Data breach notification law finally makes it to Australia's Parliament Australia's long-awaited and long-delayed data breach notification laws are back on the political agenda, after the nation's House of Representatives passing the legislation yesterday. The bill now before Australia's Senate is the rather limp document that landed in October 2016. Companies will have the chance to keep mum …
The difficulty I see is that even a minor breach can have associated consequences.
Consider for example a sporting club with an online portal for court bookings or classes etc. There is nothing confidential in there, it's all printed out on the noticeboard anyhow. But their server remained unpatched for years as they can't afford an IT BOFH and now their mysql backup files are popped.
OK, so nothing confidential had been exposed, and the passwords are all at least hashed, even though it is unsalted md5 (which we knew not to use even 10 years ago *cough* Yahoo! *cough*) but by my reading this would definitely be a minor breach.
The problem?
* Any common md5 password can literally be cracked by googling the hash. Or hashcat will find it very quickly if less than 8 characters.
* Most people use the same password for multiple services.
So now someone has their email account popped and from there password resets on other services.
Well, no. The test is:
the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates;
Note, any of the individuals - which means you have to consider the worst case, not the best.
Of course it's incredibly vague and clearly designed to enrich lawyers. But what else is new.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
