21–30 of 38 posts
> "Today’s action sends a clear message to financial institutions that they must take seriously their obligation to safeguard such data.” $35 million fine for 15 million customer's PII. The 'clear message' is that a customer's PII is worth about $2. Meanwhile the customers are on the hook for fraud monitoring in perpetuity.
Isn't like annually worth like $10.
Earlier quoted context omitted.
I've been using fde since like 2005 or so and I'm not even a bank. Seems like they don't have much excuse?
That's at least two years before even the most forward thinking offices started using FDE on PCs. Bitlocker came out in 07.
Though at the same time while we've gotten used to banks lagging horribly on tech, given their resources and the sensitivity of the information they deal with an argument can be made that they should be leading not lagging and that cost cutting and lack of leadership interest aren't great excuses for delays. I do think by 2015 yeah that was getting kind of bad. On the other hand, the penalty wasn't much ($35m in 2022 would be worth a lot less to them working back 7 years). It might still have been cheaper to setup FDE back then. Optimistically, there may be Morgan Stanley clients well off enough to mount real private lawsuits or at least take quite a lot of money elsewhere if they're irritated enough, so while this penalty alone might not be much of a lesson about PII perhaps they'll still come to regret it a little :\.
> "Today’s action sends a clear message to financial institutions that they must take seriously their obligation to safeguard such data.” $35 million fine for 15 million customer's PII. The 'clear message' is that a customer's PII is worth about $2. Meanwhile the customers are on the hook for fraud monitoring in perpetuity.
"Punishable by fine" means "legal if you can afford it". Until living, breathing, actual people face real consequences for this kind of thing, any enforcement actions are just theater.
At least humans are mostly controlled by ethics and morals.
Corporations, not so much.
I used to visit the data centers of some very large financial institutions. The SoP at those places was that hard drives from the data center NEVER left the building except through a device that destroyed them…. Their security guards were really into checking for them and etc. It was a pretty common rule across those banks and etc at that time, and that was quite a while ago.
Earlier quoted context omitted.
At the same time I heard several stories of people copying the files onto their desktop hard drives and leaving the building with them when lehman went bust.
I didn't see any indication that the hard drives from the data center policy had anything to do with drone's laptops coming and going. To be clear in one building there were a few thousand people working. When I visited myself and maybe a dozen or two dozen other people in the building had access to the data center. Cameras everywhere, appointment verification, IDs, man traps and all. I'd visit and go up to the doors…
Earlier quoted context omitted.
At the same time I heard several stories of people copying the files onto their desktop hard drives and leaving the building with them when lehman went bust.
I didn't see any indication that the hard drives from the data center policy had anything to do with drone's laptops coming and going. To be clear in one building there were a few thousand people working. When I visited myself and maybe a dozen or two dozen other people in the building had access to the data center. Cameras everywhere, appointment verification, IDs, man traps and all. I'd visit and go up to the doors…
Earlier quoted context omitted.
Are you running an EMC CLARiiON array with the export encryption option licensed? What works on your desktop isn't really comparable to what Morgan Stanley had on the datacenter floor 10 years ago.
Yeah, but they don't have millions of dollars available and they don't store personal information of millions of people. Morgan Stanley is and was clearly able to afford this license and if you need to handle data this sensitive, you must meet the necessary precautions.
Earlier quoted context omitted.
Same. When I used to work at a hedge the standard procedure was to zero them out first. Then retain the hard drives in a closet. Then someone could come periodically to physically destroy them.
How was the process governed so that drives actually were wiped before going out the door? That’s really the challenge, the humans managing the kit are the weakest link. I do like the comment about drives only able to depart the premises through a shredder.
The people who literally shredded the hard drives would give us the literal bits back.
It's kind of nutty but information is the life blood of hedge funds.
Earlier quoted context omitted.
Yeah, but they don't have millions of dollars available and they don't store personal information of millions of people. Morgan Stanley is and was clearly able to afford this license and if you need to handle data this sensitive, you must meet the necessary precautions.
Just because the company has money, doesn't mean the department or line of business does. I didn't read the report but wouldn't surprise me if this was some acquisition infra (it would explain why they hired a moving company)
> I didn't read the report but wouldn't surprise me if this was some acquisition infra (it would explain why they hired a moving company)
I didn't read it yet, either, but this seems unlikely - why would an acquisition have so much customer data in their DC? And if they had so much data, why didn't they encrypt it beforehand? Anyway, in the end, it was still Morgan Stanley that hired the moving company, so they f-ed up either way.
Earlier quoted context omitted.
I've been using fde since like 2005 or so and I'm not even a bank. Seems like they don't have much excuse?
Are you running an EMC CLARiiON array with the export encryption option licensed? What works on your desktop isn't really comparable to what Morgan Stanley had on the datacenter floor 10 years ago.