It's not just online banking. My bank would print 10m+ statements every month (across transaction accounts, mortgage accounts, credit cards, wealth management etc.). We don't maintain a printing press in the basement. Instead, data (including names/addresses, account numbers, balances etc.) is sent to printing houses. We also don't maintain our own postal system - instead we rely on Australia Post, USPS, Royal Mail etc. to deliver the final product.
All of these are third parties handling sensitive information, in vast quantities, every single day of the month. Yet, no one here seems to be concerned that all of this data is being sent to external parties for handling. Cheers Ken From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Andrew S. Baker Sent: Tuesday, 24 December 2013 12:10 AM To: ntsysadm Subject: Re: [NTSysADM] RE: 40 Million CC breach at Target.... >>That's a pretty fair analogy - and both statements are true. On the other hand, banking is much better understood - experience with banking goes back hundreds of years, with concomitant expertise in many fields in dealing with the risks in banking. The experience around computing is much more shallow, and the risks are not as well known, nor has nearly as much thought and practice gone into mitigating them. Okay, so how about when banking relies upon computing? Which risk profile comes into play, then -- the hundreds of years, or the shallow years/decades? Whether or not YOU use online banking, it is almost assured that your bank provides it and that others are aware of its existence. Do you think that your bank is providing such a service without any reliance upon 3rd parties? Do you think that because you aren't using the online services from your bank that your data would be unimpacted? (Hint: I'm sure that some of the people impacted in the Target breach, as in the TJX breach before it, were *not* online users) ASB http://XeeMe.com/AndrewBaker<http://xeeme.com/AndrewBaker> Providing Virtual CIO Services (IT Operations & Information Security) for the SMB market... On Sun, Dec 22, 2013 at 10:31 PM, Kurt Buff <kurt.b...@gmail.com<mailto:kurt.b...@gmail.com>> wrote: On Sun, Dec 22, 2013 at 6:59 PM, Andrew S. Baker <asbz...@gmail.com<mailto:asbz...@gmail.com>> wrote: >>>Amazon's cloud is external to its customers - Amazon's staff, > procedures and infrastructure are a risk to its customers. > > That's as illogical a statement as the following: > XYZ Bank's technology infrastructure is external to its customers - XYZ > Bank's staff, procedures and infrastructure are a risk to its customers... That's a pretty fair analogy - and both statements are true. On the other hand, banking is much better understood - experience with banking goes back hundreds of years, with concomitant expertise in many fields in dealing with the risks in banking. The experience around computing is much more shallow, and the risks are not as well known, nor has nearly as much thought and practice gone into mitigating them. >>>Except when suborned or perverted by money, patriotism or blackmail: > http://www.reuters.com/article/2013/12/20/us-usa-security-rsa-idUSBRE9BJ1C220131220 > > And how does you maintaining your infrastructure on-premises, but having to > rely on 3rd party telecommunications mitigate the above risk in any way? It's not just that specific incident - that's but one example, and in this specific instance, there was no remedy - trusted parties were subverted, and the same can happen in other fields. I'm not arguing for perfection here - just a recognition that complexity brings risk, and that keeping things simple and under more control is usually wise. Indeed, for some businesses, especially small ones with no IT staff, or very limited IT staff, going with a public cloud might make sense. But if a business has good IT staff, I'd venture that migrating most or all of their infrastructure to a public cloud isn't their best bet. Kurt
