Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 5 down vote favorite
2

Lots of companies seem to be raising IT security as a big issue - but is it?

What's been your company's biggest security leak? The reason for asking is that I want to make sure it doesn't happen to us! I'm hoping some of these will trigger us into taking action where it is really necessary and not over-reacting to the "IT security" issue.

Obviously, please don't mention company names!

share|improve this question
2  
1) this should be a community wiki. 2) You're asking a community of sysadmins if security is a big issue? Really? – squillman Jul 2 '10 at 18:20
If X answer you with a real case in his company I guess X is the biggest security leak himself ! :) But I'm sure that lot of people will give you good security recommandation. – radius Jul 2 '10 at 18:21
3  
The way this question is framed is dubious. It's like posting to a place full of bankers asking what the most common fault in their vaults is. – Warner Jul 2 '10 at 18:44
What are you trying to say, Warner? Do you think this question is dangerous to ask? Are you afraid someone is going to read it and try it out? If so, I had not considered that. On one hand tt is a security concern in itself - on the other, what about free speech? In reality, I'm just trying to learn. – Wikis Jul 2 '10 at 18:55
1  
This is not the way to go about assessing risk for your company-An unacceptable risk for my company might be an acceptable risk for yours--What you are doing is asking for anecdotal evidence, and (from what you said in your post), you are going to try and make sure that you are protected from the "leaks" that have happened to other companies; If you are truly trying to asses the risk of your company, in relation to your IT resources, you should talk with a IT security consultant, and go from there. Does that make sense? – Josh Brower Jul 2 '10 at 20:37
show 4 more comments

2 Answers

up vote 3 down vote accepted

These aren't my company's leaks, but, leaks that I would consider somewhat significant:

  • Third-party credit card processors maintaining username/password/hostnames in the clear so that when they're hacked, dozens of hosting providers need to restore backups.

  • Large national chain stores that have no business storing credit card numbers, having those card numbers stolen.

  • Government employees/contractors having detailed personal information on a laptop that was conveniently lost prior to the purchase of a larger house or boat.

  • Facebook application developers using third party ad systems without sanitizing the data first. Even though the graph token is only valid for 7200-8800 seconds, it is enough to grab data from Facebook and post to that user's wall. Kudos to application developers that have asked for extended permissions.

  • Selling government data to foreign governments for 25 years before the very agency that looks for this sort of thing figured it out.

  • Credit card processors that feel the need to not follow the very same restrictions that they place on merchants, then, due to the threat of the business having to pay, having Visa waive the requirement that they notify all 40 million affected cardholders because it would have a negative impact on their stock price.

share|improve this answer
Yes, those are all pretty serious! Thank you. Personal data, especially credit card information, is a serious risk. And it is an interesting answer because I was expecting more about company information leaking, making your answer especially welcome. – Wikis Jul 2 '10 at 20:18
up vote 1 down vote

My company is very small and has fortunately not suffered any security leaks of personal/financial information thus far (knock on wood).

If I had to narrow down our two "most vulnerable" spots most likely to leak information I believe it would be the following:

  1. Google. We use Google Apps Enterprise hosted email, calendar, contacts, documents, and so forth. Don't get me wrong, these services are great and I'm a big Google fan, but all that information is still "out on the cloud" and I can only assume it's being taken care of. Very sensitive information like credit card numbers and other financial data is stored in a database on a local server, but we still have many confidential communications running through Google.

  2. Users. Need I say more?

share|improve this answer
You could've just said "Users". Oh -- and hosted apps means the hosting company can be accessed via subpoena, rather than needing a search warrant (issues w/ third party storage). – Joe H. Jul 6 '10 at 16:44
1  
that's interesting, thanks. The question is - which is more secure - Google or your company? For most of us, my money's on Google! – Wikis Jul 7 '10 at 9:17
re: users, that shows the importance of hiring the right people so that we don't create tons of rules to handle the, shall we say, less motivated. (See Jim Collins' Good To Great book.) – Wikis Jul 7 '10 at 9:18
3. The computers. There would be fewer computer-related security problems if the computers were disconnected from the network, powered off and burned to a cinder. Nuke it from orbit, it's the only way to be sure. – Stefan Lasiewski Jul 14 '10 at 21:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.