, 2006-02-20
A recent case involving a stolen laptop containing 550,000 people's full credit information sheds new night on what "reasonable" protections a company must make to secure its customer data - and what customers need to prove in order to sue for damages.
Expand all |
Post comment
Strict liability for data breaches?
2006-02-21
Adam (1 replies)
Adam (1 replies)
Strict liability for data breaches?
2006-02-21
Stephen T (1 replies)
Stephen T (1 replies)
Strict liability for data breaches?
2006-02-23
Anonymous (2 replies)
Anonymous (2 replies)
Re: Strict liability for data breaches?
2006-02-23
Anonymous (1 replies)
Anonymous (1 replies)
If it's encrypted and stored on a laptop, isn't it likely that the decryption mechanism is also on the laptop?
The key and data must be separated for encryption to be useful. Ideally this would be the case, but I see requirements all the time to encrypt data stored in databases, when the password to decrypt it is in a software configuration file on the server.
This is a ridiculous waste of cycles since the server admin has the keys to all the boxes, and a hacker that comprimises a front end server can simply do a database dump using the client on the server.
-Neil
[ reply ]
Link to this comment: http://www.securityfocus.com/comments/columns/387/33168#33168