Federal Department Bans Use of Portable Devices (YAFF)

I thought I had blogged about this Canadian data breach, but I guess not.  All these data breaches are coming so fast it’s hard to keep up. In this report, we have another YAFF: a portable hard drive being used as a backup device.

It looks like Human Resources and Skills Development Canada (HRSDC) will be taking a three-pronged approach to protecting our data: first, a new policy banning portable storage devices; second, use of data loss protection technologies and third, establishing consequences for staff that cause a data breach.

OTTAWA — The federal department at the centre of a massive data breach says it is banning the use of portable data devices in its offices, using new technology to prevent information from being easily removed from the network and warning any staff that violation of the new rules could mean the loss of their job.

Human Resources and Skills Development Canada (HRSDC) said Monday that it will start using “data loss technology,” which would allow the department to restrict when, where and which staff can remove information from government systems. Reviews have already started to see what risks the use of secured, portable data devices, such as USB memory sticks, carry in the department’s work and whether there are enough safeguards to prevent another massive breach of personal information from happening again.

via Federal department bans use of portable devices after personal data breach | canada.com.

Their loss of more than half a million student loan borrowers’ data has led to class action lawsuits.  A missing external hard drive is the hardware piece of this breach; the fact that this drive contained unencrypted backups is the behavioural issue.  Perhaps we need to start thinking about how to train end users on the consequences of moving data from “the system” to any place else, even for backup purposes.

Is there a solution?

I have more questions than solutions here, though.  Usually enterprise backup solutions involve software plus a server or external service.  I’m not sure why HRSDC was using a portable hard drive for backup.  They are harder to manage, they tend to walk away, and they aren’t that reliable.  So I’m going to guess here that this device was a personal device or being used to sneakernet files from one location to another.  Perhaps from office to home, or from office to office.  Both of those scenarios bother me because they most likely were not official methods for doing these tasks. 

I don’t think there’s one answer.  Training, policy, inspections, consequences, real monitoring and protection, more training, more inspections, some tough decisions.  It’s a complex issue that will require complex responses.  I’d like to hear what other organizations are doing to mitigate data breaches.

4 Comments

• 
  Matt Velic 29 January 2013 at 10:45 PM

  I feel lucky that nothing like this has happened to me. Lord know’s I’ve been a bit lazy and carried home files on flash. Thankfully nothing super secure (and nothing from the govt.), but still. We’ve got to draw a line as professionals.
  Matt Velic recently posted..I’m Presenting at SQL Saturday #184 in North Haven, CT!

  Reply
• Groan: Victims of Data Breach Receive Letters Intended for Others | InfoAdvisors' Blog 11 February 2013 at 4:10 PM

  [...] blogged about this data breach before: Federal Department Bans Use of Portable Devices (YAFF).  To add insult to the injury, a “printer error” has led to recipients of [...]

  Reply
• 
  Noel McKinney 15 February 2013 at 1:57 PM

  If folks need to put files on flash drives, then I wish they’d take a few minutes to install and learn to use TrueCrypt. It’s not hard.
  Noel McKinney recently posted..Yes, My Blog Went Stale

  Reply
• Episode 024 – Karen Lopez | People Talking Tech 26 February 2013 at 11:05 AM

  [...] Federal Department Bans Use of Portable Devices (YAFF) [...]

  Reply

Leave a comment

Click here to cancel reply.

Name (required)

Mail (will not be published) (required)

Website

Comment

Notify me of followup comments via e-mail. You can also subscribe without commenting.