The Professional

An interesting narrative, trapped unfortunately behind a pay wall, comes from the Chronicle of Higher Education - "Chapel Hill Researcher Fights Demotion After Security Breach"

A cancer researcher's database of gets potentially pwnd (two years from incident to discovery), spurring the usual breach notification process.  Her bosses cut the researcher's pay and reduced her status to associate from full professor.  The justification was that she, as principal investigator, was responsible for the security of the personal data entrusted her by the subjects of the study.

The meat from the article (emphasis added):

The provost also accused her of assigning server-security duties to an inexperienced staff member, who failed to install important patches and upgrades, and of not providing the staff member with the training needed. Ms. Yankaskas countered that the staff member, who has since left, had worked for the university's technology office and that the employee never submitted a formal request for additional training.

"I had an employee who I trusted who told me things were OK," she added. "I would have no way to get on the computer and tell if it was secure. Unless I assumed my employee was lying to me, I don't know what I could have done."

Working in the Public Interest

I believe that there is a another option.  Some folks are in charge of security but are not liars, but are incompetent.    And, yes, it is hard to tell them apart.

If it was money that was stolen, and someone said "I have no way of telling if the books were correct.  I trusted the accountant.  He was an experienced bank teller" what would be the response.  Why didn't you hire a forkin' CPA?  CPAs have professional knowledge, and ethical obligations, and if they fail to meet them, you can have their license pulled.  

No so with security folks.  Why is it acceptable to treat for others to manhandle your personal, private data more cavalierly then your  accounting records?  

I'm tempted to start my rant on certification, psuedo-science and "computer forensic professionals" but I'll save it for the next post.   

Visualize World Data Breach

38.2% of the known universe has blogged about the Verizon data breach report and how it has changed their life, and opened their eyes, busted icons and confirmed suspicions. But I looked right at the facts there, but I might as well have been completely blind.



My thoughts are simply:

• What? No scatterplots? Bar charts and pie charts combined with narrative paragraphs that don't describe either are sort of lame. Give us an idea if there are two or three mammoth breaches that are skewing your stats. A little creativity would have helped. Don't just think the data breach. Be the data breach.
• It would have helped to have "data breach" defined. Sometimes, the stats are describing a leak of GLB-style NPI, other times credit card info, other times website defacements. What do you want to bet that the threats and controls for a theft of trade secrets is different than for a credit card data from a Bennigan's POS terminal? Is it enlightening to lump this data together? I recall reading many years ago an essay in a scholarly computer science jounal on Computer Crime. They including the classic network hacking and phone phreaking in their analysis, as well as people hijacking trucks carrying motherboards. So, if I hit someone over the head with a laptop that stores unencrypted SSNs, is that a data breach?
• I will give the Verizon guys extra bonus points for not using the report as a sales lead generation tool. I'll rant more on that later.

Photo of Gene Clark courtesy of Find-A-Grave. Think Gene Clark, not Eagles.

Shake Hands With Danger

or the Mysterious Case of the Substitute Teacher and the Depraved Pop Ups. Krebs has the details, more or less. And some comments. Lotsa comments.
I am of several minds on this incident.


The Forensics
Network Performance Daily has a couple of CSI:Connecticut posts the about the forensic evidence from folks who have seen it.
The Defense - The few details included don't support forensic discipline. The statement "[d]uring the copy process we received several "Security Alerts!" from our antivirus program" appears to indicate that the forensic data was being copied (not imaged) over to a general purpose computer (that runs antivirus). Generally, forensics is done off an image mounted as read-only. Copied files don't have much in the way of chain of custody, and copying data can change some of its properties.
The Prosecution - This post is just unreadable. I can't tell what's going on, but that the cop may have used a forensic program to examine the data.

Whatever
I mean, whatever. The forensic evidence doesn't really establish who was at the keyboard when the nasty images came up. Could have been seventh graders, could have been the teacher. The teacher didn't shut off the computer (or even turn off the monitor) when she left the room, though. I mean, in the words of G.O.B. "COME ON!"

So Shake Hands With Danger
When you log on to the Internet, you shake hands with danger. Computers are dangerous. If you aren't checked out on the equipment, you shouldn't operate it! You could be a danger to yourself and those around you. Don't end up like Three Fingered Joe!