Comment The delusion of security (Score 1) 126
This may be a hoax; but it is certainly not impossible for this sort of thing to happen.
What governments and businesses need to know/do is:
1) Understand that there is no such thing as ABSOLUTE security - every castle, system, etc can (arguably will) be compromised. The dilemma is whether the cost/effort needed to compromise the system is worth the reward/gain.
2) They should only keep the essential information - don't keep what you don't need. Besides, what they don't store can't be stolen - in the long-run it's cheaper for them and better for the user/customer. Legally speaking, businesses/agencies that store personal/private information is assuming a fiduciary duty to the customer/user - particularly in protecting their data.
3) They should keep the data as atomic/discrete (ie separated) as possible. Instead of housing everything in one mega-database, user information should be kept separate from credentials (passwords), which should be kept separate from banking data, and that should be kept separate from transaction data.
4) All data access should require credentials (certificates and/or passwords) - preferably, the credentials should only provide limited and/or one-time access to the data.
5) Particularly sensitive information should be encrypted within the database, and all access should be logged on a separate system.
6) Credentials and certificates should NEVER be stored on the same system they access.
7) They should use randomly generated unique IDs for each segment of the data - preferably, these IDs should be changed on a regular basis (like passwords).
8) Government issued ID numbers should only be used by the government agency that issued the ID, just like bank account or credit card numbers should only be used by the bank that issued them. Employers should NEVER use the employee's SSN, driver's license, bank info, etc as an employee ID.
9) They should ONLY aggregate the data as needed (at transaction time) - if possible, they should even avoid having more than one segment within the same code.
10) They should make an effort (ie spend time & money) to protect user/customer information data - like it was their own.
A) They should have their entire system audited by certified external analysts - I wouldn't be opposed to (random) government audits of corporate data.
B) They should spend more time and money resolving the issues/findings, and then have their systems audited again.
C) They should also regularly update the system. Over time, the cost/effort to overcome any security system decreases while, in most cases, the value (ie gain) increases.
11) If they aren't willing or able to spend the time/money to protect the data, then they should NOT be allowed to store personal data on their systems.
12) If they do store a user's/customer's information, the user/customer should be able to request certified proof that the system was audited - to verify that their information is safe.
13) All parties should utilize up to date encryption, virus/malware, and security technology to secure their and/or the customer's information.
14) No matter how much effort/money is spent, there is no such thing as ABSOLUTE security.
Personally, I believe that what most businesses are doing with customer's data is reprehensible - and should be outlawed. A person's private information is just that, PRIVATE. Outside of storing financial transactions, user's/customer's information shouldn't be kept to do market research/analysis. They certainly should not be able to profit off of the data - that's a violation of their fiduciary duty. If you think of every worker as a little private enterprise and their employer is effectively "the customer", imagine how much information each of us could collect from every "customer" we've had. Then imagine if every worker started analyzing and selling/sharing "trends" with other "private enterprises", or using that information for their personal benefit. How quickly would those businesses go ape-sh!t trying to stop that activity? What if workers stored their "customer's" data on systems without proper security? Didn't some politico recently state that corporations are people? Wouldn't the corollary then be that people are corporations - with the same rights and privileges?