Schneier on Security

Davi Ottenheimer • March 1, 2005 1:36 PM

Unbelievable. Thanks for the link Bruce. What a mockery these people make of the security profession. Richard Baich says in the article that Howard Schmidt met him at RSA and said “This is fraud, it’s not a hack”.

Everyone in the business should know that people, processes and even physical access are fundamental to information security. A “hack” is simply an exploit of the weakest link in the chain. Fraud is deception deliberately practiced to secure unfair or unlawful gain. If they are unable to connect the dots, then they are just asking for trouble from organized crime as well as the wrath of their shareholders.

Note that Mr. Baich carries the propagandist line that the ChoicePoint’s “vision is to make a safer, more secure world through the responsible use of information.”

On the contrary, their profit-model is hard to distinguish from many of the groups that law enforcement is actively trying to shut-down for selling personal identity information without the consent of those who would be financially impacted:

http://www.informationclearinghouse.info/article4973.htm
“Prosecutors in Nicaragua, Mexico and elsewhere across Latin America have opened investigations into the business of private information mining after discovering that the U.S. Justice Department hired a Georgia company to collect personal information on up to 300 million people throughout the region without their knowledge.”

So if I collect personal/financial data from people and then sell it to the US government without their consent, does that mean I am practicing “responsible use of information”? They were responsible to whom, Ashcroft? They certainly were not practicing “reasonable” use of information.

Beyond all the news about ChoicePoint’s relationship with the Bush Administration and the Florida election disaster, there is another troubling aspect of Mr. Baich’s philosophy. In the article he says “We worked with (authorities) and did the right thing disclosing the breach where a lot of companies may not have ever disclosed this.”

Wow. As the Editor points out ChoicePoint was forced to disclose because the SB1386 law in California required it. I see no cause for celebration — no pat on the back for complying with the law. Even more telling is the point that ChoicePoint initially did not disclose for anyone BUT Californians! They clearly were not interested in doing the right thing. Americans can thank California for regulation that protects consumers.

It seems to me that ChoicePoint’s statements continue to show the antithesis of accountability and reasonable security management.