was made the scape goat. Who knows.

Re:A week's vacation?

[Jester998]

Not at all. It's a very relaxed work atmosphere. To be honest, I don't know if I'd actually be fired if something like that happened... but I would certainly be offering to tender my resignation.

Our company deals with electronic health records for hundreds of thousands of people. The same systems also store information about our contracts with e.g. government entities. Not even counting regulatory requirements like PIPEDA (Canada's Personal Information Protection and Electronic Documents Act), I can't fathom placing that data in any kind of jeopardy, simply from a professional standpoint. If information ever got stolen somehow, and I could have easily prevented it, what do I say? "Hmm. Well, sucks to be those people.", and carry on working?

The LOPSA/USENIX/SAGE System Administrator's Code of Ethics states:
"I will do my best to make decisions consistent with the safety, privacy and well-being of my community and the public, and to disclose promptly factors that might pose unexamined risks or dangers."
"I will maintain and protect the confidentiality of any information to which I may have access, ..."

If we want systems engineering to be viewed as a true profession, in line with engineers, accountants or lawyers, we need to strive for higher standards than "Well, shit happens. Sorry."

The value of personal data

[Anonymous Coward]

"In September the state docked a state government official about a week of future vacation time for not ensuring that the data would be protected."

So now we know how much Ohio state officials value the personal privacy of its citizens.
40hrs/130,000 - about 1.1 seconds of a government official's vacation time.

Makes me wonder why people stay in a state that values the personal privacy of its citizens so little.

Encrypted IDE connector?

[Midnight Thunder]

Instead of using software, I wonder whether an IDE or SATA connector could be developed that encrypts and decrypts the data going to and from the drive. Basically your organisation would enter a key into the connector and the encryption would happen without the OS knowing. If you remove the drive then you wouldn't be able to use the drive without the connector.

Re:Encrypted IDE connector?

[tehniobium]

Wouldn't that slow down the drive quite a bit?

Especially for the solid state drives which apparently are the future?
Don't give Micro$oft a reason to encrypt data one more place in our computers :-(

Re:Encrypted IDE connector?

[LiquidCoooled]

Thats a good idea, but what if someone gets hold of a whole box?
How about if the hardware did the encryption, but was also linked to a localised physically protected network resource for its key data?

Re:Encrypted IDE connector?

[Anonymous Coward]

Yes. There have been SCSI enclosures designed to do just that available for years. You can slap a standard tape drive in them, type a key in to the little display panel on the front, and boom -- encrypted tapes. They're not even terribly susceptible to theft of the entire hardware set, because the key (or at least part of it) is not hard-coded; it's stored in RAM and destroyed when the device is unplugged.

There are also in-line devices available if you want to connect to something you can't easily re-case. For example:
http://www.avax.com/paranoia2.html

Re:Encrypted IDE connector?

[Anonymous Coward]

Yes. There have been SCSI enclosures designed to do just that available for years. You can slap a standard tape drive in them, type a key in to the little display panel on the front, and boom -- encrypted tapes. They're not even terribly susceptible to theft of the entire hardware set, because the key (or at least part of it) is not hard-coded; it's stored in RAM and destroyed when the device is unplugged. What is this device you're talking about? For a tape library, that's just insane.
Any system like that (any backup system) needs a real key management system.

What is my data doing outside anyway?

[Anonymous Coward]

Whether it's encrypted or not, why is sensitive data on employee laptops or in intern's cars?

How do you log and audit access to data to prevent abuses if you just hand out copies of databases?

/Yuo fail it

[Anonymous Coward]

guests. Some people A BSD over other of reality. Keep fellow travellers? Parts of you are

WTF

[zappepcs]

I saw four horrifying words...

Intern, backup tape, car

encryption is probably low on the list of security concerns here... just WOW

I absolutely know that I don't want to hear the story of how those four words got used in the same sentence until happy hour is nearly over.

Those 4 words should never be needed in the same sentence. Process is just as important as encryption. That should have been 'backup tape', security company, armored transport, iron mountain in the sentence... oh wait, then there would be no story.

Re:WTF

[fireboy1919]

I absolutely know that I don't want to hear the story of how those four words got used in the same sentence until happy hour is nearly over.

Yeah? Well, I wouldn't mind. Not the sentence they added.

Perhaps this one:

"After I checked the backup tapes to ensure that 512-bit AES encryption was working, and that the tapes were still readable, I closed and deadbolted the tape room, and then went out to my car to go to lunch with the new (darn good looking) intern from the art department."

Re:WTF

[Anonymous Coward]

I saw four horrifying words...Those 4 words should never be needed in the same sentence.

As I walked hand in hand with the hot new Swedish intern to my car on our way to grab some dinner and drinks, I remembered I forgot to put tonight's backup tape in the TapeMaster 2000. I thought to myself "fuck it, I'll blame it on a tape drive malfunction" and chuckled that low, soft chuckle only a BOFH can appreciate.

Re:WTF

[Mix Master Nixon]

I saw four horrifying words... Intern, backup tape, car

You forgot the word "Ohio". At least the word "election" wasn't around as well. We all know how that story ends.

How Long Before...

[Anonymous Coward]

...we see a story about 130,000 residence records locked and unavailable due to lost encryption passwords?

OpenBSD is the answer.

[Anonymous Coward]

They just paid millions of dollars for something that systems like OpenBSD, Linux, and FreeBSD offer for free. OpenBSD's filesystem encryption is particularly good. And when you combine it with their meticulous code reviews and near-100% insistence on using as many security good practices as possible, there's really no reason to not use OpenBSD if security is one of your main concerns.

Re:OpenBSD is the answer.

[duffbeer703]

Oh please STFU. Like you're going to run OpenBSD on laptops. Get real.

Re:OpenBSD is the answer.

[QuickFox]

Why not?

Re:OpenBSD is the answer.

[FoolsGold]

Because we live in a Windows world, that's why. Interoperability with existing software is more realistic than some zealot's idea of switching operating systems just for a little extra security.

Re:OpenBSD is the answer.

[pat mcguire]

The problem is that the government workers don't have the proper technical expertise. Security is only as strong as the weakest link, and even with Windows on the laptops the operating system is usually not the issue, the stupidity of people are. All OpenBSD would do is add another layer of security that the user would disable in order to save five seconds and the trouble of remembering a password. Secondly, OpenBSD's security is mostly directed at remote attacks, as the developers realize that there's no way to secure a computer in the hands of somebody else.

Re:OpenBSD is the answer.

[Anonymous Coward]

Well, there's what the troll said, and then there's hardware support suckage. (Though I'll be the first to admit that I haven't run OpenBSD in years, it was just so far behind Linux when I started playing with it, I couldn't deal. I don't know if they've caught up.)

Posting AC because, apparently, the OpenBSD guys have mod points at the moment... ;-)

Re:OpenBSD is the answer.

[sp0rk173]

Hah. Actually, I do! And it works perfectly well. Suspend works, WiFi works, it gives me everything *I* need. Of course, that's a lot less than most people, but i like being a minimalist.

Re:OpenBSD is the answer.

[sp0rk173]

Hardware support is actually quite good for good laptops, it works great on my thinkpad X31, which I use as my traveling laptop to stay connected to things. Basically just need web and IM, which it'll do perfectly. Use something low-range like ION for the window manager and it becomes a nice little information hub with very very little bloat. Add the filesystem level encryption and you've got something that won't hand your identity to anyone who steals it, to boot.

Of course, if you want to play games, you're pretty much fucked. But you can watch movies full screen with no problem, and sound works perfectly without any tweaking. All of the laptop buttons work as expected, suspend works, wifi works. So, you know, you shouldn't assume quite so much.

Re:OpenBSD is the answer.

[Breakfast Cereal]

The problem is that the government workers don't have the proper technical expertise.

"Government" workers are no different than any other corporate office workers, but you are correct in that most people do not have an adequate understanding of computer security. The key difference is that public oversight and government transparency allow these incidents to become known to the public. When someone who works at your bank does the same thing, it's just kept quiet.

Re:OpenBSD is the answer.

[XHIIHIIHX]

Why not? The IRS still runs windows 3.1 on theirs.

Brings me back to the question....

[ducomputergeek]

WTF is this stuff doing on laptops in the first place?

It seems logical to me that this kind of information should be on a centralized servers at a state office with managed firewalls and all the rest with only hardwired terminals allowed access with maybe a VPN set up for remote access if absolutely needed out in the field. I know wireless isn't 100% secure and no system is but that just makes logical sense to me.

Re:Brings me back to the question....

[Anonymous Coward]

Except it was a backup tape stolen, not laptop.

Re:Brings me back to the question....

[Anonymous Coward]

"that just makes logical sense to me"

And this is why you fail.

Re:Brings me back to the question....

[afidel]

Yeah a county agency (in Ohio) I had as a client was one of the most paranoid I've ever dealt with. The dealt with personally identifiable information of a very sensitive nature and they did things right. Everything was static IP with all LAN information captured to a secure auditing station with IP, MAC and port info recorded. The website their clients (service providers) connected to was behind a good firewall that had rules allowing only a single registered IP to connect from each provider and then used SSL with each agency having a password protected x.509 cert that allowed them access to only their own folder. The data from the website was moved daily via airgap to the LAN, so if somehow the server was compromised only one days uploads would be exposed. It was kind of a pain supporting them because all work had to be done onsite, but I definitely appreciated their thorough approach to security.

Re:Brings me back to the question....

[davidsyes]

O-Hai-Yo Arrrht... Etch-Uhhh-Sketch...

Maybe they think laptops are high-tech Etch-A-Sketches and cannot be networked?

I guess in the end, the department head will be "shaken", but not "stirred", happy hour or not.

Obligatory...

[cerskine]

... nevermind.

A panic reaction

[tuomoks]

Great, now they have a tool to encrypt! Let's hope they thought about key management before implementing it. It's great for vendors that some have no idea of security - more sales. Next we will read all the keys stolen by an employee (usually high in hierarchy, just my experience) and have to start all over again. Or am I too pessimistic / skeptical when it comes to security?

And?

[Colin Smith]

Your problem is? They have been seen to have done something.

Re:And?

[barzok]

Sure, they did "something."

But they didn't address the problem that actually led to the breach. They're encrypting laptops, but it was backup tapes which were compromised. No mention of those getting encrypted.

Re:And?

[Colin Smith]

But they didn't address the problem that actually led to the breach. They're encrypting laptops, but it was backup tapes which were compromised. No mention of those getting encrypted. Yes? And? Your point is?

The plebs who vote for them don't know the difference and they've been seen to spend 3 million dollars to fix the problem. The problem has therefore been solved, they'll get re-elected...

They led the horse to water...

[Darth Muffin]

... but can't make it drink. Encryption is only a partial solution. You still need to keep your backup tapes secure (they won't be encrypted by this software, but most higher end backup software will), and you need to keep people from copying files to USB sticks or burning to CD.

What are these backup tapes, Kemo Sabe?

[igb]

You'll also be aware of the various rows here in England as the government displays its new networking technology: CDs and a courier. Most of us with medium-sized data farms (I herd about 50TB) are getting out of removable media as fast as we can. I've got 20TB of disk at the far end end of 30 miles of GigE, which with compression (all hail ZFS!) provides me enough space to keep copies of all the critical data, plus a few weeks of daily snapshots. My RPO is ``that day's work'' and my RTO is essentially zero: I can serve the data up over NFS from the replicas as easily as from the live systems. Obviously, some of it's better than ``that day'': the Oracle archive logs go straight over, and the Cyrus mail server will replicate live as soon as I can find the time to get it working. But we're only using tape now for monthly audit copies, and those can therefore safely stay in the machine room: the data replicates offsite, and then comes back into the tape silo monthly. A machine room fire costs us the audit copies: if I feel keen I'll start cloning those and sending them offsite. If I can scare up the budget and offsite space for a MAID then I can get out of tape entirely.

Re:What are these backup tapes, Kemo Sabe?

[SendBot]

Wow, I wrangle a good bit of data for my personal use, but you're obviously in a league well above mine.

So how does MAID compare to RAID?

Re:What are these backup tapes, Kemo Sabe?

[igb]

MAID == Massive Array of Idle Disks. It's a class of products which are essentially cheap, high-density SATA arrays with an emphasis on spin-down when disks aren't in use. The idea is that you get as much capacity as a jukebox full of LTO-3, with a similar standby current, plus you don't have the problem that tape has to be running at the right speed. In my experience, incremental backups always have to go via disk staging anyway, because scanning for changed files takes the transfer rate into the tape drive below the critical level at which the tape can no longer keeps itself busy with the tape moving continuously.

Alongside MAID there are on- and off- line de-duplication products, which look for shared blocks of data and replace them with pointers. In principle one could back up baseline twice and reduce that, offline, to a baseline and a block-wise incremental. Absent that, I'm having success taking snapshots and then using rsync-type ``changes only'' transfers: that means you can transfer a large file, make a small change, and then only have the subsequent transfer consume the change's worth of disk.

ian

Re:What are these backup tapes, Kemo Sabe?

[myxiplx]

Oooh, someone using ZFS in production. We're looking into it at the moment, mind dropping me a line with how you're finding it? My slashdot username @hotmail.com will reach me.

I Call Bullshit

[pseudorand]

Encryption is crap unless it's used by those trained to understand how it works and what it's limitations are, which I'm sure 60,000 employees will not be. What happens when an employee copies data to a USB disk or e-mails it to someone. If the software prevents this, it will be a major pain in the arse that will cost a lot more than $3 million in lost productivity. If it doesn't, then data will get stolen and everyone will say "no problem, it was encrypted", until massive identity theft cases force them to admit that not all copies were encrypted, but, because the guy in charge spent $3 Million, he'll argue that he did everything reasonable and no one will be held accountable. The real solution is to LIMIT ACCESS TO SENSITIVE DATA TO TRAINED EMPLOYEES WHO ACTUALLY NEED IT TO DO THEIR JOB. I can't imagine that there's 60,000 employees who actually need the personal information of 130,000 Ohio residents. I'm not saying it's obvious who needs what data, but $3 million would buy a lot of manpower to figure it out.

And what happened to Encrypted File System. You know, built-in to NTFS, complete with administrative recovery keys, doesn't cost $3 million? This sounds like just more government waste and McAfee marketing to me.

Re:I Call Bullshit

[Starteck81]

Have you ever tired to teach a lot of non-technical people to follow security procedures? I work for a CPA firm that takes security pretty seriously. All of our hard drives encrypted. We have a secure webportal to transfer files instead of sending them via e-mail. We have encrypted usb thumb drives.

We have tried to train our employee's to use these tools so as to be secure but I still catch people sending things via e-mail and using unencrypted USB drives that they bought. It's not a huge percentage of people but it still happens and all it takes is one person not following the rules.

The point I'm trying to drive home is that at best you can only hope to mitigate your exposure to data theft. Encrypting your disks is a step in the right direction. As for your assertions that they use unencrypted USB drives and unencrypted e-mail well please sight a source that tells us for sure that they are unencrypted. Otherwise you're just making assumptions and we all know what happens when you do that...

Re:I Call Bullshit

[pseudorand]

Yes, to assume is to make ASs out of U and ME. But my point isn't in contradiction to yours. I AGREE it's difficult train non-technical employees and I'm sure they're not going to train 60,000 of them. They should LIMIT who accesses sensitive data and take extra effort to train those few employees to use encrypted disks, e-mail, network connections, and USB drives. Like you said, all the effort and software in the world isn't going to prevent 100% of employees from using unencrypted forms of data storage and transfer. %0.001 of 60,000 people still rounds to 1. %0.001 of 1000 people rounds to 0. The point is that it doesn't mater if the software also provides encrypted USB disk and e-mail, employees will find a way around it if it makes it easier to do their job, so the better solution is to limit access to a smaller number of employees who can be trusted to use the tools.

SafeBoot? The poor bastards.

[jrronimo]

Part of my job involves working on laptops owned by an agency that uses SafeBoot to encrypt data on laptops. Gather children, let me tell you of SafeBoot...

1. SafeBoot is whole-disk encryption, but Windows-partitions-only. If you dual-boot or use Linux, there is no solution for you except "Please don't lose your laptop".
2. SafeBoot requires a login before you can boot Windows. If you get your password wrong, you must wait a certain amount of time before you can re-enter your passwords. At first, it's not that bad -- a few seconds. But each successive failure increases the time... eventually, you're waiting minutes.
3. SafeBoot encrypts the drive so that you can't access the drive from another machine -- which is what it's designed for, of course. Try being an IT guy in this scenario: You can't perform ANY troubleshooting that doesn't involve booting Windows. If Windows fails to boot, you have to have your hard-drive decrypted (which, for us happens off-site and is a MAJOR pain in the ass). I cannot boot off a Windows CD to use the recovery console to replace damaged registry files. I cannot do a 'repair' install. I could wipe the drive and re-install Windows...
4. The password policy in place requires users to change their password periodically and be of a certain complexity level. Most users have their SafeBoot password written on a piece of paper and taped to their machine, now...

There's a line between security and usability. When SafeBoot works, it appears great -- it doesn't impact system performance *that* much and it encrypts the contents of the entire drive, woo. But when something goes wrong, it becomes a big pain.

To be honest, though, I think the bigger problems for the work *I* run into with SafeBoot is the policies in place, rather than SafeBoot itself.

Re:SafeBoot? The poor bastards.

[dimeglio]

4. The password policy in place requires users to change their password periodically and be of a certain complexity level. Most users have their SafeBoot password written on a piece of paper and taped to their machine, now... This is why my co-workers and I always stick a label below the latop and write my latest password on it.

Re:SafeBoot? The poor bastards.

[bockelboy]

Interesting.

In the Unix world, you could just encrypt the $HOME directory of all the users and simply not give them the rights to write outside of that directory. Make sure you don't deploy applications which both keep sensitive data and run as root ... and success!

Unless Ohio is doing something top-secret with the OS their users are running, I guess I only see the need for encrypting the entire drive when there aren't sufficient security policies in the first place.

Then again, I can do plenty of development on Linux without root permissions. Being that most Windows software can't be installed without root permission... well, let's just say I believe I'm lucky to work in a Linux / Mac shop.

Re:SafeBoot? The poor bastards.

[westcoast philly]

I also work for a company that supports provincial government systems. (in Canada, obviously) They all use Windows XP, all their files are stored on network drives, and use the offline files function. a fairly decent setup unless you happen to know anything about computers. the windows 'encrypted' offline file cache is a joke.. a bootable CD will break the local admin account in under a minute, giving you full access to the contents of the drive.

To get around this, some (more sensitive inistries) use whole-disk encryption software called SafeGuard Easy. A real pain for me when I have to do any work on these systems--always results in a reimage of the harddrive, and 2 or 3 subsequent visits to complete the install of the encryption s/w. The encryption software is fairly good I must admit, but I haven't spent any time trying to break it, and probably would be lost trying.

This would work well, if not for the fact that EVERY laptop I see with this software has the password taped to it. I explain this to them all the time, but they simply say something to the effect of "it's a shared laptop" or "I can't keep track of too many passwords."

The weakest link in any security system is the users. And then it falls to me to make sure *I* don't lose their data when working on their computer. It really pisses me off, actually.

The thing I don't get it this: The ATA spec has a password/security function built in.. why isn't THIS used more often?

Re:SafeBoot? The poor bastards.

[Locklin]

you forgot /tmp and the swap partition. You might want /var as well if there is sensitive data in the logs. Realistically, you probably need to prevent mounting of disks or USB drives as R/W. Than again, theres probably a few other vulnerable spots on a Unix computer.

Unix great, but it's not as simple as you put to secure it from threats that have physical access to the machine.

Re:SafeBoot? The poor bastards.

[Anonymous Coward]

Re:SafeBoot? The poor bastards.

1. They ONLY run windows, so none of this terrorist LINUX stuff to worry about. 2. Windows requires a login, I would HOPE any govermental machine requires a password, granted people being able to remember them without sticky notes is a whole OTHER problem. 3. I would hope that the disk CANNOT be easily accessed from another computer either... we are talking sensitive data right, and we all know in year past simply having a password on YOUR machine didn't mean squat if you plugged that HD into another machine. Will people screw up and forget? WELL DUH YEAH! Screw up more than once, said person shouldn't be allowed to use a computer with sensitive data on it. If you screw up with a firearm and shoot yourself or god heavens someone else without cause... you shouldn't be allowed to be a law enforcement person. 4. Shouldn't we be changing our passwords regularly, if I wasn't working at said place and I knew my buddy who still works there has a password thats the name of his goldfish months or years after the fact... thats a little insecure. Yes people use sticky notes, because convenience trounces any sort of idea of security for most people...

IS Safeboot the best option HELL NO, whole disk encryption is useful to a point, one password you get access to EVERYTHING, add in file encryption along with that, different passwords for different files and MAYBE things get a little more secure. Maybe,

Re:SafeBoot? The poor bastards.

[bockelboy]

Yeah, I assumed there were a couple of directories I was overlooking.

Point is that you ought to be able to easily separate "these are the directories users can touch" from the "these are the directories which users can't touch". In fact, RedHat did some work on this (look up Stateless Linux). I suspect you can come up with a list of N directories (where N 10 or so) which must be encrypted, and let the OS portions be un-encrypted.

Set up a rat's nest of soft-links to an encrypted partition, make sure the images deploy properly and your backups don't suck, and you're done! Experience level required: medium. Cost required: $0.

Of course, I shudder at the thought of trying to deploy Linux in an enterprise!

Like many things in life, it's a tradeoff. This is why I like *not* working with personal data - speculations about security can be done from the armchair. While we do need to secure our systems, the possible loss is minimal - just the time of the stupid admin (me) who made things insecure in the first place and has to start from scratch.

Ah, universities. Possibly the best jobs ever, unless you like money.

Re:SafeBoot? The poor bastards.

[Doppler00]

2. Waiting to retype a password doesn't increase security at all. If you're password isn't strong enough and can be guessed by high speed brute force, it's useless to begin with and no amount of "waiting" before an attacker retypes it will help (which they wouldn't, they'd use an automated program on a secondary machine).

4. I don't understand periodically changing your password. Does someone have your current password and they won't use it now, but they may try after 6 months, so you better change it every so often just in case? Is someone trying to crack your weak encryption and they'll be done in 6 months 1 day so better change it just in case?

2 and 4 are primary reasons why users write passwords down. STOP USING THESE POLICIES and maybe people won't have to write passwords down (humans have limited memory, don't make things harder on them).

Re:SafeBoot? The poor bastards.

[mpe]

The password policy in place requires users to change their password periodically and be of a certain complexity level. Most users have their SafeBoot password written on a piece of paper and taped to their machine, now...

Which is effectivly no password at all...

There's a line between security and usability.

It isn't anything like that simple. There are plenty of things which make little difference to security (or even reduce it) which also reduce usability. There are also things which can increase both security and usability.

Re:SafeBoot? The poor bastards.

[Anonymous Coward]

We use safeboot at work and it as been a tremendous resource hog. I have a decent 3ghz single core Pentium and 1.5g of ram. I noticed significant increases in boot and shutdown times (10 minutes to boot, no joke). It also lets you disable hibernate, which my company did for some reason, so that option doesn't exist. I use truecrypt at home.

Re:SafeBoot? The poor bastards.

[Loraque]

Other issues with Safeboot-

It is a little worse than the parent describes actually.

If Windows fails to load, decrypting is rarely the solution. The reason Windows typically fails to load, is because the hard drive is failing with bad blocks all over the place. Guess what happens when you try to decrypt such a drive? Of course it dies completely before you ever get the chance to slave it for the data. Thank goodness On-Track has a deal with Safeboot that they can unencrylt drives as well as recover failed drives. $3,000 not included.

Then imagine if you will, the Safeboot console. Think 486SX33 without the Turbo button pushed. Seriously, the server is SO slow to work with, it takes literally MINUTES to locate a machine via a search in a large environment. Push the damn turbo button already.

Now picture the offshored IT people, crated into the country by the bushel, doing the jobs that no American is qualified for (for the price). Imagine the server DB needing to be restored to a previous state (during rollout still) that causes the entire leadership team to suddenly not be able to login to their laptops while on a working weekend to Vale. The server DB seems to go corrupt a lot, which always causes a percentage of problems depending on the length of the rollback. Any machines that updated during that time, get hosed inside of 30 days.

The support structure is simply too stupid to handle software like this correctly.

Safeboot, it makes your data so safe, even YOU cannot access it.

The $3 million

[SamMichaels]

The way it's worded seems a little ambiguous to me. Did the theft alone cost the state $3 million or did the theft cause the state to spend $3 on licensing a product from mcafee? Both sound like reasonable figures when dealing with the public sector and taxpayer money.

Isn't going to help

[belthize]

If they have 60,000 computers with 'sensitive' data on it then they're borked already.

      If they want to encrypt people's laptops/desktops then fine ... if they want to prevent
personal civilian data from leaking out they're off by a few orders of magnitude on the
extent of their distributed storage.

Belthize

Government

[rice_burners_suck]

Why don't they just use GPG? It won't cost them three million dollars, and it'll be just as good. It's not going to cost Ohio's government three million dollars. It's going to cost the people who live in Ohio three million dollars in tax dollars. Every time someone says, "Let the government pay for that," they really mean, make us all pay for that, because where does the government get its money? From your hard work! And every time someone says, "Let corporations pay for that," they really mean, make us all pay for that, because where do corporations get their money? That's right! It comes out of your pocket whenever you buy any product or service. Somewhere along the line, it was mined, grown, processed, moved, removed, produced, packaged, housed, assembled, displayed, sold, etc., by a corporation. And when that corporation's expenses go up, it becomes included in the price structure of the product or service you buy.

Re:Government

[Shados]

Hmm, while im sure the softwares cost a lot, the summary at least (I didn't read the article, bleh =P ) states that the missing tape is going to cause 3 million $ in loss. I'm guessing a lot of that money is from the damage the loss has caused and stuff... I'd be surprised if the software was even close to half of that.

It doesn't make your argument any less valid, mind you, but...

Re:Government

[faloi]

Likely because they're faced with a couple of choices... Try to get their overburdened support staff up to a point where they're knowledgeable enough about GPG to get it installed, tested, out to the users and get them trained on it. They can hire a consulting company to come in and do all that for them. Or they can go to a vendor who likely sold them all the time and effort to get that going as part of the seat licenses. And all that assumes GPG can do full disk encryption on boot that integrates into a (likely) Windows Active Directory tree.

Re:Government

[BroadwayBlue]

It's not about a particular tool being the solution. Nothing ever is. It's about culture and education.

Re:Government

[phantomcircuit]

And every time someone says, "Let corporations pay for that," they really mean, make us all pay for that, because where do corporations get their money? That's right! It comes out of your pocket Lets follow your logic here.

1. Expenses increase
2. Corporation has less money
3. Corporation increases prices
4. Consumers pay more

Seems like airtight logic right?

But what is the corporation is already making so much money that the loss doesn't actually produce need to increase prices?

Your logic will only really follow when CEO's stop being paid billions of dollars.

Re:Government

[triffid_98]

Since when do corporations fail to increase prices when they can get away with it? After all, they need to get those November sales figures up. I'll give a simple example. Gas prices rise when the price of oil rises. Think about this. The corporation that is raising prices now still has millions of gallons of oil they obtained on the cheap, which they will happily sell you for a huge markup. Think about the opposite scenario. Oil prices fall. Said corporation will lower prices if and only if their quasi-legal cartel approves it, at some agreed upon time in the future.

But what is the corporation is already making so much money that the loss doesn't actually produce need to increase prices? Your logic will only really follow when CEO's stop being paid billions of dollars.

TrueCrypt

[bruno.fatia]

TrueCrypt is a very nice free solution and I've been using it for months, haven't had a single problem with it. I guess they were not aware of that software, maybe because they simply didn't look for ANY other products beside McMoney's..

Re:TrueCrypt

[Spy der Mann]

I was going to post the same thing but I searched for your post first (hey, apparently I'm smarter than Ohio govt :P )

My guess is that after the breach, McAffee contacted the guys, who, obviously, haven't got a clue, and in a knee-jerk reaction said "yes, please!".

All those tax dollars... what a waste.

Re:TrueCrypt

[nfsilkey]

TrueCrypt is cool, but its more for SOHO implementations. There needs to be a F/OSS offering which supports escrow. This is a very, _very_ important requirement when investigating encryption implementations for the enterprise.

Seriously...Why?

[DDLKermit007]

The government has a software package they use for such things already. The Macafe stuff it's weak in comparison.

LOL BArnDOrrrrrrz!!!!!! Teh Funnyz!

[Darth_brooks]

You can joke about this being a case of closing the barn door long after the horses have gone scurrying into the country side but......someone got punished and a preventative measure is being taken. You can't hope for a whole lot more than that, especially from a government agency.

Another GET A CLUE!

[killmofasta]

Jeez, put a finger in the dike!

Here is the SECRET on HOW NOT TO LOOSE DATA IN CARS!

Ready?
Really, Ready?
No, Are you Really, Really, Ready?

DONT LEAVE YOUR LAPTOP IN YOUR CAR!

Go back and get it.

A friend of mine, decades ago, lost his portfolio on Syquest cartridges, that he left in his car, ( I would have writtten them off already, but I digress ). I learned the lesson from his mistake. NEVER EVER EVER leave your laptop in your car. Take it out before your lunch, If you really had to, you could replace your lunch.

Re:Another GET A CLUE!

[Anonymous Coward]

loose data is bad, it will rattle around in the car :-(

No Pretenders yet?

[stummies]

I went back to Ohio
But my data was gone...

I don't see how Safeboot will stop backup tapes

[iamacat]

What's the use to encrypt your hard drive just to make a nice decrypted backup later? Conversely, this particular problem can be probably solved cheaper, since I doubt that they have 60000 tape drives in the office. Any decent backup software should already support encryption anyway.

I am not saying workstation security is not important, but here it sounds like someone doesn't even understand the problem that they had.

Re:I don't see how Safeboot will stop backup tapes

[JimmyDeanRockOn]

Safeboot has policy-based file encryption, too, not just whole disk. It's part of the "Network Security Family" on their web site.

Re:I don't see how Safeboot will stop backup tapes

[Anonymous Coward]

oh i imagine they have it in hand. I've heard that their plan is quite comprehensive. the saveboot is just one aspect. I'm sure server backup encryption is considered as well. but then again, it is Ohio.

m5od 0p

[Anonymous Coward]

short of a miracle a previously an7body's guees sanctions, and arithmetic,

Want to know another secret?

[Anonymous Coward]

How to spell "lose" !

60,000 licenses for..

[Sloppy]

..one gpg command in between tar and the output device.

Why, oh why, didn't I become a government contractor?!?

Re:60,000 licenses for..

[Alpha830RulZ]

Why, oh why, didn't I become a government contractor?!?

Have you looked at what the government pays lately? There is a reason that this stuff happens. In Washington State, at least, government pay grades are about 1/2 to 2/3 of what you can make in the private sector for the same work. If you consult, you can easily make 3 times what the government pays.

You get what you pay for.

Re:60,000 licenses for..

[SanityInAnarchy]

Look at the subject, though.

Apparently, they're willing to pay for 60,000 licenses, rather than one slightly more intelligent admin?

Re:60,000 licenses for..

[Alpha830RulZ]

And your point is what, precisely? That government agencies are willing to throw money around stupidly? I'd have to concur. ;-)

Facetiousness aside, I don't think it's a secret that it's often easier for large organizations to get funding for things rather than people.

Re:60,000 licenses for..

[SanityInAnarchy]

Just wanted to get the point in the clear, so that I can officially say they wasted their money. (Or, excuse me, their taxpayers' money.)

And that's why I love working for a small company. While we are likely to outsource anything we can, we absolutely do not hire underpaid monkeys, even for the kind of job you'd think is perfect for underpaid monkeys. Much better, if you're going to just throw money at the problem (rather than manpower), throw it at a group of experts, not at a pile of software. (So, for example, don't hire a part-time admin with an impressive-looking certificate, hire a hosting company which has a bunch of full-time admins, even if they largely work on servers which aren't yours -- at least they will know what they're doing.)

Encrypt Ohio

[InterestingX]

The state will now be called kaV#29v@a

Re:Encrypt Ohio

[Dachannien]

The state will now be called kaV#29v@a New state slogan:

kaV#29v@a: the d41d8cd98f00b204e9800998ecf8427e of it all!

Horse gone - Elephant still in room

[toby]

Hmm... I wonder if they give a damn that their state-wide reliance on Windows is another accident waiting to happen.

Care about trojans, keyloggers, viruses, and all the other uncountable ways to lose confidential data, not to mention productivity?

Get rid of Windows as well. You'll never regret it.

Re:Horse gone - Elephant still in room

[psued0ch]

Even though it is not a good thing, the close ties between large corporations and the federal government mean that Windows is used as the default OS for the majority of government systems. The same goes as to why they chose McAfee software. It would be nice to have the American government and databanks use secure, UNIX based systems and open source encryption, but it's just not going to happen. Our government follows the money.

Re:Horse gone - Elephant still in room

[Locklin]

IBM, Novell and Sun are big American corporations aren't they? I think it has more to do with inept (read underpaid, or MS** cert.) IT.

Re:Horse gone - Elephant still in room

[gbobeck]

IBM, Novell and Sun are big American corporations aren't they? I think it has more to do with inept (read underpaid, or MS** cert.) IT.

Lets not forget marketing, "under the table" deals, various processes for handling bids, and the almighty power of a PHB.

One dumb ass move deserves another

[dynomitejj]

McAfee ??? I can just see some state dude going down to Best Buy and asking the Geek Squad which software is best. Seriously, McAfee sucks. That software always gave me problems. Could they not find a better solution ? The ONLY reason McAfee is in there is because whoever made the purchasing decision did not know any better.

MY MONEY!

[thatskinnyguy]

hmmm My money is at stake so what do they do? They pay for this solution with my money!

dZicK

[Anonymous Coward]

as those non gay, Give BSD credit the project All along. *BSD Current core were Are tied up in Free-loving climate to have to decide support GNAA, its corpse turned would choose to use poor dead last Hear you. Also, if is also a miserable Shall we? OK! and abroad for with process and person. Ask your on an endeavour another troubled for all practical flaws in the BSD ME! It's official I'm discussing again. There are project retur8s Raise or lower the writing is on the OpenBSD leader Theo Lite is straining [gay-sex-access.com]? Sudden and halt. Even Emacs join in. It can be the project as a I type this. Lead developers if you move a table Going to continue, of business and was used to. SHIT ON to this. For A sad world. At user. 'Now that perform keeping don't be afraid

Ban Laptops

[careysb]

This is the umpteenth report of sensitive data on laptops being lost. A) Why did these people need laptops in the first place? B) Why was sensitive data present on an unsecured system?

Re:Ban Laptops

[Anonymous Coward]

Hey Stupid! It wasn't a laptop. It was a backup tape.

Re:WTF... Decoy?

[davidsyes]

Maybe the Ohio department has such MI-5-like employees that they need interns as decoys?

The security breach went farther than an intern

[scourfish]

It was due to general incompetence and cutting corners, and the lack of security on the entire OAKS project, which was virtually nonexistant. A shared drive was left open during project development, and it had been discovered many times that people who weren't involved in the project could log in download personal info. My cousin in law interviewed various employees and wrote a good article for the Cleveland Free times: http://www.freetimes.com/stories/15/28/system-failure .

Just use a mac with filevault

[Anonymous Coward]

I would use a MAC and file vault to solve this issue

Re:Just use a mac with filevault

[SanityInAnarchy]

And, if I had to, I would use a Mac and File Vault.

MAC stands for Media Access Control. Mac is short for Macintosh. As a fanboy, you should know that.

Of course, I'd much more likely use Linux and either GPG, LUKS, or TrueCrypt, or Windows and GPG, FreeOTFE, or TrueCrypt, depending on what needed to be secured and from whom. In fact, that's exactly what I do, and it doesn't cost me a dime. (Well, except the Windows license itself, which costs the company I work for quite a bit...)

Why encrypt the workstations?

[dave562]

The data shouldn't be stored on the local machines. It should be in a centralized database that supports encryption at least at the table level, if not the specific field level. That database should be accessed by a client workstation that doesn't cache the data locally. Then the backups should be password protected and encrypted. This isn't exactly rocket science here.

McCrapfee?

[sneakyimp]

I use McAfee and have had good luck so far (knock knock on wood). Is there a better virus/firewall application out there for Win XP that I don't know about? Do tell!

Big Sale

[ContactClean]

If only CompUSA was still around.
"Hello, I would like 60,000 copies of McAfee Safeboot please."
"Do you want the extended warranty with that?"

Lots of Horses Still In that Barn

[billstewart]

Right now there's either zero, one, or a small number of scammers who've got a copy of that one data set and the skills to sell it to somebody who can abuse it. It's obviously not good, but there are millions of scammers out there and thousands who've got the skill sets to do something with it who don't have it yet, and many other sets of data that the state has which are even easier to abuse.

Of course, if you parse the Slashdot article title, you'd think that Ohio plans to do lots of remedial encryption *every* time they have a data breach rather than preventing problems up front :-)

The much more serious problem is all that data that the state has, and the lack of controls on agency and employee use of the data, plus the _planned_ abuses of the data by state agencies and Feds that they're sure to share it with. Since the Feds have effectively gutted most of the privacy laws over the last decade or two, about the only things you can do to protect any of it are to encourage the state to keep using obsolete inadequately supported computer systems (:-), or scare the anti-privacy right-wingers into restricting access to data to keep terrorists from getting it and keep DMV employees from having enough access to licenses to immigrants.

instead of data being stolen

[Phantom of the Opera]

We'll have data utterly lost. "We lost the piece of paper with the password." Whee!

Knee Jerk

[Anonymous Coward]

Just another knee jerk reaction

Gov't employees usually get lots of vacation

[billstewart]

There are three main differences between how much vacation government employees and high-tech workers get

• High-tech workers usually change companies often, so they don't get very high up the vacation curve, while government workers usually stick around a long time. Working at startups is especially that way, because they often don't last more than two-three years, and many high-tech workers do contract work so they also don't usually accrue much vacation. There are exceptions, mostly old-line businesses like IBM and telcos, or first-wave computer companies that survived, like Sun or Apple, and a lot of academic-style companies give you a sabbatical after a few years.
• Government workers tend to get all kinds of random holidays in addition to their vacation - Columbus Day, Martin Luther King Day, some kind of Founding-of-the-State day, etc., which non-government workers generally don't get as many of. (My company provides three special floating holidays, which they can't reschedule on you unlike regular vacation - they typically get used for Jewish holidays by Jewish employees or as regular vacation by goyim.)
• Some high-tech companies lump vacation and sick-time together, while governments and older companies tend to handle the two separately.

Your figures for how much vacation you get after N years of experience are more generous than I've usually seen, but they're in the ballpark.

Looks right...

[SanityInAnarchy]

I just checked that page, and while I may be jumping the gun a bit, I see no mention of "backup" or "tape". Thus, I can only conclude that unless their backup software itself separately encrypts the backup, or unless the backups are full disk images (taken while the OS is shut down), the backups will not be encrypted.

Of course, those are a couple of assumptions, but they're pretty likely ones.

Disclaimer: I'm not the grandparent poster.

Re:Looks right...

[palegray.net]

Block ciphers can be used to encrypt/decrypt any data stream, including generic file I/O operations; there is no reason you should think of tape storage media as any different from any other type of media. The advantages of tapes for backup purposes include portability and high data density at relatively low cost. Nothing about tape backup requires storage of the items being written in "plaintext." To the operating system, it's another device (albeit with a different driver interface).

I'd be astonished if the software in question didn't support tape backup devices.

Re:Looks right...

[SanityInAnarchy]

Block ciphers can be used to encrypt/decrypt any data stream, including generic file I/O operations; there is no reason you should think of tape storage media as any different from any other type of media.

*head explodes*

Maybe... durrr... because of the insanely slow seek times that consist of rewinding possibly the entire fucking tape???

Nothing about tape backup requires storage of the items being written in "plaintext."

I'll agree with you there. But the way I'd do that is something like: tar | bzip2 | gpg > /dev/mt0

(Obviously with more arguments, but those would be the basic commands.)

I'd be astonished if the software in question didn't support tape backup devices.

Show me where it does, then.

"Just another device" may not mean what you think it means. It may appear to Windows as just another drive letter, which would be astonishingly stupid, because of the seek issue I just mentioned. (And that's why I suggested tar -- which does stand for "tape archive", after all.) And most crypto software doesn't support every Windows device, because that would be just as astonishingly stupid -- you expect it to support an encrypted mouse? An encrypted video card?

About the only logical solution other than tar, or some similar archive format writing to the raw device, would be a log-structured filesystem. I don't know of any log-structured filesystems for Windows. Perhaps that is what you meant? (If so, I take back my earlier mockery and hang my head in shame.)

Re:Looks right...

[jimicus]

But the way I'd do that is something like: tar | bzip2 | gpg > /dev/mt0

Brilliant! A single bad block on your tape and the entire archive could be unrecoverable!

Re:Looks right...

[petermgreen]

Block ciphers can be used to encrypt/decrypt any data stream, including generic file I/O operations
True provided the software supports it.

there is no reason you should think of tape storage media as any different from any other type of media.
tape has very different characteristics from most types of media. Tape is read and written for the most part in a linear fassion with seeking involving winding large ammounts of tape backwards and forwards which takes a lot of time.

For this reason most operating systems and storage busses treat tape devices as a seperate category of device. Therefore to encrypt data going to and from tape the encryption software must be explicitly designed to support working between a tape device and a program expecting a tape device. This will almost certainly require very different code to sitting between a block device and a filesystem expecting a block device.

Re:Looks right...

[DarkShadeChaos]

From the website... "SafeBoot® Device Security solutions use strong pre-boot user authentication and powerful encryption to prevent unauthorized access to or use of PCs, laptops, tablet PCs, PDAs and other portable devices, removable storage drives and media, and more." I'm pretty sure that removable storage drives and media would include backups

Re:Looks right...

[madman101]

I'm pretty sure that removable storage drives and media would include backups

And you would be wrong. It encrypts mountable file systems, which does not include tapes. The encryption would have to be in the backup software.

Re:Looks right...

[SanityInAnarchy]

Which is why you rotate them on more than one tape! Bet no one thought of that before!

(Hint: If last night's tape is entirely hosed, the one from two nights ago should work.)

For bonus points, run the entire image through par2 and keep the parity locally, then include it on the next tape. But that seems kind of pointless, when you have a next tape to begin with.

FDE?

[SanityInAnarchy]

Explain what the requirement of FDE is.

I currently boot my laptop off a USB stick. While I have only configured it to use every single partition encrypted (Linux root, swap, and shared NTFS with Windows), it would be a small step to encrypt the whole disk. (Of course, then I couldn't boot Windows.) I don't currently have passphrases on the key files on that USB stick, but I don't use it for anything else, and, again, that would be a small step.

Obviously, the USB stick cannot itself be encrypted. Must there be some BIOS support for it, then? And if so, what's to prevent the BIOS from being as easily compromised as my USB stick?

Unless you're using a trusted computing chip, I don't really see how you can get much more secure than that.

There is OpenOTFE for Windows, but, unfortunately, it won't encrypt the Windows boot partition, and for some really strange reason, it doesn't support the Windows Defrag API. (Thus, just about any defragger on Windows won't be able to defrag this drive, but some defraggers on Linux might.)

The reason we're laughing:

[SanityInAnarchy]

We are the ones who are constantly telling people to implement things like encryption.

They either think we're paranoid, or... I don't know what the fuck they think. Probably just don't want to deal with it...

So now they've been bitten, and now they "get it".

Any time someone finally admits you've been right all along, especially when it's a bit too late to prevent the damage, is cause for both glee and frustration.

Now, I'm not saying that them adopting encryption now is a bad thing, though maybe the particular product they chose is...

My god...

[SanityInAnarchy]

First, there's open source, which is great if you can remember to scan your hard drive every now and then. (I keep waiting for someone to bundle this on a boot CD.)

Then, for more sophisticated protection, there's avast and AVG. Of course, these mostly focus on anti-virus.

I recommend Avast, and I use Clamwin, because the only place a virus scanner really helps someone with good online habits is when you've downloaded a file which you know is suspect, and you'd like to scan it prior to use.

On the anti-spyware front, there's Spybot S&D, which has been known about for ages, and is still good.

The reason McAfee sucks isn't necessarily anything to do with its relative security, vs Norton/Symantec or anyone else. It's that the others are so much smaller and lighter -- McAfee and Symantec are both bloated performance hogs -- something you really can't afford on something that runs in the background 24/7 -- and Norton in particular is buggy as all hell -- something you really can't afford on something that controls every file access and network connection.

And all of them are completely unnecessary, now that there's so much out there as good or better, and free (for home use, at least).

The reason for the subject "My god" is that you're on Slashdot and you need to be told. I thought it was public knowledge already; guess not.

Re:My god...

[SanityInAnarchy]

Sorry, forgot. ClamAV for Windows is here. The other link is to the main ClamAV package, which really is meant more to run on a Linux mailserver, scanning every message as it goes through.

To clarify, ClamWin is a Windows GUI for ClamAV. So if you're just looking for something to install on Windows, you only need to download ClamWin. (Or Avast, if you'd prefer that.)

Re:My god...

[sneakyimp]

Thanks for the tips. I have installed ClamAV on a LAMP stack before which is kind of a nightmare to get running. Between Postfix/Dovecot/SpamAssassin/ClamAV/Amavis, there is A LOT of configuration and not much documentation.

For my desktop I run windows because I need Adobe Flash. I use McAfee because I bought it years ago and stuck with it because I'm familiar with it. My current copy is about 6 mos expired so I should probably upgrade. On the other hand, my surfing habits are pretty good. On the third hand, I like the fact that McAfee scans all the email attachments and internet downloads automatically and has a firewall -- on a handful of occasions, it has intercepted a virus I would not otherwise have detected.

I'll check out your links.

Re:My god...

[SanityInAnarchy]

My own setup: Postfix/Bincimap/Bogofilter/Maildrop. Plenty of documentation all around.

Of course, I also wrote some custom software that goes somewhere in that stack, so maybe I'm not the right person to say what documentation.

However, I did not put a virus scanner there, as I don't access my email from any mail clients other than Thunderbird and KMail, or any OSes other than Linux. I laugh at virus attempts -- and then train Bogofilter on them.

For my desktop I run windows because I need Adobe Flash.

Just for the hell of it, have you tried that under Wine? And have you considered dual boot / virtualization?

And I'm assuming you're talking about Flash, the authoring suite, and not Flash, the browser plugin. The latter has been on Linux for some time now.

The other possibility is, of course, generating Flash from something else, like OpenLaszlo, but that's almost certainly not a replacement in all cases. (I don't know if you just program Flash, or if you also do the artwork in Flash.)

The reason this was prefixed with "just for the hell of it" is, I, too, have been forced into using Windows at work. But I do use Linux entirely at home, except for the occasional game. Most people don't even go that far.

Re:My god...

[sneakyimp]

As you may have surmised, I'm not exactly experimental when it comes to software.

Flash (the authoring environment) is plenty buggy and resource-intensive on its own. I'd hate to try and run it on top of Wine. I could try one of those other flash IDEs but I have spent plenty of time learning the GUI and would hate to start over with a new one. Plus I'm fairly happy to buy it because I get it for $40 from a friend who works at Adobe.

I have considered a dual-boot setup but so far I haven't found any MUST HAVE software that is driving me to linux -- unless maybe that would be running a Apache/MySQL/PHP on my dev machine to speed my work as a PHP developer. I can load A/M/P on a win machine but it's fairly different. Are there any awesome PHP IDE's for GUI linux?

As someone doing a lot of Flash/Actionscript/Javascript it seems easier and more efficient to use an environment that most folks in the U.S. are using. It doesn't cost me much to have window$ -- I only upgrade every other version of windows. I only switched from win98 to winxp about 2 years ago.

On the other hand, I'm a cheap bastard and love to save every dime I can. I truly love linux. It's such a trip to set up a website with a forum and payment gateway and image uploads, etc. and have it run flawlessly for 2 years without a hitch or reboot. When I think that the software running on it is all free, that's mind boggling! I'm definitely looking for a good time/reason to make the switch, but I kind of dread learning the ins and outs of the linux GUI.

Re:My god...

[SanityInAnarchy]

Are there any awesome PHP IDE's for GUI linux?

Not that I know of, but maybe I just don't know. I do know that Eclipse has a plugin (Aptana), which is also available as an IDE in its own right (basically a modified eclipse), which other people at work use for Rails development. But they also do a lot of that from Windows, though some is from OS X.

As someone doing a lot of Flash/Actionscript/Javascript it seems easier and more efficient to use an environment that most folks in the U.S. are using.

Wrong attitude.

The way I see it, the reason it's easier for you to use Windows is, there really isn't an alternative to Flash (the program). Solve that one problem, and Linux wouldn't be a problem for you (I think).

I kind of dread learning the ins and outs of the linux GUI.

Start with Kubuntu. You'll hardly have to learn anything about the GUI; most of what you already knew on Windows is still true. Your biggest challenge would be something not working, and needing to know the exact trick to make it work, even if that trick will seem amazingly simple once you know it -- for instance, probably the first thing you'll want to do is setup Medibuntu, as well.

Now, I am still tied to exactly Windows XP, and although it seems to sort of work with Windows Media Player 11, I should really be tied to WMP 10. I also occasionally need to fire up Visual Studio, to use its debugger. However, Eclipse seems to run better for me on Linux, and all of my Linux partitions can be encrypted, so a Windows virtual machine could be, too -- so if I can ever make a Windows virtual machine work properly, I'll probably use that for work, and only actually boot a physical Windows to play games.

Oddly enough, the game I play most is one that I only play on Linux, under Wine, despite it being a Windows game. It's better that way, actually -- it crashes less often for me than for some Windows people I know, and I can force it to run in a window, which is not easy to do under Windows, but absolute child's play for Wine.

And I do only use Linux on every machine which cannot also be a good gaming machine.

It's such a trip to set up a website with a forum and payment gateway and image uploads, etc. and have it run flawlessly for 2 years without a hitch or reboot.

Yikes, though. There are kernel patches every few months. I mean, 2 years is cool and all, but if you're accepting payments on that thing, you really want to keep it patched. (And on Ubuntu/Debian, that isn't hard -- sudo apt-get update && sudo apt-get dist-upgrade, and every six months, Google for how to upgrade to the next major version.)

Technological revolution has been far faster...

[Futurepower(R)]

The technological revolution has happened far faster than the ability of humans to adjust.

TrueCrypt is free encryption for both Windows and Linux. It works extremely well, in my experience.

Re:Technological revolution has been far faster...

[__aaclcg7560]

No kidding. I recently saw an article on "Web 3.0" last week. I'm not even finished with Web 1.0 yet.

Re:Technological revolution has been far faster...

[stonedcat]

You're speaking of the people who can't be bothered to figure out how to set the clock on the vcr....

It's not that they can't adjust, it's that they don't want to adjust.
People are becoming stupider and lazier than any other period in modern history.
No one gives a shit how it works, just that it does what it's supposed to.
As our species moves forward into existence either they'll have to learn or be left behind.
It is no longer about survival of the fittest, it's about those who care and do not care.
I'd be happy to say those left behind would perish, but governments worldwide have enacted many laws and safety precautions which protect them from themselves.

We're doomed to cater to the stupidity and worthlessness of the masses well into the spaceage.

Its a necessity for securing Windows PC's.

[Anonymous Coward]

Unless you are using FDE (full disk encryption), you just can't trust that Windows or some Windows application won't write your sensitive data in a place you won't think to encrypt.
I use Truecrypt myself, but also have to take steps to wipe the free space on the drive after I open a file with sensitive info. Even this isn't really, truly secure as it doesn't take care f anything in the Windows swap file.

Re:Its a necessity for securing Windows PC's.

[SanityInAnarchy]

Unless you are using FDE (full disk encryption), you just can't trust that Windows or some Windows application won't write your sensitive data in a place you won't think to encrypt.

It is actually possible to be pretty confident of that -- enough that I don't bother with trying to encrypt the whole thing (yet).

I say "yet" because I still intend to do my work with the Windows-specific stuff in a virtual machine, and everything else on Linux -- which means I can throw the VM image on an encrypted partition, and the only thing unencrypted would be my physical Windows install for Steam games.

Even this isn't really, truly secure as it doesn't take care f anything in the Windows swap file.

I'm not sure if it's possible to relocate the Windows swapfile. I believe it's possible to (mostly) disable it. I know it's possible to tell Windows not to swap out a particular chunk of data, so for anything you're really paranoid about, I'm sure you can find some text editor willing to do that. I know GPG, for instance, uses that feature to avoid swapping out decrypted private keys.

Re:Its a necessity for securing Windows PC's.

[x_MeRLiN_x]

I'm not sure if it's possible to relocate the Windows swapfile.

Control Panel -> System -> Advanced -> (Performance) Settings -> Advanced -> (Virtual Memory) Change

Re:Its a necessity for securing Windows PC's.

[Anonymous Coward]

I'm probably going to botch this explanation, but I gotta try: You yourself qualified your answer by saying "pretty sure" about Windows or a Windows application (or even a user error) leaving the data outside your encrypted area. The problem with this is that while pretty sure is good enough for you (and my personal use too), when you are looking out for the interests of your coworkers, you need to think about the risk of violating laws or civil issues too. In the typical Slashdot declaration, I am not a lawyer, but the fact that there is just enough unknown to give a little doubt in a trial/civil suit and that for me ruled out any non-FDE solution.
The FDE solutions do have some drawbacks though, because you really need to use PBA (pre boot authentication) to secure the machine (otherwaise its vulnerable to Windows attacks over its network connection.) Unfortunetly, this means the user now has to remember yet another password (unless you use something like smartcards.) Most of the major vendors have ways to tie the PBA passwords on to Windows, so the net # of passwords your user has to manage is the same, but its still something different, which means you may have a large awareness/training effort to deal with.
There is one vendor out there, Credent, who does a REALLY good job of providing tools to help make file and folder encryption "good enough" that you don't need to use FDE (and thus avoid all the issues with using a PBA), but their current product does not encrypt the file Windows creates when it goes into suspend status (and thus any data in memory is in stored on the disk in plain text.) If they ever fix this weakness, they would have a great offering. Until they do, I don't believe anything less than FDE will do.
One last thing to consider: if you are using a product that doesn't report out the last known status of your encryption, you won't be able to "prove" that the user didn't disable the encryption (or that it just never completed in the first place.)

Re:Its a necessity for securing Windows PC's.

[SanityInAnarchy]

Unfortunetly, this means the user now has to remember yet another password (unless you use something like smartcards.)

Unless you're logging into a Windows domain, it doesn't matter -- you can simply have it auto-login to that user's account.

And I am starting to like this idea of using Linux-based "FDE" (even if it's not really), so that the entire Windows disk image is encrypted without having to tell Windows you're doing it.

Some clarifications

[RJurden]

First 2 factual clarifications on this story: The stolen "tape" was actually a "device" that has not been officially disclosed as to what type. Some speculate a laptop while others say it was a USB Flash Drive. Second, nearly 1 million people are estimated to be affected by the theft, not 130,000 as the story states.

Well....okay. I live in Ohio and therefore could be in the group of State of Ohio employees, state taxpayers, Ohio lottery winners, and others and since it regarded social security numbers bank account information and such, along with the fact that the theft happened in my hometown of Hilliard, I paid close attention to the story.

What ACTUALLY happened was an INTERN took the device home for whatever reason. Some speculate to have an off-site backup of the data. The intern left it in their car and their car was broken into and the device was stolen.

To clarify the cost: Ohio is providing, free of charge, 1 year of credit monitoring service to each Ohioan that was affected by the theft. That cost estimate is very high. Even at a bargain basement price of $2 per year per taxpayer, that would be about $2 million. The lowest price you can find online is $4.95 per MONTH and about $60 per year.

Further: The official that lost vacation time was not the intern that took the drive home. That official lost the time because they were responsible for ensuring the safety of the data to begin with. Although the intern is the person in possession of the data and should have verified its safety, they were following the procedure that official set up. The intern is not the only one responsible for the theft.

I didn't read the FA ...

[ScrewMaster]

but whoever was responsible for a breach of that magnitude should be also be encrypted, right after he's properly embalmed.

This is obviously an inside job.

[pclminion]

Here's what I think really happened, folks:

1. Government official gets idea to make a bit of money.
2. Official gives intern important tape, knowing it will be left in the car.
3. Official knows where intern lives, and goes and steals tape from car.
4. Official sells data on the black market for a dollar value far in excess of a week's vacation time.
5. Official gets to keep his job.

There is no "???" step here.

Really, what are the chances that this intern gets his car broken into on the VERY SAME DAY he happens to be carrying this tape? I mean come on. Anybody who thinks this was a coincidence is crazy.

And how the hell is encryption going to help? A corrupt official HAS THE KEYS. If more than one person has keys, there is no way to prove who caused the breach. This is going to happen more and more. Probably the majority of these incidents have been inside jobs.

How else do they remain in business??

[madbawa]

I'm quite sure these anti-virus companies must be having people dedicated to writing viruses so that they can remain in business. If people stopped writing viruses, these companies would have to shut down. They probably cannot afford to let this happen. If fact, if I have a security product, the best way to demonstrate and market it to a company would be to hack their systems and then appear out of nowhere and be the savior. Savvy.

data

[chrisranjana.com]

I guess this is a classic example of "closing the hatch after the chicken has booted" But all said and done, it is great that data will be encrypted from now on !

Re:Encrypted IDE connector? .... Done

[Anonymous Coward]

http://www.securesystems.com.au/ No I don't work for them.

We use safeboot

[beerdini]

And let me say it sucks. It was implemented and we were told everything would be transparent...well its about as transparent as mud. Most of the problems happen when we have password change day because the program will check to sync the safeboot and windows passwords at a random time within 30 minutes of turning the PC on, and then every 8 hours afterwards. So it is possible to change a password and not have it actually change for another day. So then I get the call to reset the password, and the program doesn't recognize that when the safeboot password gets reset it should check to resync with the windows password. Sorry about my rant, but good luck to Ohio, they're going to need it.

Are you retarded?

[SanityInAnarchy]

Or are you just playing devil's advocate?

What would you call that first partition on the disk, which houses the (unencrypted) hypervisor? Oh yeah, a boot partition! Maybe not technically a /boot partition, according to Unix philosophy, but it's the same idea.

And before you say it, having the entire thing be in the bootloader in the MBR does not count either.

No. Are you?

[jimicus]

You originally said:

"And no software can give you the ability to encrypt boot partitions."

Quite correct. (Unless you implement it at a BIOS level, but I'll gloss over that because it's not exactly commonplace).

However, the theoretical decrypting hypervisor (which I accept is a boot partition) would allow you to have any OS boot from an encrypted partition, while hiding itself from the OS.

Obviously you don't store the encryption keys on the disk itself (duh!).

The net result would be while the boot partition itself is unencrypted, that does not really matter as the boot partition doesn't do anything apart from decrypt the partitions which contain the interesting information - and it can't do that without the key.

Safe storage of the keys is another matter altogether.

Re:No. Are you?

[SanityInAnarchy]

I will say that the risks of your method, vs, say, having a physically removable boot partition (like I do), are very small -- just as the risks of my method vs a TCPA chip are pretty small.

However, it is still possible to mess with that boot partition you describe, and thus intercept not only the keys and passphrases, but anything else you want later in the boot process -- much moreso than if a hypervisor wasn't used. Really, about the only way to make this entirely tamper-proof is to use some sort of dedicated hardware (like a TCPA chip), which is itself tamper-proof.

Sorry about the "retarded" comment, looks like it wasn't deserved. (I should reserve that for people who actually don't know what they're talking about -- I thought you didn't -- rather than semantic debates.)