Simon on: ITCM - Be responsible for event registration security

We’ve seen many major companies experience security breaches with the Ashley Madison hack even leading to suicides, so isn’t it time industries take a look at how it protects its customers’ data?

The events sector has seen an increase in the number of conference websites which requires its delegates to sign in, pay to attend, and book sessions, and while the companies behind the sites should be doing everything to keep data secure, some of the onus is on those registering.

When it comes to password choice, size really does matter, but websites still insist on implementing password limitations.

Read the whole article about the vicious password circle, as featured on ITCM, by clicking here.

Simon on: Data security in events

I know I bang on about data security a lot but it really is a subject that doesn’t get taken seriously enough.

I do believe that event websites are less likely to be targeted because of the short term nature of registration websites - that isn’t an excuse for not doing everything you possibly can to protect your data though.

Very recently a healthcare company in the US had a data breach and were sued by their customers. The healthcare company’s insurance paid out $4.1m in compensation, but an investigation revealed that the healthcare company had not done enough to secure their data and so the insurance company demanded the money be repaid.

Another recent study found that for the first time ever, bots are generating more traffic on the internet than people. A bot is an automated process that gathers information – Google use them to index web pages but criminal gangs are now using the same technology to look for personal information.

Our data is an important asset which needs to be protected. You wouldn’t leave your home or office unlocked when there’s nobody there so why leave your online information up for grabs?

Originally published in Conference News

Simon on: ITCM - Time to consider our own data security

With recent stories of celebrities' iCloud accounts being hacked, it's time that data security became a serious issue for everyone.

We wouldn't leave our doors unlocked so why do we leave our personal information up for grabs? 

With nearly a third of us choosing '123456' as our password of choice, the question is: are you doing enough to protect your data? 

Read the whole article featured on ITCM, by clicking here.

Simon on: App security

Ask any organiser whether they would mind a competitor getting hold of a full list of their registrants in order to promote a competing event and most would probably object. 

Yet, according to recent reports, that’s what’s happening at some events. In some cases, the organiser has apparently been told that it’s possible and has ignored the warning.

The situation has arisen because some conference apps (not all by any means) allow any user to download a full list of registrants, in some cases, along with all their personal information.

A competitor doesn’t even need to attend the event. All they do is download the app to get free access to the registrant database.

The fact that some organisers have been told that this is possible with their event app and have done nothing to prevent it suggests that they don’t care about the security of their data. 

Unfortunately this seems to be a common attitude these days. A recent conference session on Internet security attracted only a handful of delegates while another promoting the wonders of social media was a sell-out.

Perhaps it’s time for organisers to learn how to safeguard their assets before being swept up by the latest bandwagon.

Originally published in Conference News

Data security is a deadly serious issue

My recent blog post said that programmers who stored passwords in plain text should be beaten to death with a house brick. That caused someone to email me saying that they thought it was a bit extreme and that perhaps I should consider changing it.

So the first thing I'd like to say is that my comment was not meant to be taken literally but I seriously believe that was obvious. I did have a think about it and I believe the sentiment was justified as a way to highlight the seriousness of the situation and I'd like to explain why starting with some examples.

The first example is the British Pregnancy Advice Service. They have a website which amongst other functions, allows people wanting advice on pregnancy, abortion and contraception to request contact from the charity.

Unfortunately, the charity didn't manage their website development well and didn't know that their website was storing highly sensitive personal information about people who contacted them. Their website was also vulnerable to hacking and someone broke into the site and stole a lot of sensitive personal information.

The charity was fined £200,000 by the Information Commissioner's Office in the UK – something that will certainly hurt badly for them but it was less than the maximum possible fine of £500,000. The charity said they were "horrified at the scale of the fine" but the ICO's Deputy Commissioner said "ignorance is no excuse".

At this point I need to say that I have no idea whether there were unprotected passwords in the BPAS website but at the same time, most attacks by hacking exploit lazy or bad programming that doesn’t adequately protect the data in question.

Then there's the case of Cupid Media who operate a variety of dating sites. In 2013 they were hacked and 42 million user account details were stolen from their server. Sadly these details did include plain text passwords and unfortunately, many people regularly use the same password for every website meaning lots of other sites that they are registered with could also be hacked.

Rather disturbingly I also saw a website recently which had almost no security – the admin elements of the site could be reached if you knew the right URL with no login at all and this website stored both passwords AND credit card details in plain text. Honestly, this is probably the most scary example of bad programming I have EVER seen in my life.

Even the general standard of programming was truly shockingly bad. Unfortunately, the person who wrote that website allegedly does this stuff for a living but honestly shouldn’t.

My point is that if a programmer doesn't understand that storing passwords in plain text is one of the worst possible things they can do then there is realistically no chance that they will understand all of the other security threats or how to keep your data safe.

As the UK Government "Cyber Essentials" scheme puts it "Compromise of information assets
can damage companies" and I completely agree.

So when I said you should "beat them to death with a house brick" I was doing so purely for effect. Don’t do that – just fire them and get someone else!