Dumpster diving for data
October 15, 2009 by Sam NarisiPosted in: In this week's e-newsletter, Information security, Latest News & Views
We all worry about cyber-thieves breaking into databases and stealing confidential information. But there’s a more low-tech approach to theft companies need to look out for.
It takes very clever systems management and a big investment in time and money to defeat the most determined hackers. But any idiot can do a little dumpster diving to find paper documents left intact by careless employees.
“It is a mistake we made.” That’s the explanation a manager from Flagler County (Florida) gave when it was discovered that large quantities of names, Social Security numbers and driver’s license information were sitting unprotected in the county’s dumpster.
Employees were told to destroy 10 years’ worth of old data, but managed to shred just one of 16 boxes. The rest was just sitting in the dumpster.
Luckily for the county’s residents, a local retiree was poking around in the dumpster for unexplained reasons and found the vulnerable data He contacted police and local media. Embarrassed county officials ‘verbally reprimanded” the careless employees and promised to destroy the documents.
All this happens as Florida counties are under a state mandate to remove or secure sensitive data. According to an article in the News-Journal of Daytona Beach:
“Amended state law requiring all county court clerks to remove sensitive information electronically by January 2011 pits record custodians statewide in a race against time to vet millions of documents, some dating to 1917.” It involves mass redaction — that’s a major headache for cash-strapped counties.
Document security needs a two-pronged approach – for both paper documents and digital ones. On the paper side, it’s a matter of training and follow-up. The county had the shredder and the policy, but the employees didn’t follow up. On the digital side, you should be actively checking that crucial data is not casually accessible without authentication. For companies and agencies where website grew without much planning, there may be more data exposed than you realize.
FinanceTechNews.com delivers the latest Finance news once a week to the inboxes of over 150,000 Finance professionals.
Click here to sign up and start your FREE subscription to FinanceTechNews!
