We're terrified of sharing information, but the benefits of talking about IT and infosec outweigh the negatives

When something bad happens to our systems, our applications or our security, it's almost certain that our organisation is not the first it has happened to. We won't be the first in the world, or in our industry, or in our country, or probably even in our area. Why, then, does it feel like we are? The answer is simple: the …

[Anonymous Coward]

Um.....Did Anyone Mention Edward Snowden???? ....Or Peter Thiel??

@Dave_Cartwright

Link (1999): https://www.wired.com/1999/01/sun-on-privacy-get-over-it/

Link (2018): https://www.bloomberg.com/features/2018-palantir-peter-thiel/

Sorry Dave, but it's absolutely NOT about the people you VOLUNTARILY share information with...........................

...................it's about all the other snoops who are listening (and sharing)......and who you know NOTHING about!!!

GDPR is (still) a joke!!!!

[Eclectic Man]

The sanctity of the confessional

There is an issue here about sharing information when an offence has been committed, or might have been committed, for example by negligence. Many are the articles and comments on the Register describing when stingy management has decided to 'save' money by not providing a fully operational back up system, power supply or to train staff properly or even just have proper rehearsals, and when something went wrong, they were unable to cope. This despite their internal regulations requiring them to provide standby systems and test them and ISO 27001 'compliance'.

One major comms company effectively cut off a city for a day because when something failed in a big way, the mandatory back up system simply had not been built, almost certainly in order to save money at the time, and get the (ir)responsible manager some 'brownie points' and a bonus / promotion.

I cannot see large companies publicly quoted on the stock exchange ever giving their technical people the authority to describe in any detail the technical issues around GDPR failures, contractual 'five nines' failures, or any breach of government security regulations when the actual cause was saving money on a deal. Let's face it, if your idiot programme manager decides to close down the contractually required secure support desk in a secure building and move it to a commercial, shared service support team to save some money*, are they really going to own up? Similarly the programme manager who decides to offshore the technical IT support team for a secure government system which is specifically required to be operated by cleared staff, 'because it is cheaper and we won't make a profit on the deal otherwise' will not be happy at even Chatham House Rules disclosures.

OK, so the article was about people not being egregiously stupid, but management tends to regard things going wrong as a risk assessment exercise - 'how likely is it that I will be around and cop the blame if or when the shit hits the fan? A classic example is that senior management of large corporations typically spend 5 years of less at any one company (see, e.g. the length of service of BT CEOs over the last 20 years).

Priests may be bound by the sanctity of the confessional, but they tend also to dole out punishments or requirements to change behaviours and require repentance, and we have all seen from the RC church's** record on dealing with child abuse by priests how that works out.

Sorry folks, the solution, as far as I know it, is to spend the money required to to do the job properly and not cut corners, but that tends to be out of technical people's hands. And we all know that management types dislike being informed of the facts of life by technical underlings.

*Yup that really happened, probably more than once (my lips are sealed).

**Other religious and public institutions are equally culpable if the press are anything to go by (The BBC, CoE, Rotherham, Canada's indigenous 'schools' etc.).

[Anonymous Coward]

Rational....and misses the point entirely!

@Eclectic_Man

Quote: "...describe in any detail the technical issues around GDPR failures...."

Supremely rational.......and completely missing the point!!! For example, take the Equifax hack. Who stole millions of credit records? Were the stolen records sold on? If yes, who has copies of those records today?

In this (and many other similar examples), GDPR has ABSOLUTELY NOTHING OF VALUE TO CONTRIBUTE!

And the specific individuals whose PII was stolen have NO IDEA where their records are held today.

Tell me again about GDPR! Tell me again how it is supposed to "protect my data"!

[Anonymous Coward]

Re: Rational....and misses the point entirely!

I didn't think it was to protect your data --- I thought it was mostly the EU taking another pop at Google.

[big_D]

Re: Rational....and misses the point entirely!

Given the number of large fines handed out to local (EU) companies, compared to the number Google & Co. have received, I would say that US Big Tech still gets off relatively lightly.

Given the number of companies and government departments that receive fines or sanctions, US Big Tech just grabs the big headlines.

This is usually because the smaller companies can't afford the fines or the bad publicity, so they cooperate with the regional or national DPOs to remedy the situation and tighten up their practices. If they cooperate and are contrite, the fines are smaller. US Big Tech tends to try and bluster it out and therefore make more press than those that comply and, because they don't cooperate, but try and lawyer their way out of the situation, they end up with bigger, headline grabbing fines.

[Anonymous Coward]

Re: Rational....and misses the point entirely!

> "In this (and many other similar examples), GDPR has ABSOLUTELY NOTHING OF VALUE TO CONTRIBUTE!

> And the specific individuals whose PII was stolen have NO IDEA where their records are held today.

> Tell me again about GDPR! Tell me again how it is supposed to "protect my data"!"

First off please don't use the term PII in conjunction with GDPR - PII is an American term that is a subset of "Personal Data" which GDPR in intended to protect (PII doesn't include things like your IP address etc).

GDPR is supposed to protect your data (assuming you're in areas covered by it, i.e. EU, Iceland, Lichtenstein, Norway, and UK). However that protection requires at least adequate enforcement and *that* is the ongoing problem - many of the regulators in countries like Ireland and UK are largely ineffective at enforcing GDPR. The EU has the ability to take action against each of those countries' regulators (excluding UK as, with Brexit, the UK now is covered by UK GDPR, not EU GDPR) but unfortunately have not done so yet.

As it's therefore a lottery whether any organisation breaching GDPR will be investigated and have any substantial action taken against them the vast majority of organisations carry on more as less as they did before GDPR knowing its unlikely they'll "win" the GDPR investigation lottery.

For example I have been trying to get something done about multiple regional health organisations who have been breaking data protection law (both GDPR and the preceding UK DPA 1998) multiple times per day for *10 years* and are still continuing to do so. The ICO has a 4+ month backlog to look at any complaint and in my case almost 6 months after submitting the case whilst it has finally been assigned to a Case Officer he has has not yet found the time to start reading the submitted documents let alone decide what, if any, action to take...

[Missing Semicolon]

Re: Rational....and misses the point entirely!

If it's about the "business as usual" at Health Trusts, you can bet that the Case Officer has a special deep in-tray, in another building, especially for those.

The big failure (I do wonder if this was deliberate) is that liability is purely corporate. perhaps there was a naive assumption that a company dinged with a GDPR fine would fire those responsible. In practice, medium-to-large companies just circle the wagons. Only with personal liability would things really change.

[big_D]

Re: Rational....and misses the point entirely!

It is supposed to get companies to take data protection seriously and to put in place security and procedures to ensure the data is safe. If they don't comply, they will face heavy fines, which are more expensive than doing things right in the first place.

It also ensures that all those affected by a data breach are informed in a timely manner.

At the companies I've worked for, it has generally worked well.

[elsergiovolador]

Re: The sanctity of the confessional

team to save some money*

Is that an euphemism for increasing disguised profit?

Any "saving" must be followed by generating fake cost, otherwise there will be corporation tax due.

I wonder if this creates a death spiral, where a manager is unaware of tax avoidance and he or she is asked to cut real costs - they do it, only to find out later the company has not "saved" anything.

They also get another excuse why they won't get a raise and at the same time they see CEOs photos boasting about his new collection of sports cars.

[Doctor Syntax]

Re: The sanctity of the confessional

The solution to this, as in the aviation industry* is a statutory inspectorate. It would need powers and resources for pre-emptive inspection and prosecution.

Unfortunately we have a govt. that keeps bleating about being the best in the world for whatever issue drifts across their minds on the day but usually mean by that an absence of "red tape" when, in fact, the said red tape holding in place the security of the supply chain would actually be more beneficial.

* Withou Boeing-style self-certification.

[Anonymous Coward]

Re: The sanctity of the confessional

At one company I worked for, there was a breach of the Exchange server and it started trying to send out crypto malware to other PCs and servers on the network.

It brought the server to its knees, but, luckily, the AV software caught the malware being sent to the other PCs and flagged up a warning.

The DPO was on the phone straight away, wanting to know if data had been exposed and trying to assess, whether they had to report it to the state DP authorities.

This is one of the reasons why the DPO position, in some countries, is a privileged position, they don't work for management and they cannot be fired whilst they are in the role. If they find internal problems with DP, they report it to management and give them a deadline to deal with the problem. If there is a breach, they have to report it and management can't stop them or carry out reprisals.

[Anonymous Coward]

Special events for this

While on holiday in an entrepreneur-laden capital of a small country, I saw a poster advertising events run by "fuckupnights.com", specifically for people to share "what I wish I hadn't done in my startup". Not a plug for them; I've never been to their events and don't know what they're like, although I suspect they're full of humblebragging, and apparently in that country they got commandeered for self-publicity by the Minister for Taking Credit for Other People's Projects (or Minister for Trade and Industry as I believe the official translation of her title was).

[Stork]

Perhaps learn from the chemical industry

For decades, major players in the chemical industry shared what they learned from accidents and near misses in order for the whole industry to improve (and to be allowed to continue operating). I knew one of the engineers taking part of this at BASF, they had the full support of management.

Of course chemical industry is much more concentrated, more mature and has more headline-grappling accidents (Flixborough, Bhopal, even BASF Antwerp 1989), but perhaps something could be learned.

[big_D]

GDPR

If the event exposes personal information or someone has infliltrated the network, in Europe, you have 72 hours to report it to the relevant authorities, otherwise you face fines for non-compliance.

[Anonymous Coward]

Commentards seem to miss the point..............

...............so......when my PII is stolen, the organisation which has been hacked needs to 'fess up in a timely manner.

Big deal..........my PII is now in SOMEONE ELSE'S hands.......potentially being used for unknown purposes......sold on to who-knows-who...........

......and GDPR has NOTHING AT ALL to say about the new "data owners"...........

What am I missing here? Sure, the stable door is open.....sure the horse is long gone..... But the real sh*t is handed out to private citizens (you know...the customers) who have to deal with impersonation, theft, credit fraud......

So.....GDPR is (still) a joke.....explain where I've got this wrong!

[SCP]

Re: Commentards seem to miss the point..............

That viewpoint could be applied to any law - the presence of the law and punishment under the law cannot undo the crime and all of its consequences. The law itself will not prevent the crime.

IT security is challenging; even when people are trying to do it right - that is a problem.

Security is also a trade-off between protection and utility - that is a problem.

Others have commented that the enforcement of GDPR [by an overburdened/under resourced ICO] is lacking - that is a problem.

The law might have its problems - but it is never going to be the total solution.

[Richard 12]

Re: Commentards seem to miss the point..............

When a company kills your partner via an obviously unsafe working practice, prosecution doesn't restore them to life either.

Laws cannot ever un-do an event, they aren't time travel machines.

Safety equipment and safe methods of work aren't free, so companies do the minimum they think they can get away with. Making the cost of not doing something too high is basically the only way a government can force a corporation to do it.

The theory is that GDPR should make it too expensive for companies to collect unnecessary data or to ignore properly securing it.

In practice, it seems only Luxembourg and Germany are bothering to enforce GDPR. That's the actual problem.