I am so tired of seeing stable doors bolted. It seems that anyone who has stewardship of sensitive data largely ignores that responsibility until they’ve been compromised, then rushes to spend fortunes proving how much better they’re going to do it in future. I’m looking at you, TalkTalk, but I’m also thinking of Equifax. After … Continue reading Can’t you just pretend you’ve been hacked?
I’ve been re-reading the Article 29 Working Party’s report on workplace monitoring. I mean, who’d be rockstar when you can have my life? Anyway, I thought this section merited reproduction in full: 5.8 Processing operations involving disclosure of employee data to third parties It has become increasingly common for companies to transmit their employees’ data … Continue reading Yay! No more “our team” pages
I do wish the Europeans would make up their minds. There was an ECJ ruling a couple of years ago that made it clear that you could monitor your employees' private use of the internet while at work. The GDPR also makes it clear that you can process information that the data subject has "manifestly" made … Continue reading No, you can’t snoop on your staff
It's been a big week for security news. Parliamentary email hacked, UK politician logon credentials circulating for sale, a massive (paper) data breach at the NHS, another massive ransomware outbreak, Boomerang Video fined... Wait, what? Who the hell are Boomerang Video? Boomerang are a small video-game rental operation. Their website was hacked in 2014 and … Continue reading Yes, data protection matters to you too
Reuters: Ransomware virus hits computer servers across the globe I told you so. And yes, it looks like it's the same attack method as WannaCry. This time without a killswitch. Did you do anything after WannaCry? Looks like lots of people didn't... Backup now. Patch MS-CVE-2017-010 now. Patch MS-CVE-2017-0199 now. Turn off SMB1 now. Send out … Continue reading I told you so
Oh you really couldn’t make it up. Recent terrorist outrages have prompted various European politicians to call, with more or less complete technological illiteracy, for encryption to be weakened so that the security services can spy on us more effectively. I’ve written about this several times, pointing out why this is a criminally stupid suggestion, … Continue reading Hahahahahahahahahahaha
UEA accidentally sent a spreadsheet with confidential medical information to 320 undergrads. The sheet wasn’t password protected, or encrypted, because... the confidential medical information was stored in a spreadsheet because… the spreadsheet was accessible to be attached to an email because… Please tell me that the GDPR will prompt UK orgs to spend at least … Continue reading News in brief