He should be replaced because he was the person responsible for the data. Obviously I don't want them encrypting irrelevant materials, but if it contains SSNs, then there is no question it should be encrypted. Thus the statement about "data classification". It's a very simple concept, look it up.
Two months is absolutely unreasonable. It should not be a complicated process to determine what's on the tapes (any halfway decent backup product contains a database of what materials are backed up to which media), and they obviously had the names/address information because that's part of what was backed up! Just because it takes a long time to go through red tape is not an excuse. While the Ohio government was going through their CYA process, citizens of that state were at a higher risk of identity theft and fraud due to their inaction.
There are others, but those are the ones pissing me off at the moment.
I recieved one of those lovely "We lost your data" letters... 2 months after the incident. So, as one of the individuals who was personally impacted by this, I'd like to say a few things:
1) Their IT staff is incompetent. In my department, we ship over 50TB a week to our DR facility in England. We have had instances where tapes were lost in transit (thanks FedEx!) but the data was encrypted. No harm, no foul. That being said, their idea of sending tapes offsite was to put it in the back of an intern's car. GENIUS!
2) This petty hand-slaping is absurd. Yes, I want the idiot fired and replaced by someone who gives a damn about data management, security, and data classification.
3) 2 months to contact people who were on the tapes?! FFS!
4) Their incident handling in the media was that the criminals would need "specialized knowledge and tools" to extract the information. It says what kind of tape it is right on the case! That, and a little Google go a long way. Stop feeding the public a line of BS and own up to the fact that it's really not that hard to get the data off the tape.
There are others, but those are the ones that are pissing me off at the moment.
Slashdot Mirror
He should be replaced because he was the person responsible for the data. Obviously I don't want them encrypting irrelevant materials, but if it contains SSNs, then there is no question it should be encrypted. Thus the statement about "data classification". It's a very simple concept, look it up.
Two months is absolutely unreasonable. It should not be a complicated process to determine what's on the tapes (any halfway decent backup product contains a database of what materials are backed up to which media), and they obviously had the names/address information because that's part of what was backed up! Just because it takes a long time to go through red tape is not an excuse. While the Ohio government was going through their CYA process, citizens of that state were at a higher risk of identity theft and fraud due to their inaction.
There are others, but those are the ones pissing me off at the moment.
I recieved one of those lovely "We lost your data" letters ... 2 months after the incident. So, as one of the individuals who was personally impacted by this, I'd like to say a few things:
1) Their IT staff is incompetent. In my department, we ship over 50TB a week to our DR facility in England. We have had instances where tapes were lost in transit (thanks FedEx!) but the data was encrypted. No harm, no foul. That being said, their idea of sending tapes offsite was to put it in the back of an intern's car. GENIUS!
2) This petty hand-slaping is absurd. Yes, I want the idiot fired and replaced by someone who gives a damn about data management, security, and data classification.
3) 2 months to contact people who were on the tapes?! FFS!
4) Their incident handling in the media was that the criminals would need "specialized knowledge and tools" to extract the information. It says what kind of tape it is right on the case! That, and a little Google go a long way. Stop feeding the public a line of BS and own up to the fact that it's really not that hard to get the data off the tape.
There are others, but those are the ones that are pissing me off at the moment.