And about bloody time too.

[Board Game Geek]

security breeches

I think you will find that these are more "security breeches".

I take it you mean "breaches" ?

[ratewhore]

Do you work there?

I don't need to work there. This is what I do for a living and I've worked in enough places, both public and private sector, to know there are next to none of them that adhere to the rules rigidly.

Yes there are plenty of rules, unfortunately, as DaveB has already pointed out, they're not followed. And the fact remains that PA did not adhere to them either...

[Unicorn]

Stick Audits

AIUI The data was provided to PA by the Home Office on the data stick. This was apparently in line with the contract on the basis that PA would then look after it properly. Presumably the HO then asked for it back, at which point someone shat themselves.

Quote from article
Our investigation has demonstrated that while the information was transmitted in an appropriately secure way to PA Consulting and fed to a secure site, it was subsequently downloaded on to an insecure data stick and that data stick was then lost.

Not the same stick so presumably there must be some audit somewhere to show the data was downloaded onto the unauthorised stick.

[Moose423956]

erm, bollocks!! Sorry, but it is...

Do you work there?

[ratewhore]

That was my friend's point, the controls over sensitive data are very strict, and they are adhered to rigidly.

erm, bollocks!! Sorry, but it is...

[DaveB]

I am not a user of these stick thingys, so sorry if this is a silly question.

But ....

How do they know that this copy existed in the first place apart from someone saying "I copied so-and-so to a stick and now I can't find it"?

What is to stop someone creating a new copy and they saying "it's all right, I've found it now"?

AIUI The data was provided to PA by the Home Office on the data stick. This was apparently in line with the contract on the basis that PA would then look after it properly. Presumably the HO then asked for it back, at which point someone shat themselves.

[HairyArsedBloke]

I am not a user of these stick thingys, so sorry if this is a silly question.

But ....

How do they know that this copy existed in the first place apart from someone saying "I copied so-and-so to a stick and now I can't find it"?

What is to stop someone creating a new copy and they saying "it's all right, I've found it now"?

[DaveB]

That was my friend's point, the controls over sensitive data are very strict, and they are adhered to rigidly.

I'd still apply Hanlons' Razor.

Never attribute to malice, that which can be adequately explained by stupidity.

[Moose423956]

It's not difficult at all. From the article the USB stick was left in an unlocked drawer in an unsecured office. Chances are it was pilfered by an opportunist.

If this is correct it points to either a complete lack of control over sensitive information, a blatant disregard for any controls that do exist or a catatstrophic failure to implement those controls correctly.

That was my friend's point, the controls over sensitive data are very strict, and they are adhered to rigidly.

[DaveB]

I was talking to a friend of mine who used to work for PA, and he said it would be incredibly difficult to lose data in this way unless someone wanted to do it deliberately.

And thinking of the other instances, it appears to be either unbelieveable carelessness and stupidity, or maybe done deliberately to cause embarrassment to said organisation and the government in particular.

So, could it be a conspiracy?

It's not difficult at all. From the article the USB stick was left in an unlocked drawer in an unsecured office. Chances are it was pilfered by an opportunist.

If this is correct it points to either a complete lack of control over sensitive information, a blatant disregard for any controls that do exist or a catatstrophic failure to implement those controls correctly.

[BrilloPad]

Who by?

I think the only people who can sue are the people who are damaged, how do they prove that damage was caused?

Hopefully there will be no damage caused. But there is potential. I appreciate as the law stands there is little hope of damages being awarded for potential loss. Some may consider the loss of contract damaging enough.

[Moose423956]

I was talking to a friend of mine who used to work for PA, and he said it would be incredibly difficult to lose data in this way unless someone wanted to do it deliberately.

And thinking of the other instances, it appears to be either unbelieveable carelessness and stupidity, or maybe done deliberately to cause embarrassment to said organisation and the government in particular.

So, could it be a conspiracy?

[KathyWoolfe]

I hope they get sued for damages.

Who by?

I think the only people who can sue are the people who are damaged, how do they prove that damage was caused?

[BrilloPad]

PA Consulting contract axed after data loss

Hopefully people will start to realise that these kinds of security breeches have consequences and start to treat information security seriously.

I hope they get sued for damages.

[DaveB]

PA Consulting contract axed after data loss

Hopefully people will start to realise that these kinds of security breeches have consequences and start to treat information security seriously.