Skip to main content

Privacy? who are you kidding?

Recent developments in privacy decisions should have both H.R. departments, internal investigations teams, and employees re-evaluating what is private, and what is not.

A couple recent decisions to be aware of:

This is in progress at the Supreme Court, but is based on a case from California where a police officer used a work issued device to send inappropriate messages (even though his supervisor at one time said that the department allowed personal use if he paid for the usage fees).

http://www.cnn.com/2010/LIVING/worklife/04/20/work.text.email.privacy/index.html?hpt=Sbin


Another recent decision from the New Jersey Supreme Court. The summary is that an employer can not read email messages sent via a third-party email service provider -- even if the emails are accessed during work hours from a company PC. This is a bit more complex because it has to do with communication to legal counsel (privileged communication). But it is an important thing to consider, just because you can see data that is sent via your enterprise systems doesn't mean you are allowed to see it/use it. Another point is that the employer in question had vague or non-existent policies on use of corporate systems and privacy.

http://www.darkreading.com/story/showArticle.jhtml?articleID=224201355

A couple broad considerations:

1) DO have clear and understood policies that your employees have to read that clearly state how you wish to handle usage of company systems for personal use (allowed with no expectation of privacy, not allowed, etc.).

2) Get legal advice before assuming you have the "right" to use data that you find.

3) Consider not allowing your enterprise to access external mail accounts on your production network. These accounts and systems can be a major virus vector as well as an aperture for loss of company data (PHI, PII, Intellectual Property) as well as a privacy risk.

->Pierre

P.S. Just saw this on GeekDad (regarding what kids know about online privacy)
http://www.wired.com/geekdad/2010/04/what-do-your-kids-know-about-online-privacy/

Comments

Post a Comment

Popular posts from this blog

Requirements for Information Security

If you want to get into Information Security you HAVE to be a/have this skill... Why this is total BS. Almost daily I see someone posting on twitter, trying to be helpful to folks who are looking to get into InfoSec. Often I see "If you want to be in Information Security (Cyber Security) then you HAVE to be a programmer" or "If you want to be successful you have to be a hacker/have a criminal record/have abused systems without permission" etc. While having technical capabilities (such as programming) and having the ability to compromise a system shows a specific skillset neither are required. When talking to people who are interested in Information Security I often refer to it as a cake, there are tons of slices, many flavors, many pieces and parts you can sample, choose to focus on, will be expected to know something about, etc. Incident Response and Forensics (my current focus) is not the only part of Information Security, and certainly not the only part tha...
Post a Comment
Read more

Privacy considerations for home users

In light of the recent new stories regarding the recently signed legislation allowing ISP's to be able to sell your data http://www.vox.com/new-money/2017/3/29/15107110/republican-isp-data-privacy Here are a couple ideas and tips about privacy in general. Don't panic - a lot of the info was already being gathered, this isn't that large of a change regarding scope, it's more of a change to who can profit or sell it (which is a shift for sure). Remember a lot of the services you use today already gather your browser, activity, and search info (google, bing, yahoo, facebook, etc.). ISP's haven't implemented this yet, expect to see new terms of service in an upcoming bill, or an email sent to you, etc. If you would like to take some steps to try to preserve your privacy, here are some ideas and examples: VPN (Virtual Private Network) - this in essence creates an encrypted tunnel between two points on the Internet. One point being your system...
Post a Comment
Read more

Busting the myth of the malicious insider

The Myth of the Insider Threat Too often after the announcement of a new breach, the first reaction from the victim company and the media is "another malicious insider attack".  Case in point, I was catching up on news from various sources and came across the following: http://www.idgconnect.com/abstract/19647/lessons-sage-leak " “We believe there has been some unauthorised access using an internal login to the data of a small number of our UK customers so we are working closely with the authorities to investigate the situation,” the Newcastle, England-headquartered firm said in a statement." Of course an internal login was used to access the data, as part of the attack lifecycle, during your reconnaissance phase you identify accounts to target for possible compromise, based on the access/role of the individual.   Phishing attacks or other simply attacks are often successful in gathering login credentials for individual users, which can then of...
Post a Comment
Read more