HMRC data loss 'completely predictable'

'Old, outdated and broken processes,' says Symantec

Written by Ian Williams

Security firm Symantec has told vnunet.com that it was "not at all surprised" by the recent catastrophic data loss at HM Revenue and Customs.

"At least this time it was spotted, even if it was some weeks later," said Guy Bunker, chief scientist at Symantec. "How many times has something similar happened that went completely unnoticed or unreported?"

Advertisement

Bunker reckons that the junior employee who was responsible for the data breach was probably just doing his job and had no idea of the implications of his actions.

"I am sure he does the exactly the same every time there is a similar request. He probably just presses 'option five' on the screen with no idea about what happens at the back end," he said.

Bunker maintained that the loss of two disks containing the details of 25 million Britons was simply down to "processes that are old, outdated and broken ".

He added that this must act as a wake up call to all government departments and private organisations to address all instances where potentially sensitive information is dealt with by staff.

Sadly Bunker is sceptical about whether anyone will learn from the incident. He cited the lack of impact caused by previous high profile data leaks, such as those at Nationwide and TK Maxx.

An all too prevalent 'this won't happen to us' mentality means that most organisations will not learn from the HMRC case and tackle potential pitfalls in their own policies.

Bunker suggested that a fine similar to the one handed to Nationwide might encourage some companies to sit up and take notice as they will not want to incur a similar penalty.

"But, ultimately, fining the government is not of much use to the people who have had their details lost," he said.

Companies and governments must understand and question the procedures and policies they implement, and these systems to be investigated to make sure they conform to the required security standards.

Bunker concluded that legislation forcing companies to disclose data breaches, as happens in some US states, may be necessary to ensure that customers are as protected and well informed as possible. "Forewarned is forearmed," he said.

Tags:

Further reading

Related whitepapers

Related jobs

Do you agree?

IT white papers

Search vnunet IThound

Top categories

Job of the week

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Hiring now on ComputingCareers:

Related IT jobs

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Enter email address to edit your newsletter preferences

Watch

Shaun Nichols and Iain Thomson

10 Oct 2008

7.33 MBPodcast Special: Views from the Valley More...

Podcast image

09 Oct 2008

12.99 MBComputing podcast - IT implications of the banking crisis, and the FSA clamps down on IT security More...

Shaun Nichols and Iain Thomson

03 Oct 2008

6.49 MBPodcast Special: Views from the Valley More...

Poll

Google Android

Google Android

Are you intending to try out a Google Android mobile phone?

Previous poll results

Spotlight

MoD building

Latest data breach leads MPs to demand culture change

MoD admits to losing a hard drive containing up to...  More...

Online shopping

E-retailers urged to prepare for Christmas

Credit crunch sending shoppers online for cheaper presents   More...

Mobile phone

Emerging markets drive mobile growth

Mobile penetration rates expected to reach 95 per cent by...  More...

Digital information

Poor data classification costing companies dear

Millions wasted on searching through clutter, says analyst   More...

Primary Navigation