Australian Government data loss avoidable
by Cyber - Ark
Cyber-Ark says the deletion of more than 10,000 Government records in Australia’s Northern Territory by the drunken ex-fiancee of an IT staffer highlights the need for protection of critical user IDs and passwords.
“Reports are coming in of the deletion of 10,475 user accounts on the Northern Territories’ health, court and prison service’s computer systems in a drunken rage after one member of IT staff terminated a relationship with another IT employee,” said Mark Fullbrook, Cyber-Ark’s UK and Ireland Director.
“The plain fact of the incident – which cost five days and around A$1.25 million to resolve – is that high level IDs such as that operated by the lady concerned should never have been accessible to ordinary members of staff.
They should have been stored digitally and only accessed on an auditable basis by designated members of staff with specific authority for a given user session,” he added.
According to Fullbrook, high level administrator IDs such as the one misused in the Northern Territories data deletion incident, should have been protected by an authenticated protection system and the use of one-time transaction access numbering (TAN) technology.
By using an auditable data vaulting protection system, allied with one-time TANs, even if the male member of staff had been able to discover his fiancee’s login details, the staffer could not have deleted the user account data without a TAN, he said.
The incident, says Fullbrook, is a classic case of insufficient multi-stage security being applied to high level administrator IDs and passwords.
The technology required to protect administrator IDs and passwords, he explained, is now available at relatively low cost, and is therefore deployable in a wide variety of IT situations.
“Data vaulting technology is no longer the expensive option that many people think it is. It’s cost-effective, easily deployable and, perhaps more importantly, can be integrated with other audit and user account control systems,” he said.
Click here to discuss this: Security Forums
Related posts to "Australian Government data loss avoidable":
- Crown Plaza Venice hotel booking fiasco was avoidable
- Origin says MBNA laptop fiasco could easily have been avoided
- Welsh NHS Trust data loss avoidable
- Oz government told to block malware
- BackStop service deletes sensitive files on lost or stolen laptops, computers and GSM devices
Speak Your Mind
Tell us what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!
Previous: « Tufin gains global momentum
Next: Internet criminals hide behind fast-flux DNS »
Visited 693 times, 1 so far today