The Oracle Australia and New Zealand Middleware and Technology Blog.

Friday, August 29, 2008

Can IT beat the clumsy human pt1


One of the greatest challenges is securing data, especially for some reason data that contains information on people. It’s almost like personal data morphs into the people it represents and wants to break free of the constraints placed upon it within the database and applications. When you look at how many ways data can escape these constraints you often wonder is it possible to protect from humans from assisting in data breaches.

So let’s have a quick look at what can go wrong;

“Export” could be the greatest contributor to data breaches ever. How many people use this luxurious command to get data into excel so they can massage it with pivot tables. Now the clumsy human is a simple being so files are often labelled like “first half year forecasts” or “details of registered guests”. Once this data is exported from the confines of a structured data store and let loose in the unstructured world there is little that can be done.

“WEB2.0” have you noticed how easy it is these days to share files across the internet via social network sites, cloud computing, software as a service, online storage, instant message ect. Indeed except for twitter almost every other WEB2.0 technology is a haven for moving data. For the clumsy human it’s all too easy to store data somewhere in the cloud for convenience and backup assurance.

“eBay” unfortunately shows these clumsy humans like nothing else. Only last week it was revealed a poor and i suspect now unemployed individual sold a work PC via ebay that contained private customer data. Regardless what process’s are in place the clumsy human needs to follow them. Do we insist all devices with a hard disk be destroyed via some huge cheese grater when decommissioned? – Probably.

“Smartphones” are again a great leveller when it comes to corporate security. Almost everyone has a phone with at least 256MB of RAM. This amount of RAM seems small these days, but 100MB can store several volumes of an encyclopaedia. Or 1000’s of contact details. With email synchronisation being more common now, again the clumsy human doesn’t have a chance.

See part 2 of the clumsy human for some recomendations

1 comment:

alecthegeek said...

Thanks for the wake up call -- lot's of scary stuff to worry about :-)

Why do you think Twitter is an exception? There is a lot of automated posting services for life stream apps (e.g. Twitter Feed) and Web APIs for microblogging services. As an experiment I've started having my location details, music, etc posted to http://twitter.com/alecthegeek (and Jaiku and Identi.ca) -- there is no reason that Enterprise data can't be abused in the same way...