The Auditor Attack Vector

Question

The Auditor Attack Vector

Viewing 7 posts - 16 through 21 (of 21 total)

You must be logged in to reply to this topic. Login to reply

Gary Varga SSC Guru Points: 82166 More actions · Answer 1

hakim.ali (12/1/2015)
...I once stumbled upon a spreadsheet on the network with compensation information on it...

Once worked at a place were costings for individuals was left on a printer in a general area where the people on the report sat. Salaries he costings. It caused mayhem.

Gaz

-- Stop your grinnin' and drop your linen...they're everywhere!!!

giles.middleton Valued Member Points: 57 More actions · Answer 2

I would say that the Auditors need their data-security policy auditing, but auditing only proves you followed your procedures, not that the procedures were sensible.

g.britton SSChampion Points: 13863 More actions · Answer 3

With a title like that, you've been watching too much "Big Bang Theory"

Gerald Britton, Pluralsight courses

Gary Varga SSC Guru Points: 82166 More actions · Answer 4

g.britton (12/2/2015)
With a title like that, you've been watching too much "Big Bang Theory"

Is that possible?

Gaz

-- Stop your grinnin' and drop your linen...they're everywhere!!!

Eric M Russell SSC Guru Points: 125561 More actions · Answer 5

Here is an interesting read. It's a cautionary tale and a good example of why you need clear requirements, executive signoff, and formal review process before releasing bulk data files.

..After being fired and labeled responsible for releasing personal information of over 6 million Georgia voters, the employee is fighting back saying he never had access to the information that was released..

http://www.govtech.com/security/Georgia-Voter-Data-Release-Gets-Muddier-With-Fired-Employee-Crying-Foul.html

"Do not seek to follow in the footsteps of the wise. Instead, seek what they sought." - Matsuo Basho

david.irvine 7489 Ten Centuries Points: 1290 More actions · Answer 6

My suspicions are raised as soon as I hear 'USB found on the street'. How likely is that? A few years ago there was a rash of stories in the UK press about similar finds of data from different organisations, usually embarrassing to the government, and reported along the lines of: Shock discovery of your data being mishandled by government department! Many of these 'leaks' were reported as being on USB sticks 'found in a pub car park', an unsubtle euphemism for 'exchanged for cash in a pub car park'.

Steve Jones - SSC Editor SSC Guru Points: 736183 More actions · Answer 7

david.irvine 7489 (12/18/2015)
My suspicions are raised as soon as I hear 'USB found on the street'. How likely is that? A few years ago there was a rash of stories in the UK press about similar finds of data from different organisations, usually embarrassing to the government, and reported along the lines of: Shock discovery of your data being mishandled by government department! Many of these 'leaks' were reported as being on USB sticks 'found in a pub car park', an unsubtle euphemism for 'exchanged for cash in a pub car park'.

I asked about that. The auditor did fess up they had lost the USB. I guess they could have sold it, but the situation here didn't seem likely to me. Could be, which is even more distressing.

I think on the off chance of this, I wouldn't employ that auditor again.