USPS: The Exposure

November 26, 2018 by Marc Handelman in USPI, USPS, Information Sciences, Data Loss Prevention

Where - exactly - was the United States Postal Inspection Service - the sworn law-enforcement (with arrest powers) investigatory component of the United States Postal Service in this? It took the quasi-governmental USPS over a year to catch this flaw? Astounding Incompetence.

"A report published in October found that the IV systems suffered from some misconfiguration problems, but none of them referred to adding access controls for reading user data, which is a baseline in information security." via Ionut Ilascu, writing in his outstanding news post at Bleeping Computer.

The Fifty Million of Cambridge Analytica →

March 20, 2018 by Marc Handelman in Data Mining, Data Science, Data Loss Prevention, Data Sciences, Data That Wants To Be Big, Information Security, Illicit Behavior, Data Theft, Election Manipulation

via Graham Cluley, writing at Graham Cluley.com comes an outstanding piece targeting the naughty boys and girls at Cambridge Analytica and (owned by both parent company Strategic Communication Laboratories (SCL - a private company officed at London, UK and the Family of Robert Mercer, an American hedge fund manager with offices domiciled in Washington DC, London, UK and New York, NY) detailing the move to ban the organizations utilization of Facebook, Inc. (NYSE: FB) data.

All this because of a measely 50 Million Facebook User records still held by Cambridge Analytica. As the data is really yours, perhaps you should know, eh? Of course, as stewards of your user data, Facebook, Inc. is truly responsible for any misuse thereof, right?

'Hot on the heels of banning the Britain First group from its network, Facebook has announced it has suspended political data analytics firm Cambridge Analytica, and its parent company Strategic Communication Laboratories (SCL).' - via Graham Cluley, writing at Graham Cluley.com

And then there's this...

The Banning →

October 12, 2017 by Marc Handelman in Data Leakage, Data Loss Prevention, Information Security, Mobile Security, Mobile Networks, Mobile Telephony

Behold, the top banned (i.e., blacklisted by the Enterprise) iOS and Android mobile applications with data generated by Appthority.

'According to Appthority’s proprietary Mobile Threat Risk Score, Uber, WhatsApp Messenger and Facebook Messenger are the riskiest Android apps commonly found in enterprise environments. The riskiest iOS apps found in enterprises are Facebook, Pandora and Yelp.' - via Helpnet Security

Macie the Discoverer →

August 21, 2017 by Marc Handelman in All is Information, Automation, DBMS Security, Database Security, Data Security, Data That Is Big, Data Loss Prevention, Data Driven Security, Information Security, Security Inventions, Security Architecture, Security Automation, Data Discovery

News that Macie The Discoverer has arrived in your S3 bucket... Data Security Automation - potentially - at it's finest? You be the judge.

Les Fuites de Données Rapport de la Journée →

September 10, 2015 by Marc Handelman in All is Information, Data Driven Security, Data Loss Prevention, Leakage, Information Security

aka Data Leakage Report of the Day...

John Leyden, writing at El Reg, scribes a stupefyingly scary report, detailing misconfigurations in application deployment and implementation of so-called Big Data systems which are leaking vast amounts (reports of a petabyte are floating about) of data.

BSidesCincy 2015, The Value of a Simple DLP Program →

August 06, 2015 by Marc Handelman in All is Information, Data Loss Prevention, Data Security, Data Classification, Data Driven Security, Database Security, Information Security

DLP Security Bake-Off →

March 19, 2015 by Marc Handelman in All is Information, Data Loss Prevention, Information Security

Uber's Private DB Key On Public GitHub Page →

March 04, 2015 by Marc Handelman in All is Information, Blatant Stupidity, Information Security, Governance, GRC, Encryption, Database Security, Data Security, Data Loss Prevention

Meanwhile, in Blatant Stupidity news, ArsTechnica's Dan Goodin writes of the latest Uber mistep. This time, Uber decided to store an encrypted database's PRIVATE KEY (anecdotally, the DB contained sensitive data for at least fifty thousand of the company's drivers) on a GitHub public page. Apparently, there may have been a wee bit of confusion as to what a PRIVATE KEY is, in relation to a PUBLIC KEY within Uber's apaprently crack IT department... Oops.

I Hunt SysAdmins

February 13, 2015 by Marc Handelman in All is Information, Compute Infrastructure, Data Security, Data Loss Prevention, Enterprise Management, Information Security

This Shmoocon presentation by Will Schroeder is a classic. Today's' MustSee security video.

NIST Releases First Revision for Media Sanitization Guidelines

February 06, 2015 by Marc Handelman in All is Information, Data Loss Prevention, Data Security, Hardware Security, Information Security, Forensics

News, via Pat O'Reilly of the National Institute of Standards and Technology Computer Security Division [NIST CSRC]; in which, the good Mr. O'Reilly notifies us of the release of NIST Special Publication 800-88 Revision 1, Guidelines for Media Sanitization. MYou can also view and download any previous NIST ITL [Security] bulletins, and their associated documentation and special publications at the NIST Computer Security Divisions' Computer Security Resource Center.

Government of Canada, Data From Canada Mandated To Remain In Canada →

February 02, 2015 by Marc Handelman in All is Information, Common Sense, Commerce, Compute Infrastructure, Data Loss Prevention, Cryptography, Database Security, Data Security, Encryption, Enterprise Management, Government, Information Security, Security Governance, Canada

Dr. Michael Geist (Law Professor at the University of Ottawa, and the current holder of the Canada Research Chair in Internet and E-commerce Law) holds forth on current cloud cogitation up north (at least within the data confines of the Government of Canada / Gouvernement du Canada).

Patently Fascinating, New DLP Invention

November 14, 2014 by Marc Handelman in All is Information, Information Security, Data Loss Prevention, Security Inventions

Meanwhile, in security related patent news, Hitachi Ltd (6501:Tokyo) assignees Susumu Serita and Yasuhiro Fujii both of Tokyo, Japan, have filed newly developed documents detailing their respective invention. In this case, a data loss prevention device and method that may very well change the landscape, as it were.