Slashdot Mirror
How Would You Prefer To Send Sensitive Data?
sprkltgr writes "Our HR department is implementing new software. The HR Director has tasked me with sending our data out of our network to the consultant that's loading it in to the new package. Obviously this data includes items such as SSN, name, birth date, etc. Upon being told that I would not email this data to her, the consultant asked what my security requirements were for sending the data. What would be on your wishlist for the best way to send sensitive data to someone outside your firewall?"
Redacted using FBI security techniques will guarantee absolutely nobody will be able to see it.
Make sure you send the password with the file.
Deliver it by hand.... if you're lucky they'll give you one of those cool attache cases that handcuffs to your wrist.
Three Squirrels
Make sure to install a stock, unpatched version of Debian Etch to ensure proper, secure entropy on your encrypted data.
Dearly,
The National Security Agency
Well, the first thing you need is physical security. I would reccommend Blackwater for their premium quality goons. You'll need at least two platoons and a morter squad. Then you'll want to hand-deliver a one time pad to their secure vault, with a completely off-network computer to do the decryption. You can solder off all the connections except a secure thumb drive for the OS and the DVD containing the OTP. You'll have to keep your own copy of the OTP in your own vault. And I highly recommend Windows ME on a Dell for the encryption routine.
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
Encrypt the drive and put it in a locked case, handcuffed to your wrist. Have a second person carry the key to the handcuffs and to the case and take a separate train. Just for good measures, send out decoys for both yourself and the man with they. Rendezvous at the consultant's headquarters.
Don't forget to wear mirrored sunglasses.
Science advances one funeral at a time- Max Planck
Send a CSS encrypted iso of the data on a WEP encrypted wireless network that requires HDCP to display on her monitor with a signature generated by LM hashes from an unpatched, unfirewalled Windows 98 box.
He has the ability to hold data in his head. They even made a documentary about him called Johnny Mnemonic.
Help fight spam
I prefer ROT-26; less chance for data loss.
The CB App. What's your 20?
But then you'd have to wait for the next release cycle.
Alternately, you could quantum encrypt the data, send the key by smoke signal, and nuke the entire site from orbit. It's the only way to be sure.
ROT-13 has been broken. You need to use Triple ROT-13 (3ROT13).
My comments are my own, and do not represent the views of my employer, my spouse, my children, or my cats.
Just so long as you at least verify fingerprints via the phone. Fingerprints aren't any more secret than the public key, but at least on the phone, a MITM insertion attack is much more difficult -- they would sound different.
Don't thank God, thank a doctor!
When he totally freaks out and starts screaming. Rename the file to GrowYourPenisNow.doc, spoof the From: header to be from hotmail.com, add a subject line V1agra and send.
Nobody will ever bother to read it.
How to send confidential data like this? Archive to a large disk (DVD). Use more than one if necessary. Place DVD jewel case into briefcase. Handcuff briefcase to CIO. Cover handcuff so as not to arouse suspicion. Send CIO to destination. No hacking, no data loss, security problem, etc.
Encrypt the file with PGP and put it into a TrueCrypt container on a USB stick that requires a thumb-print for access and which is wrapped in a condom and 'hand' delivered by the 'mule' via the usual hidden methods. The access codes are encrypted into an image file delivered by uploading it to a porn site, the location of which is emailed to the intended recipient with a note saying something like, "Hey, check out this babe I was with last night."
I hope this comment is well received... I could have moderated instead!
Persecutors will be violated!
You should rot-13 twice. Twice the security.
So when do I get my membership card for the 'don't read, just post' club?
I think I can help here: step 3 is: 'apply copious amounts of lubricant'.