Community archive

Ask something
Discussion Locked

Non-standard disasters

0 helpful
8 replies

by editor's response

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Tell us what you think about Mike Talon's advice about handling a non-standard disaster, such as the theft of your CEO's sensitive e-mails, as featured in the Feb. 25 Disaster Recovery e-newsletter. Does your organization have policies and procedures in place to prevent the leakage of critical e-mail information? Let us know if this information useful to you.

8 replies

by rupertfuller

According to our security admin here:
"Under EU law, a person's e-mails are private.
This would be the telephone-equivalent tapping & recording."
Admittedly the info in the e-mails could be leaked but it would be illegal to use or publish the information.

by draco vulgaris

Since last week's discussion on this topic seems to have disappeared, I'll reiterate; How did this guy get in here?

If we don't have locks on our doors, why not? If we don't have a security guard, a recptionist, or both who should not be lettingstrangers into the building, why not?

Mike, is this supposed to have been an "inside job"? I can't think of any other reason that you should have been able to get into the building to present your demands at a staff meeting.

If anybody can just walk in off the street, we have problems more serious than the security of our E-mail!!!

by miketalonnyc

At least not for the theft. A skilled cracker could have stolen the e-mail data wihtout ever having set foot in your establishment.

As for getting in to deliver the news, well, it's amzingly easy to enter most office buildings, if you work out the plan ahead of time.

Mike Talon

by draco vulgaris

Mike, this guy not only got into the building, and our offices, but he also knew where and when to find the "high level staff meeting" to which he presented his demands.

This says, to me, that our security is as full of holes as a swiss cheese! It's not just our E-mail, it's our physical security, and people who will tell a stranger where to find "the small conference room" without inquiring what a stranger is doing in the building unescorted. If our company really cares about security, why aren't we using Photo-ID badges and visitor badges.

Maybe I'm in the wrong business; I could sure use a fast $2,000,000!!!!!!

by bizcon

Dear Sir/Ms.,

The article/news letter made good educative reading. We think that the emails should be password protected to avoid breaches. We have system of limiting the users who can directly access the internet and its traffic. Only the head of computer section in our bank sends business and tech related mails and we do not allow our staff to use bank platform for their personal communication. However, we permit them to use their individual email IDs. In this also it is noted that the higher ups also indulge in sending their emails from our desktop computers.

This is a menace which bothers us. At the worst scenario, only one person must be vigilant to monitor the use of internet by installing a spy software to get the messages exchanged. In some organisations they have declared this and the use of internet has drastically been reduced.

I want more feed back on use of internet by staff during working hours at the organisation.

Regards.

Sharad C. Kapadia

by ratherbfishing

I monitor all of upper managements email, and if I discover they are about to destroy my pension, I leak it to the press.

Seriously though (that was kind of serious!) an insider job would be tough to stop.

by miketalonnyc

My accounting professor had a great saying:

"Collusion can overcome any protection"

Well, that counts here as well. Inside jobs are extremely hard to counter, which is why I didn't ask people to address how it happened, just what they would do to overcome the resulting disaster.

Mike Talon

by dinotech

Policies and procedures must be followed by the person it pertains to. The only way to secure any data is to limit the access to that data. PGP or other encryption technologies are the best way to keep data secure.
Monitoring is useful if you have the software or personnel to do it.
Another common mistake is user rights: somehow netadmins get really busy and forget to remove a user's right and it gets exploited.

So how would I deal with an espionage disaster? Well, first I would shut down the persons net access, second I would have a conversation with that person - if the person was willing - to discuss the nature of the data he is holding. Third, I would purchase the data from him if it was destructive to the company and legal action wasn't readily available. Note: if the data implicated the company in a legal or moral issue, I would work with the individual to see that the information would get to the proper authorities. What the main purpose here is: save the data, we can always generate cash flow. If the data leaks and is damaging, hold a press conference and apologize for any wrong doing, then take the matter to the board (hoping that it wasn't the board's mistake). Be responsible and accountable.

This discussion is closed to new replies.