Does anyone know what happened to MIT's Enigma project?
This is their white paper: http://web.media.mit.edu/~guyzys/data/ZNP15.pdf
120M American Households Exposed In 'Massive' ConsumerView Database Leak
11–20 of 163 posts
Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak
#12The linked article is not very good imo. It goes into almost no detail, despite including two directly contradictory statements: "Yet another cloud storage misconfiguration has exposed personally identifiable information (PII)" and "the data in question contained no names of any individuals or any other personal identifying information" Can we change this to link to the Forbes article referenced in the linked one? It…
The forbes article is good. The original linked article is so poorly written, I thought it was a sham.
The Forbes article says that the US is one of the few countries that does not have laws requiring the protection of such information. But let me ask: what would a new law change about this particular incident?
Unless the law specifically requires that someone go to jail, then the law will make no difference. The owner of the data didn't mean to expose it all. It just happened.
We already know that when companies flout the laws, no person goes to jail. The company pays a fine and everyone continues doing what they were doing. The punishment is irrelevant. With this kind of repercussions, Laws are ineffective.
Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak
#13>At issue is once again an Amazon Web Services S3 cloud storage bucket that was misconfigured and inadvertently left open to the public internet, where anyone with a connection online could have found it.
I use S3 and I have noticed that by default it's locked down and secure and in order for it to be open you have to open it for the public. Maybe AWS could improve the way it can secure the S3 buckets by making it easier to whitelist access by IPs or some variant to this. Although I personally find it fairly straight forward to use in the projects I work on but it appears it may be difficult and my developers just open it up to the public so their apps can easily access it.
Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak
#14Personal data right now is considered an asset. It needs to be seen as a liability. Maybe the solution is a data tax. You pay a set amount every year for every piece of personal data you have. If you buy personal data from another company, you still have to pay the tax for the data you acquired. If you have a breach of data, your tax goes up for a period of 10 years. In addition, every piece of personal data needs to…
Instead of a data tax, I like the idea of mandatory data insurance, with payouts to users whose data is leaked/stolen. If your company has shitty security, or a history of leaks, your data insurance provider will charge out the ass. The financial math has to clearly be on the side of it being more profitable to practice proactive security.
Just set a value on the data, a monetary value, and the rest will naturally emerge through insurance and due diligence by insurers.
Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak
#15Personal data right now is considered an asset. It needs to be seen as a liability. Maybe the solution is a data tax. You pay a set amount every year for every piece of personal data you have. If you buy personal data from another company, you still have to pay the tax for the data you acquired. If you have a breach of data, your tax goes up for a period of 10 years. In addition, every piece of personal data needs to…
Instead of a data tax, I like the idea of mandatory data insurance, with payouts to users whose data is leaked/stolen. If your company has shitty security, or a history of leaks, your data insurance provider will charge out the ass. The financial math has to clearly be on the side of it being more profitable to practice proactive security.
Without data provenance (ie a data chain of custody) corporations will just "subcontract" it out to the lowest bidder. There needs to be consequences all the way up the chain to everybody that provided the data. This way, the people will bad security won't even get the data in the first place because no one will risk their data with them.
Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak
#16The linked article is not very good imo. It goes into almost no detail, despite including two directly contradictory statements: "Yet another cloud storage misconfiguration has exposed personally identifiable information (PII)" and "the data in question contained no names of any individuals or any other personal identifying information" Can we change this to link to the Forbes article referenced in the linked one? It…
The forbes article is good. The original linked article is so poorly written, I thought it was a sham. The Forbes article says that the US is one of the few countries that does not have laws requiring the protection of such information. But let me ask: what would a new law change about this particular incident? Unless the law specifically requires that someone go to jail, then the law will make no difference. The own…
Set a value on the info, statutory value, and suddenly a breach can bankrupt you, you seek insurance, and the insurerers want due diligence of your infosec.
Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak
#17All personal information sharing should now be purely digital and encryption-keyed. We have all of the protocols, interconnected networking and ubiquitous computing necessary to make it practical.
The only “data” any organization should receive is an encrypted blob that is constructed using the key of the person who owns the data and the key of the entity that was directly given the data. Furthermore, the encoded blob should have a date of encoding and a duration of validity. In other words: “I, John Q. Public, authorize You, DataLosingMegaCorp, Inc., to receive This Blob, which is valid for 6 months or until either party revokes the key”.
Other public systems in society should be upgraded to require additional layers of security. Want to send commercial snail mail to my home address? Great: please provide the postal service with a one-time authorization code that you received from me (after all, you are using an address given to you by me and not bought from somebody else, right?).
Another nice feature would be for data to include bank deposit info for the data owner and bank withdrawl info for the data-receiving entity, where EVERY SINGLE TIME your data is decrypted you receive a cash deposit from the data-receiving entity. And make it sting, a lot: I want it to cost real dollars to use data (and of course, I can still revoke my key at any time if you still manage to do something stupid with my data).
Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak
#18Personal data right now is considered an asset. It needs to be seen as a liability. Maybe the solution is a data tax. You pay a set amount every year for every piece of personal data you have. If you buy personal data from another company, you still have to pay the tax for the data you acquired. If you have a breach of data, your tax goes up for a period of 10 years. In addition, every piece of personal data needs to…
> Personal data right now is considered an asset. It needs to be seen as a liability.
In Europe, especially with the upcoming GDPR laws, data is seen as a liability by many companies.
Data being a liability just means that companies need to think twice before storing it - if the data is sufficiently valuable, companies will still store it, but they have to manage it properly and mitigate risks since penalties are harsh.
Storing data "just because you can" will no longer be worth it, and rightly so, given the risk.
Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak
#19Apparently I take better care of user information on a hobby project running on localhost that will never see a remote server than these giant companies do with real life data.
Re: 120M American Households Exposed In 'Massive' ConsumerView Database Leak
#20The linked article is not very good imo. It goes into almost no detail, despite including two directly contradictory statements: "Yet another cloud storage misconfiguration has exposed personally identifiable information (PII)" and "the data in question contained no names of any individuals or any other personal identifying information" Can we change this to link to the Forbes article referenced in the linked one? It…
FYI, 120 million American households is only a few percent off from the being all American households. That part at least is fair.