Slashdot Mirror
Data Breach Notices Show Tip of the Iceberg
d2d writes "The Data Loss Database has released a new feature: The Primary Sources Archive, a collection of breach notification letters gathered from various state governments as a result of data breach notification legislation. The documents include breaches that were largely unreported in the media, many of which are significant incidents of data loss. This lends credence to the iceberg theory of data-loss reporting, where many incidents never break the surface. Now, thanks to the Open Security Foundation, we can 'dive' for them."
Some of my favorite highlights from recent incidents (I know, I shouldn't RTFM):
Names and Social Security numbers of at least 250,000 found through search engine
Date: 2008-12-02
Organizations: Florida Agency for Workforce Innovation
I guess there are many different ways you an innovate...
Social Security numbers of 341 posted on web
Date: 2008-12-04
Organizations: Economic Research Institute
If it's for research, then it's ok to post on the web...
Stolen laptop contains names and Social Security numbers of "several thousand " employees
Date: 2008-12-11
Organizations: Hewlett-Packard
If you thought only small time loser organizations like the first two on my list where subject to embarrassing data loss, that one would set you straight.
--
http://fairsoftware.net/ -- Software Bill Of Rights
I've always wondered if the organisations that 'lose' data such as SS#s are diligent in warning potential victims of identity theft etc.
Totally ignorent in this area - perhaps someone here could clarify. What, if any, are the obligations of an organisation that holds sensitive data about you to inform you of it's potential or real loss?
Seems that this is a start, but it's still 'passive'. Some kind of active warning system would be better... After all, if someone's stolen my bank details and passwords, I'd really like to know, fast.
We just need to somehow convince people that data is like a young blonde, attractive, girl. I'll even give you a sample police report:
Yesterday evening at 5:04pm, a young and attractive blonde female database was pushed into a UDP connection, which fled the scene shortly after...
#fuckbeta #iamslashdot #dicemustdie
ignorence is blitz I always say...
Forget diving for it individually. Let OSF collect and collate, and task someone at /. with gathering and posting a weekly summary. It'd certainly serve a better purpose than "Ignore Mail". It'd bolster OSF's effort because, get serious now, which is going to be read more?
"I may be synthetic, but I'm not stupid." -- Bishop 341-B
Perhaps, to make it easier for the effected, we should just post the actual data that was lost. Then I could setup a google alert for my SSN/bank account number, and get an email when it's been found.
"Sunlight is the best disinfectant"?
Kelsey Grammer is a Nazi?
Data breach notices have a scalability problem. As the number of notices soars, we need to better define what is a serious breach and what is not. Otherwise, the public drowns in breach notices, many of which are insignificant. --Ben http://hack-igations.blogspot.com/2007/12/does-lost-tape-equate-to-lost-data.html
Benjamin Wright, Dallas, Texas, benjaminwright.us
Despair saw it coming first
Considering that I've received notices of data nreaches at three current or former employers and from two government agencies all of which "may" have involved personal information including my date of birth, social security number, etc. Meanwhile, there's undoubtedly some organizations which have also lost data yet failed to report that fact, plus the likelihood that others have had breaches yet do not have my current contact information. It seems safe to assume that probably every bit of personal identity information for me is now in the public domain.
While I haven't yet become an identity theft victim, it seems like it's only a matter of time. Some agencies have offered 1-year enrollment in a credit monitoring service, others simply recommend that I should make sure to check my credit reports regularly. Gee thanks!
As infuriating as all of that is, what really gets my goat is all of the advice tossed out by many of these same agencies to be sure to shred bank statements before discarding them. While I agree that one shouldn't be careless with their own financial information: 1) it seems more likely that my personal information will be stolen from the very organizations that give me this advice than some neighborhood dumpster diver, and 2) if these agencies were even half as cautious with my information, these incidents would be a rarity.
Javascript, cookies, flash, and ActiveX must be enabled in order to view this sig.
"At the Data Loss Database."
"LOL"
Kelsey Grammer is a Nazi?
No, it was Kelsey's Gramper.
John
The fundamental problem here isn't the data loss (other than a possible loss of privacy), but one of what someone other than the authorized owner of that information can do with it. Credit reporting agencies, property title offices, passport offices, and a whole host of other people need a much stronger form of authentication. These fools have ignored this problem for years, and impose costs not only on the victims but on everyone else due to prosecution, police investigation, etc..
From a practical security perspective, security on data use is really limited to the "something you have" aspect (i.e. your name/SSN/DoB/address), less on the "something you know" and rarely the "something you are" categories. Both government and private industry needs to wake up and start making it much more difficult for people to have anything bad done to them simply because someone uses their data ON TOP of mandating cryptography and security for information (which I deem to be separate concepts).
An idea - digitally sign the hash of a person's fingerprint, retina, signature and a non-obvious PIN (i.e. pictures, phrases, numbers, questions), put the root certificate authority in a government-controlled secure bunker or military base with FIPS 140 secured HSMs and multiple independent layered checks and balances, and use the signature/verification chain for both government and commercial uses.