Comments on: Stolen Laptop Exposes Personal Data on 207,000 Army Reservists

By: Jahongir

Jahongir — Thu, 02 Dec 2010 12:16:05 +0000

It seems, the government agency responsible for protecting the whole country is incapable of protecting a single laptop computer. If everything goes this lax, the US is doomed !

Like or Dislike: 0 0

By: Bridget77

Bridget77 — Wed, 03 Nov 2010 20:59:29 +0000

I feel really bad for those 207,000 Army Reservists. I hope the governement pays for them to have identity theft protection. This is exactly why I use Lifelock. I LOVE them! This is my biggest fear, my company losing my personal data. You guys should check them out, if you don’t have ID protection.
http://www.lifelock.com/landing/real/safe .

Like or Dislike: 0 1

By: Max

Max — Tue, 06 Jul 2010 16:28:17 +0000

I agree. Having served in the active world I ponder why the reservists & guard are just letting sensitive data go about without any protection. I know my unit was very big on OPSEC (operational security) & we never stored any sensitive data on personal HDD’s. It was always kept on issued thumb drives that were encrypted & this was in a “dumb grunt” infantry unit. If some how the enemy were able to get their hands on an officer’s laptop all they’d get were games & maybe after some poking around his hidden porn collection. No maps, no mission details, nothing of any strategic value in the grand scheme of things. If we’re going to be hiring contractors & entrusting them with sensitive data they’d better be following OPSEC. If any violations of this magnitude occur they had better be followed with instant contract termination. The potential cost in lives far outweigh the costs of hiring a new contractor to start from scratch.

Like or Dislike: 0 0

By: Asset Recovery

Asset Recovery — Fri, 02 Jul 2010 07:13:57 +0000

It’s a matter of conern that the army didn’t take the matter seriously enough to have current policies that might have been useful in preventing it in this case. The best way is to have IS audit and control done on the whole system.

Like or Dislike: 1 0

By: Dorothy

Dorothy — Wed, 09 Jun 2010 13:31:49 +0000

That was so terrible.But i wish the data was backed up some where for a company like that at least it should have backups online for security reasons.Well my company has got its backups online with (SafeCopy) online backup.This online backup system is good because their prices are so effecitive because for 200GB of space,one only pays 50bucks a year and the company now backups up more than 2computers on one account and am so happy that safecopy has upgraded its free unlimited 3GB trial to 5GB this is so cool.

Like or Dislike: 0 0

By: Steve

Steve — Fri, 28 May 2010 22:59:23 +0000

@Jane, yep, been there done that. It takes work, time and effort and money. Not as easy as just downloading Truecrypt, which was the OP suggestion to which I responded with “it ain’t that easy”. You validated my point by introducing the requirement for corporate infrastructure and/or policy for key mgmt etc.
It is doable but not easy to do right, hence will be done reluctantly if at all. Far as I know the bank has made little progress on their implementation since I left, not much when I was there and pushing it.

Like or Dislike: 0 0

By: DS

DS — Sun, 16 May 2010 12:49:30 +0000

A little bit of over thinking here, don’t ya think? At min. the data should have been encrypted, period. Serco is now a headline. Whats the cost there Infosec Pro?? How much time is Serco going to spend making it right? Sufficient encryption is a legal safeharbor, a best practice, and an industry norm today. No brainer. This is a silly debate.

Well-loved. Like or Dislike: 8 0

By: BuddhaChu

BuddhaChu — Sun, 16 May 2010 01:06:28 +0000

Correct. That DoD policy is derived from a Presidential memo from 2006 that applies to all federal agencies.

http://www.whitehouse.gov/omb/memoranda/fy2006/m06-16.pdf

Like or Dislike: 1 0

By: AlphaCentauri

AlphaCentauri — Sat, 15 May 2010 04:49:32 +0000

I’ve been notified a number of times that my data has been on a stolen laptop. In some cases, it’s not even clear how the organization in question even got my data in the first place, as I hadn’t ever deal with them directly. So there’s a lot of data sharing even without there being any theft or loss. And short of changing my social security number, I can’t ever assume my data is private again.

Besides, every employer you’ve ever worked for has your data. (After all, that’s the only thing social security numbers were ever intended for.) You have no control over the employees they subsequently hire to manage it.

Given that there is a huge percentage of the population whose personal data is already at large, why do we act as if it’s still an aberration? Just assume everyone’s information is already fully public. Stop treating a social security number like a signature. No one should be able to take out a credit card in my name just because they know my social security number. And no institution should be allowed to lower my credit score or raise my interest rates, just because I choose to put a “fraud alert” on my accounts to prevent unauthorized use of my data.

Like or Dislike: 3 0

By: AlphaCentauri

AlphaCentauri — Sat, 15 May 2010 04:41:08 +0000

The monitoring programs to help you locate a stolen laptop might be practical for individual owners. But do you want to take home a laptop knowing your employer has the ability to see where you are and even take photographs of you while you are there? There is currently a brouhaha at a wealthy school district in the Philadelphia area where no one remembered to shut off the software after missing school-issued laptops were recovered, so the students given those computers were being photographed at home in their bedrooms every 15 minutes, day and night, for weeks.

Like or Dislike: 0 0