Sign in / up

back to article Skipton in lost laptop security woes

Skipton Financial Services has confessed to losing a laptop containing records of 14,000 customers. Information exposed by the breach includes names, addresses, National Insurance numbers, and fund investment details of clients of Skipton's Fidelity FundsNetwork. The laptop was nicked from a locker being used by a staff member …

COMMENTS

House rules Send corrections
This topic is closed for new posts.
  1. yeah, right.

    not just encryption

    Not just encryption, although it's a damn good start, it is still too easy to get access to encrypted data via various social engineering methods. How about not allowing private data to be stored on easily lost or stolen items like CDs or laptops?

    Only allow access to the data through secured, encrypted links, and provide a layer of physical security around the data storage as well. That might slow down the haemorrhage. Maybe.

    Of course, given the way the UK gov (and USA, and Canada, and every other one for that matter) is stripping "privacy" from us every chance they get, perhaps

    it's a moot point.

    0 0
  2. Colin Millar
    Alert

    Encryption is too late a start point

    In most cases that we have seen over the past month or so the data in the form it was should not have been on the media or device in the first place. Have these people never heard of GUIDs? Do they think that SELECT is always followed by *?

    Proper data modelling is required and proper need to know policies. But before all of that people with a responsible attitude to data protection need to be employed.

    0 0
  3. Anonymous John

    Um

    According to the Yorkshire Post

    "Moore Stephens Consulting was carrying out work on an IT system for the Yorkshire-based investment company when the theft took place"

    So why did he need customer data on his laptop?

    0 0
  4. John Macintyre
    Joke

    @Um

    well obviously the unlinked Moore(ski) Stephens(ki) was an undercover russian(ski) haX0r who was clearly using the guise of a consultant to steal the companies data and 'lose' it to one of his buddies in the russia. Duh

    0 0
  5. Anonymous Coward
    Pirate

    Punishment...

    Hmm... If they decide to punish these people as they deserve, will they have to multiply that punishment 1700x for the HMRC?

    0 0
  6. Richard Woollacott

    Laptops

    Other than discs, it usually seems to be data on laptops that is lost. A rule under the data protection act that sensitive personal data may not be held on anything other than a desktop or mainframe would solve most of the problems. If data is needed elsewhere it could be sent on secure encripted lines since I assume that such things exist.

    0 0
  7. Anonymous Coward
    Stop

    Ridiculous

    Putting live customer data in the hands of a consultant, off-site, is surely a breach of trust in itself?

    0 0
  8. Pete James

    If the facts don't fit the theory, change the facts

    Security will never improve until company Directors are properly held to account with robust, easily understood law instead of the flannel we are working under. And no, UK law does not work in this respect - otherwise we would have seen some brought to book by now.

    0 0
  9. Anonymous Coward
    Anonymous Coward

    huh?

    So this guy was walking around with a laptop full of thousands of customer's records... why? I can't believe that the creators of a database system that holds so much sensitive data would be so careless as to develop a mechanism that places a physical copy of so much plain text data on the client PC. So my guess is that he had a data dump on a spreadsheet. Wonderful. All the smart systems development in the world can't protect against that level of user stupidity.

    0 0
  10. Anonymous Coward
    Anonymous Coward

    RIPA

    Oh dear, looks like we're caught between a rock (encryption requirements to pre-emptively avoid disasterous data losses) and a hard place (RIPA sec 3).

    "Told you so", a consultant might say, looking back three years.

    0 0
  11. Phil Endecott

    Assume nothing is secret

    I think we should all now assume that we have no "private" data. Assume that it's all out there already, and stop worrying about any further leaks.

    As an individual, this really just means that I must always check my bank statements - which of course I do anyway. The people whose lives are made more difficult are the banks (etc.), who can no longer "verify" customers' identifies by asking for confirmation of "private" data. How they will fix this I don't know, but that's their problem.

    0 0
  12. Anonymous Coward
    Anonymous Coward

    Not stolen...

    It went walkabout because it wanted another Date with the Great Codd in the Sky.

    /Is this my concrete overcoat I see before me

    0 0
  13. kain preacher

    what I really want to know

    The article only says it was taken from a locker. I want to know was that locker on company property.

    0 0
  14. Lou Gosselin

    How to fix?

    Many people here suggest that there is gross negligence by the company losing the data, as opposed to the consultants who failed to encrypt or protect it.

    From a technical point of view what exactly is the solution, then?

    1. Have policy and equipment requiring consultants to use a remote desktop so data always remains on site.

    This has it's own technical problems, requires high connectivity, can be expensive, limits the software/os available to the consultants, and is potentially vulnerable to exploitation in itself.

    2. Require consultants to always store data on remotely mounted drive located at company via VPN.

    Difficult to enforce, and requires high connectivity.

    3. Require consultants to keep data encrypted.

    They should already have been doing this, it is difficult to enforce.

    4. Prevent them from having access to all the data (select *) so they can't loose it

    I've heard people say this, but what exactly are you talking about? The consultants may if fact need the data. SQL is by nature an adhoc mechanism, how would one impose restrictions while not simultaneously hampering the ability to do one's job?

    The company could have DBA to create and grant restrictive views to the consultants. However if every query needed approval, efficiency would drop like a rock. And if the DBA knew which queries to grant, then they probably wouldn't need the consultants in the first place. So this still wouldn't necessarily fill the security hole.

    I'm really interested in knowing how you guys would go about solving this? Clearly there are things that the consultants can do, but what about the company who's data is at risk?

    0 0
  15. Anonymous Coward
    Alert

    sue the companies?

    what are the odds of successfully suing a company for losing all this data? and the one that really makes me laugh is debt collection agencies selling the accounts to each other, so you were dealing with one firm, then a totally different one rings up and the first thing they say is "can you confirm your date of birth for security?"... i mean, why are so many companies still using this carp system for "security"?

    *meh*

    0 0
  16. Tris Orendorff
    Linux

    Skipton...

    @Lou Gosselin:

    "From a technical point of view what exactly is the solution, then?" The solution is to create a matching database with false names, addresses and other personal information. It can be used by anyone, anywhere without fear of losing a week of paid holidays.

    0 0
  17. Anonymous Coward
    Anonymous Coward

    Or...

    If 'consultants' *have* to work with live data, they do so on-site.

    There are no technical difficulties whatsoever, just inconveniences, maybe.

    Wait!

    A far more satisfactory solution now occurs to me. One that will solve very many ills and remove many irritations.

    Ban consultants.

    0 0

  18. This post has been deleted by its author

  19. Paul

    A byproduct of the Digital Age

    Quite frankly I don't think that this really matters any more, on any one individual user of the internet there's a few dozen records scattered across various company's databases, most of which don't have any real security measures on.

    All these thefts mean is that the people on the lists have an increased chance of being targeted, but even that isn't guarenteed because the criminal has to know where to look for you. There's safety in numbers when it comes to things like this...

    0 0
  20. Svein Skogen
    Flame

    Accountability for directors

    Actually, this should be the universal case. Internationally. And there is a long precedence.

    In the navy, a captain is ALWAYS responsible for the conduct of his crew. This translates to:

    A director is ALWAYS responsible for the conduct of his subordinates. Thus, if the screening of consultants/employees is insufficient to stop this kind of idiotic mistakes, THAT MEANS THE DIRECTOR IS RESPONSIBLE. The ENTIRE cost of cleaning up after the mistake should be taken out of that directors PERSONAL account. If the amount in that account does not cover it, go one step up, and empty the next level of directors accounts. If the entire chain of command from the lowest director to the board still does not cover the cost, it's obvious that these people are taking chances that make them unfit for running a company. Basically taking that kind of chances and not being capable of paying for the clean-up should be treated no different than writing bad company cheques, which iirc can land the directors in jail for a good long time.

    And this responsibility is NOT something they can sacrifice the worker that just followed their orders for.

    //Svein

    0 0
  21. Andreas Kuhn

    It's an easy to solve problem

    Get notebooks with hard disks that feature hardware based encryption. They are available today from Seagate and are actively sold by NEC and Dell Computer.

    Thes hard disks feature AES government approved encryption at full interface speed. The user doesn't even notice they have an encrypting hard disk.

    See here: http://www.wave.com

    0 0
  22. Neil Alexander

    Seems like...

    ... losing data is the fashion of this year. ;)

    0 0
  23. Anonymous Coward
    IT Angle

    Encryption is pointless in this scenario...

    ...because the person with the customer data on his laptop would have been a developer. In order to develop new systems using real data as 'test' data would mean the machine would also have the private keys needed to decrypt the data....

    Oh my gawd.

    The only viable legal solution is not to allow personal data out to physically less secure devices or environments for the purpose of application testing. In other words, companies need to create dummy data for the purposes of all development, and re-encrypt this using non-production encryption keys. Give the development shop dummy data!!!!

    When working in e-commerce in Australia, one of the leading e-commerce sites used to routinely send out 'test database' backups containing over 30,000 unencrypted credit card numbers. Managers weren't interested in the risk - billing is all they think about. The end result is that DVDs lie around the office, waiting for the cleaners to take away....

    0 0
  24. Anonymous Coward
    Flame

    Die Hard 5

    Given the amazing lengths, in Die Hard 4.0, that the US Govt went to "back up" the entire US banking system and it's terabytes of financial data - thus requiring no less than the chief architect of the system and the greatest hackers on earth to crack it and extract data from it...

    Do you get the feeling that Die Hard 5, or it's British counterpart may be more of a short 3minute film than 2hour epic?

    Bad guy goes to gym. Bad guy steals laptop from locker. Police are clueless. Nobody gets blamed, nobody looses their job. Bad guy sells data over IRC. Lots of bad guys credit 10,000,000 minutes of Nigerian Telecom calls against investors bank accounts. Credits roll.

    0 0
This topic is closed for new posts.