BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Well-Intentioned Employees Can Make Poor Judgment Calls

Posted May 8, 2012    Peter McCalister

In 2007, Google’s Street View project began to collect “payload data” including e-mail addresses, text messages, and passwords from unsecured Wi-Fi networks of potentially hundreds of millions of people. More than a dozen countries began investigations of Street View in 2010 and in the United States, the Justice Department, the Federal Trade Commission, state attorney generals and the F.C.C. began looking into the matter.

On April 13, 2012 The Federal Communications Commission released a report on Google’s Street View project after a 17-month investigation. The initial viewpoint was the data collection was a result of a “rogue” engineer operating on his own. That however, has been revealed to be false. According to the report, the engineer suggested it was entirely intentional: “We are logging user traffic along with sufficient data to precisely triangulate their position at a given time, along with information about what they were doing.”

Google responded in a blog saying, “The project leaders did not want, and had no intentions of using, payload data.” In addition, Google stressed that the engineer started the project on his “20 percent” time – time that Google gives to employees to work on their own initiatives.

So how did this happen? A Google executive says, “Quite simply, it was a mistake.” Marc Rotenberg, executive director of the Electronic Privacy Information Center says, “This is what happens in the absence of enforcement and the absence of regulation.”

Sometimes well-intentioned employees make poor judgment calls, putting their company in a compromising situation. Proper regulations, especially when employees are empowered to work on their own initiatives, can prevent media frenzy, or as in this particular case, an investigation for potentially breaking privacy laws.

Leave a Reply

Additional articles

How To Implement The Australian Signals Directorate’s Top 4 Strategies

Posted October 20, 2014    Morey Haber

The Australian Signals Directorate (ASD), also known as the Defence Signals Directorate, has developed a list of strategies to mitigate targeted cyber intrusions. The recommended strategies were developed through ASD’s extensive experience in operational cyber security, including responding to serious security intrusions and performing vulnerability assessments and penetration testing for Australian government agencies. These recommendations…

Tags:
, , , ,
asp-mvc

Exploiting MS14-059 because sometimes XSS is fun, sometimes…

Posted October 17, 2014    BeyondTrust Research Team

This October, Microsoft has provided a security update for System.Web.Mvc.dll which addresses a ‘Security Feature Bypass’. The vulnerability itself is in ASP.NET MVC technology and given its wide adoption we thought we would take a closer look. Referring to the bulletin we can glean a few useful pieces of information: “A cross-site scripting (XSS) vulnerability exists…

Tags:
4bestpracticesaudits-blog

Four Best Practices for Passing Privileged Account Audits

Posted October 16, 2014    Chris Burd

Like most IT organizations, your team may periodically face the “dreaded” task of being audited. Your process for delegating privileged access to desktops, servers, and infrastructure devices is a massive target for the auditor’s microscope. An audit’s findings can have significant implications on technology and business strategy, so it’s critical to make sure you’re prepared…

Tags:
, , , ,