Why the OPM Breach is such a Security and Privacy Debacle
http://www.wired.com/2015/06/opm-breach-security-privacy-debacle/
It turns out the hackers, who are believed to be from China,
also accessed so-called SF-86 forms, documents used for
conducting background checks for worker security clearances. The
forms can contain a wealth of sensitive data not only about
workers seeking security clearance, but also about their
friends, spouses and other family members. They can also include
potentially sensitive information about the applicant's
interactions with foreign nationals--information that could be
used against those nationals in their own country ... The OPM
had no IT security staff until 2013, and it showed. The agency
was harshly criticized for its lax security in an inspector
general's report released last November that cited its lack of
encryption and the agency's failure to track its equipment.
Investigators found that the OPM failed to maintain an inventory
list of all of its servers and databases and didn't even know
all the systems that were connected to its networks. The agency
also failed to use multi-factor authentication for workers
accessing the systems remotely from home or on the road.
- - -
In many states, a corporation that operated this way could be facing
criminal charges and enormous penalties.
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
