It's time to stop playing war games in the name of "security"

Some organizations put too much emphasis on hardening guidance

Jesper's Blog — Tue, 21 Mar 2006 22:25:12 GMT

I have been working on hardening guidance for almost 10 years. The first few I worked on were essentially...

re: It's time to stop playing war games in the name of "security"

Alun Jones — Fri, 17 Mar 2006 01:17:24 GMT

I thought I was going to come across as a frothing loon if I said that out loud - it's something I've been saying for quite some time, though.

My data is my data, and I may allow you to borrow it so that you can do business on my behalf, but unless there's a legislatively mandated requirement that you have access to my data, I should be able to decide who gets to borrow it or not.

If there _is_ a mandated requirement for you to have my data, or I have allowed you access to it, there should be a process for me to inspect, and correct, any factual data you carry that describes me.

European data protection laws have had this right from early days. In school, I went to a day of the committee readings of the Data Protection Act in the House of Commons, and was thoroughly expected to be disgusted (as a know-it-all teenager); I came away impressed by the fact that our politicians seemed to understand the basics of what they were discussing.

It's not without its faults, granted, but the rights ascribed to data subjects are unparalleled by anything here in the United States.

re: It's time to stop playing war games in the name of "security"

TechNet Archive — Wed, 15 Mar 2006 10:04:10 GMT

True, but that's not directly related to the point the article was making. This is more of a data ownership issue, and until we have regulations in this country that:

* specifically define the subject of the information to be the information's owner

* place financial risk of disclosure on the collectors of that information

We won't solve the problems. Right now, you don't own the information collected about you, and the people who collect it have no financial incentive to protect it -- they don't usually pay in the event of exposure.

We as a society must fix these two problems first.

re: It's time to stop playing war games in the name of "security"

Alun Jones — Wed, 15 Mar 2006 00:31:40 GMT

I don't think the business mind-set really always helps all that much, either, sadly.

The most glaring examples are the "your data is now ours, and we can sell it to whomever" issues that have been plaguing various credit card processing companies for some time.