Leaky S3 bucket sloshes deets of thousands with US security clearance Thousands of files containing the personal information of US citizens with classified security clearance have been exposed by an unsecured Amazon server. The sensitive information of an estimated 9,400 job seekers, mostly military veterans, was stored on an Amazon Web Services S3 storage server that required no password to …
Okay, I get it : your minions make a mistake and, if you're shortsighted, you have two options : alert whomever should be alerted and clean up, risking the loss of the contract or worse, or cover up the situation and make like a hole in the water hoping nobody will notice and everything will go fine.
Except an unsecured server is not a "mistake" these days, it is literally dereliction of duty. Somebody noticed, and the consequence is that TalentPen is "dissolved". With a swift kick, I should hope.
In any case, I'll wager the managers of that particular company are not going to get anywhere near contracts with veterans any more. They must be blacklisted and their names nailed to the wall.
Sorry have to down vote you.
The first question you have to ask... "Did Talent Pen know what information was in the data?"
The answer is yes, they had to know since they are a 'third party recruitment firm' .
The information contained PII (information) and thus they had an implicit obligation to lock that information down.
This isn't to say that they should have clear policies in place, but that their contracts should also have explicit wording on the need to protect PII (information). Note: This wasn't mentioned in the article and it may already exist.
The point is that Talent Pen is clearly at fault.
True, but if I was to hire Tigerswan to review and advise on security, I'd expect any report to include something like "define and implement appropriate security controls for the sharing of data with third parties, and for ensuring the third parties demonstrate compliance". That they didn't enforce that is pretty dismal.
Anything stored in "the cloud" is potentially public. A company recruiting employees for government classified work should know better than to outsource their data storage. Hard drives practically grow on trees these days and job applications/resumes take up hardly any space.
The agency should be banned from all future government work and the execs criminally charged.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
