BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Well-Intentioned Employees Can Make Poor Judgment Calls

Posted May 8, 2012    Peter McCalister

In 2007, Google’s Street View project began to collect “payload data” including e-mail addresses, text messages, and passwords from unsecured Wi-Fi networks of potentially hundreds of millions of people. More than a dozen countries began investigations of Street View in 2010 and in the United States, the Justice Department, the Federal Trade Commission, state attorney generals and the F.C.C. began looking into the matter.

On April 13, 2012 The Federal Communications Commission released a report on Google’s Street View project after a 17-month investigation. The initial viewpoint was the data collection was a result of a “rogue” engineer operating on his own. That however, has been revealed to be false. According to the report, the engineer suggested it was entirely intentional: “We are logging user traffic along with sufficient data to precisely triangulate their position at a given time, along with information about what they were doing.”

Google responded in a blog saying, “The project leaders did not want, and had no intentions of using, payload data.” In addition, Google stressed that the engineer started the project on his “20 percent” time – time that Google gives to employees to work on their own initiatives.

So how did this happen? A Google executive says, “Quite simply, it was a mistake.” Marc Rotenberg, executive director of the Electronic Privacy Information Center says, “This is what happens in the absence of enforcement and the absence of regulation.”

Sometimes well-intentioned employees make poor judgment calls, putting their company in a compromising situation. Proper regulations, especially when employees are empowered to work on their own initiatives, can prevent media frenzy, or as in this particular case, an investigation for potentially breaking privacy laws.

Leave a Reply

Additional articles

webinar 2

On Demand Webinar: Because Auditing Stinks Sometimes

Posted July 2, 2015    Lindsay Marsh

Auditing stinks. Well, mostly stinks. In this on demand webinar, lead by Group Policy MVP Jeremy Moskowitz, you’ll learn the three key tenets to real Group Policy auditing. Tenet 1: Why do you care about Group Policy auditing? Tenet 2: How does Eventing help you know “Who did what?” Tenet 3: How does Reporting tell…

Tags:
, , , ,
skeletonkey3_713678_713680

Stopping the Skeleton Key Trojan

Posted June 29, 2015    Robert Auch

Earlier this year Dell’s SecureWorks published an analysis of a malware they named “Skeleton Key”. This malware bypasses authentication for Active Directory users who have single-factor (password only) authentication. The “Skeleton Key” attack as documented by the SecureWorks CTU relies on several critical parts.

Tags:
, , , , ,
webinar 2

On Demand Webinar: 10 Steps to Building an Effective Vulnerability Management Program

Posted June 26, 2015    BeyondTrust Software

In this on demand webinar, Cybersecurity Expert, Derek A.Smith will take you through his 10 steps for a successful vulnerability management program and how to get started now.

Tags:
, ,