Slashdot Mirror
Best Western Loses Details On 8 Million Customers
Albanach writes "Scotland's Sunday Herald newspaper has an exclusive report that the Best Western hotel chain has lost the personal details of each and every guest who has stayed at any of its 1300 hotels in the past 12 months. This amounts to details on 8 million customers and includes information such as name, address, credit card details and employment details. The data even includes future booking details, causing speculation that homes could be targeted for burglary when it's anticipated they will be unoccupied. A Best Western spokesperson is quoted as saying 'Best Western took immediate action to disable the compromised log-in account in question. We are currently in the process of working with our credit card partners to ensure that all relevant procedural standards are met, and that the interests of our guests are protected.'"
We're getting "anti-terror" laws that cut away our civil liberties piece by piece, despite little to no terrorist activity anywhere. Yet we have "data loss" on an almost weekly base and nothing happens. Could anyone tell me why those companies are still in business? When did criminal neglect become less than a misdemeanor? Because, well, did you see anything happening out of it? I didn't.
These companies cause problems to their customers by their careless handling of personal and financial data. At the very least, they subject their customers to the threat that their credit card data is in the hands of a criminal, ready to use it whenever they please. When are we going to see some laws that mean consequences if you can't handle your customers' data?
Every company is very keen to collect everything about you, from your favorite dish to your shoe size, but they can't be bothered with the task to keep this information secure? If you can't keep info secure, don't collect it, dammit!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The issue is not so much that the data were stolen, though obviously that is bad; but that the hotel made it worse by keeping data on hand that weren't necessary. "Employment details"? WTF? I recognize that certain data are unavoidable in such a system; but I would like to see substantially greater penalties for those who compromise customer data that they don't even have a good reason for keeping.
Incidentally, when did we start using the term "lose" as a polite synonym for "fuck up in fine style"?
Don't rush to judgements without the facts being in. Its entirelly possible from what was posted there that a single employee did something bad, not that the whole organization was negligent.
If you can break one account and download millions of records before anyone notices and you allow all that anonymously over the Internet, then I'd say there are some systemic problems. That is by far the easiest way to do it, but also the least secure. If any single user account gets hacked, the entire database is open for quick and easy download. But, if you had people go through a front-end that only fed one record at a time, logged all records presented to which accounts, froze the account at more than 10 records per minute or 100 in a day (or whatever number works) then you could make a system that would still allow for a user that gives away his username and password and not make millions of records available for immeditate download. And even if it did happen, you'd have an exact record of every record touched, to limit exposure and damages (no one claiming they were affected when they weren't).
Compartmentalization is important for security, but never done because it is often inconvenient for the users. The trick is to fine for just the loss of records, something like $10 per record exposed, so that they will treat them like real money, not just a PR issue if things go wrong. The current method of them paying only with proof of damages to a person, or buying a credity watch for a year (probably at some obscenely discounted rate and gets you on the credit report company's mailing list) is a joke. Make it cost real money and you'll see more lying about when they do happen and more security to prevent them from happening.
Even if you have separation of powers you are still vulnerable. Suppose the DBA and the System Admin are different people. Maybe the DBA keeps things locked up tight and the database itself is encrypted. The system admin can still just sit and read memory all day and collect the info that way. I used to do this in school. Some of us had shell accounts in the comp sci dept. I never had to "break" or get elevated privilages past any security but I could collect lots of interesting information by running a little C program I wrote which allocated a big character array, did not initialize it and then wrote the contents to disk every few moments, lather rinse repeat.
Or, they give full read access to everyone so that some accountant somewhere has an easier time setting up Crystal Reports to run a monthly report. You don't need high level access to compromise the data. Even the lowest read-only access will expose every record in it.
Learn to love Alaska