An ounce of prevention is worth a pound of cure
November 30th, 2007
I’m in Europe this week meeting with customers, partners and open source project teams. The biggest news story of the week spans the popular business and technology press and relates to the loss of two CDs containing personal information for 25 million UK citizens. Having been the victim of identity fraud in the past I know exactly what’s ahead of these folks to ensure that this event doesn’t affect their ability to buy a house or a car in the future. It took me 18 months to undo the damage done to my own credit rating and now I take a belt and braces approach to protecting my personal data: I have put an alert on my credit record with all of the major credit reporting agencies, check my credit record on a monthly basis and shred all correspondence.
One of the topics that I’m often invited to speak about at conferences is open source security. There are those who continue to subscribe to the concept of security through obscurity and during the session I typically ridicule that concept and show how easy it is to use techniques like SQL injection to access sensitive data. More often than not I’ll be able to access the conference registration system and take a look at the registration information and personalized agenda of one of my colleagues, with their prior consent of course.I then go on to talk about how a secure database product should provide discretionary access control, roles, encryption, and auditing of all database activity whether successful or not; all of which are provided by Ingres. I typically round out the discussion with an overview of off-line data protection and run through recent press coverage of data security breaches caused by human error in handling off-line data. It amazes me how little thought is given to off-line data protection and how frequently back-up media will wind up in the trash without being erased or destroyed first. If you don’t yet have a policy for managing off-line data security I’d urge you to put one in place before the end of the year. “An ounce of prevention is better than a pound of cure” as my Auntie Maggie always says.
