BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Well-Intentioned Employees Can Make Poor Judgment Calls

Posted May 8, 2012    Peter McCalister

In 2007, Google’s Street View project began to collect “payload data” including e-mail addresses, text messages, and passwords from unsecured Wi-Fi networks of potentially hundreds of millions of people. More than a dozen countries began investigations of Street View in 2010 and in the United States, the Justice Department, the Federal Trade Commission, state attorney generals and the F.C.C. began looking into the matter.

On April 13, 2012 The Federal Communications Commission released a report on Google’s Street View project after a 17-month investigation. The initial viewpoint was the data collection was a result of a “rogue” engineer operating on his own. That however, has been revealed to be false. According to the report, the engineer suggested it was entirely intentional: “We are logging user traffic along with sufficient data to precisely triangulate their position at a given time, along with information about what they were doing.”

Google responded in a blog saying, “The project leaders did not want, and had no intentions of using, payload data.” In addition, Google stressed that the engineer started the project on his “20 percent” time – time that Google gives to employees to work on their own initiatives.

So how did this happen? A Google executive says, “Quite simply, it was a mistake.” Marc Rotenberg, executive director of the Electronic Privacy Information Center says, “This is what happens in the absence of enforcement and the absence of regulation.”

Sometimes well-intentioned employees make poor judgment calls, putting their company in a compromising situation. Proper regulations, especially when employees are empowered to work on their own initiatives, can prevent media frenzy, or as in this particular case, an investigation for potentially breaking privacy laws.

Leave a Reply

Additional articles

dave-shackleford-headshot

Tales from the Datacenter: Vulnerability Management Nightmares

Posted May 27, 2015    Dave Shackleford

Vulnerability scanning, threat management, risk analysis, patching, and configuration management are some of the major activities usually associated with vulnerability management, and none of these are new…so why are we failing so badly at many of them?

Tags:
, ,
Sudo_logo

Don’t Create a Different sudoers File for Each System

Posted May 20, 2015    Randy Franklin Smith

What if you have multiple Linux and/or Unix systems? Sudo management can become onerous and unwieldy if you try to manage a different sudoers file on each system. The good news is that sudo supports multiple systems.

password-safety

What Does Microsoft Local Administrator Password Solution Really Do?

Posted May 19, 2015    Morey Haber

LAPS is a feature that allows the randomization of local administrator accounts across the domain. Although it would seem that this capability overlaps with features in BeyondTrust’s PowerBroker Password Safe (PBPS), the reality is it is more suited for simple use cases such as changing the local Windows admin account and not much more.

Tags:
, ,