two tales of security

From the “if I had a nickel every time..” cat­egory, a story from The Tele­graph on the loss of sens­it­ive inform­a­tion by the RAF:

The Min­istry of Defence has admit­ted that files had been stolen, and more than 500 RAF staff have been warned of the pos­sible con­sequences to them and their fam­il­ies after the unen­cryp­ted data — stored on three com­puter hard drives– went missing.

The extremely per­sonal inform­a­tion had been given by ser­vice­men for an in-depth vet­ting pro­cess to give them high secur­ity clearance.(emphasis added)

Now, I cer­tainly can’t com­ment on the spe­cific facts sur­round­ing the loss of this data, but I did note, in par­tic­u­lar that the data recor­ded was unen­cryp­ted. As most read­ers of this blog know, this is cer­tainly not the first time an incid­ent like this has occurred (i.e. a lost, mis­placed, or inad­vert­ently dis­carded data stor­age device that con­tained sens­it­ive inform­a­tion). In fact, to be hon­est, it is some­what mind-boggling that this still occurs. Not that things get lost. I under­stand that things like that may hap­pen des­pite the phys­ical secur­ity pro­to­cols that one may put into place. But not encrypt­ing such data? Per­haps  a dec­ade ago, some­thing like that would be under­stand­able. But it should not be today, par­tic­u­larly when there has been story after story about this sort of thing. In this case, not only has the RAF com­prom­ised the per­sonal inform­a­tion of cer­tain of its officers, it has also put the UK’s national secur­ity at risk. Com­pletely inex­cus­able. And if I sound harsh, it’s because I intend to.

So, once again for any­one who cares to read this blog: If you are respons­ible for sens­it­ive data and store it in digital format, you really, really, must ensure that you encrypt that inform­a­tion, par­tic­u­larly if it is on a stor­age device that may be trans­por­ted, or is sit­ting any­where other than a very secure vault. Oth­er­wise, it’s only a mat­ter of time that someone will come after you for neg­li­gence. Or worse.

On the other hand, there is a brief story in Wired about an inter­est­ing video on You­Tube. It’s basic­ally a faked video show­ing some “hack­ers” tap­ping into a building’s SCADA sys­tem. Inter­est­ingly, this appeared to set off alarm bells in some circles:

“Per­haps the first demo was just for fun, but the oth­ers will have less juven­ile goals,” McAfee Avert Labs researcher Fran­cois Paget blogged on Fri­day. “An attack can involve nation­wide dam­age, a ter­rible effect on the public’s mor­ale, and huge fin­an­cial losses.”

…

To be fair, McAfee’s Paget acknow­ledged some doubts “about the tech­nical aspects of these light-show ‘attacks’ on unpre­pared build­ings.” But with the enthu­si­astic faith of cybarmaged­don­ists every­where, he boldly asserts that it doesn’t mat­ter if the video is genuine.

“Fake or not, the video con­firms that hack­ers and cyber­crim­in­als have got their eyes on SCADA networks.”

So, a ques­tion for any­one read­ing this — even if the video were real (and it’s not), why (other than what the art­icle already notes) do you think Mr. Paget’s com­ments might be a bit off the mark, at least when it comes to the con­tents of the video itself?

related:

1. from the “another secur­ity head­ache” department
2. asp issues
3. XBRL Is Cool
4. arbit­rary elec­tronic search & seizure + cana­dian bor­der = ok
5. when not to use technology