Webproze Labs

hmm

2009-09-02T19:53:00.000-07:00

Is it wrong that I named my fantasy football team "Vick's Dog-sitting Service"?

Tell me this ain't true

2008-03-04T07:21:00.001-08:00

"Hacker Safe"? I don't think so

2008-01-09T05:42:00.000-08:00

In the first announced of what I'm sure will be many more, a site experienced a data compromise despite the fact that they subscribe to ScanAlert, a service where the site is scanned daily for vulnerabilities. BTW, in October, McAfee announced that they would be purchasing ScanAlert. Coincidence? I think not.

You can read more information here, but if you're a customer of Geeks.com, you may want to start checking your snail mail for a notification from them about your data being compromised. You may also want to check your credit card statement on a daily basis.

Just throwin that out there.

Run a Mac and think you're safe?

2006-03-07T07:52:00.000-08:00

Think again

Bad week for CPA firms

2006-03-02T11:10:00.000-08:00

Deloitte and Touche suffered a bit of an image hit when one of their auditors left a CD that held the stock holding information for thousands of McAfee current and former employees. The data was not encrypted. Staffers were offered a two-year membership to a credit monitoring program offered by Experian.
A PriceWaterhouseCoopers employee had a laptop with data from 4000 patients of University of Texas M.D. Anderson Cancer Center. PWC says that the data was encrypted using a 'sophisticated encryption software'. (*Probably an Excel spreadsheet with a password on it-jj)

From personal experience, after having worked for a CPA firm, it's regular practice to have gigabytes of client information on a laptop and not have that data encrypted. This isn't just something that's happened at the firm I worked, but at several firms that I had interaction with during my tenure there. Data was frequently shared between the internal auditors and external auditors, and when I would send it encrypted, was told on a regular basis by clients and other auditors as well "Why do you encrypt it, no one else at your firm, outside of your security group does?", or "We don't encrypt stuff we send to you, just send it to me unencrypted (other firms)".

If you look over the news in the last several years, there are a multitude of cases where data has been stolen from CPA firms or lost by them, thanks to their poor security practices. If hackers were smart, they'd start targeting the REAL sources of information storage. You hack one company, you get their data. You hack a CPA firm, you get hundreds or thousands of companies data. And no amount of compliance with PCAOB will change that. Talk about your inmates running the asylum.....