IT Auditor Borrowed a Partitioned Encrypted USB of mine

Neon_Lights · 19-12-2013 10:05PM #1

She also proceeded to leave a lot of sensitive company documents on it relating to our systems? What should I do.... should I bring it to my managers attention... I know I could be potentially be in the wrong for giving her the usb key (but then again theres nothing stopping her going out and buying her own), but also there is a side of sloppiness of her not deleting the information off of it.

Edit: the documents were in the unencrypted part

uck51js9zml2yt · 19-12-2013 11:02PM

in my opinion most definitely

syklops · 20-12-2013 12:44AM

We'll need more details.

My read so far:

External IT Auditor comes into company, asks to borrow USB disk(why is there no universal name for them yet?), half is encrypted, half is not, she leaves company files on unencrypted part with the guy who she borrowed it from who presumably works in IT for the company she is auditing.

What is she auditing? PCI? ISO27k1?

That aside, I'm not sure of the problem? If you are using strong crypto on your USB stick, you dont need to worry. The docs she looked at stayed on the stick. What are you worried about?

Edit:

You said its sensitive information. Is it above your security clearance? If so, then report to your manager straight away.

Khannie · 20-12-2013 10:50AM

syklops wrote: »

You said its sensitive information. Is it above your security clearance? If so, then report to your manager straight away.

Yep.

If not, just delete and move on. It's stuff you already have access to.

Blowfish · 20-12-2013 11:42AM

Khannie wrote: »

If not, just delete and move on.

I wouldn't say that, I'd have serious questions of the competence of an auditor who leaves the organisation they are auditing open to potential loss of sensitive data. At the very least whomever in the organisation is responsible for InfoSec should be made aware of it.

Khannie · 20-12-2013 12:06PM

Blowfish wrote: »

I wouldn't say that, I'd have serious questions of the competence of an auditor who leaves the organisation they are auditing open to potential loss of sensitive data. At the very least whomever in the organisation is responsible for InfoSec should be made aware of it.

Unless I'm missing something, there is no potential loss of data. I agreed with reporting if the data is outside the USB key holders security level.

Blowfish · 20-12-2013 12:20PM

Khannie wrote: »

Unless I'm missing something, there is no potential loss of data. I agreed with reporting if the data is outside the USB key holders security level.

It depends on how paranoid you are I suppose. For us, storing any non-public data in an unencrypted format is at the very least going to result in a slap on the wrist. The fact that nothing occurred from it in this instance is irrelevant, it's the fact that they are using poor practices and could lead to potential future data loss if say during the next audit, the auditor popped the USB key in their pocket while on lunch and then it was lost/stolen.

This is why I said the InfoSec guys should know so they can at the very least give out to the auditor so it doesn't reoccur.

Neon_Lights · 21-12-2013 12:39AM

Hi guys,

thanks for the help, have read through everything and some interesting points. What I did in the end was read through the files which contained a lot of internal business system information, Access controls, server and port mappings to the applications, and sensitive data extracts from system tables. Safe to say I deleted them as that our systems admins and dba's should know. I did not bring it to the attention of the person in charge of IT Security yet but will do in the new year.

I do feel partially to blame it was sloppy on my part admittedly, but thought it was awfully sloppy on the part of the Auditor. It makes me question the value of the practice seeing as a "professional" in one if nor more areas highlighted above would leave a window open for a customers data being exploited. Not sure which area of IT audit they are doing, its not my job to know, although saying that it makes me wonder should I find out.

As for being paranoid, I do think you have to take this point of view with information security in this day and age. If information like this gets into the wrong hands it can do reprehensible damage to a company, both in terms of its IT and day to day operations.

Edit: The information out of my remit for the particular systems they were viewing, but I do have access rights to it on other systems which I operate.

Victor · 21-12-2013 12:55AM

It is quite possible this was part of the test.

You were meant to report it to your manager.

syklops · 21-12-2013 09:57PM

Im curious what the OPs role is in the company and the circumstances in which the auditor borrowed the USB drive from him.

I go into companies a lot for Pen Testing, PCI compliance checks and so on. Usually, you are put sitting next to the IT team, or the InfoSec team. Is it possible the auditor assumed the OP was a member of the IT or InfoSec teams and thought the documents would be safe with him.

hmmm · 22-12-2013 04:41PM

I've rarely (with only a few exceptions) come across an IT auditor that had much of a clue about security and I'm not surprised one wouldn't be able to figure out how to use an encrypted partition. Tick the box merchants, straight out of college for the most part obsessed with password length and other security settings that were relevant in the 80s.

syklops · 22-12-2013 08:31PM

hmmm wrote: »

I've rarely (with only a few exceptions) come across an IT auditor that had much of a clue about security and I'm not surprised one wouldn't be able to figure out how to use an encrypted partition. Tick the box merchants, straight out of college for the most part obsessed with password length and other security settings that were relevant in the 80s.

I agree on all counts except password length. Still very much relevant. I get irritated with complicated password requirements when length really is all that matters.

Khannie · 22-12-2013 09:47PM

syklops wrote: »

I agree on all counts except password length. Still very much relevant. I get irritated with complicated password requirements when length really is all that matters.

Two dictionary words might make a long password, but it's potentially very weak. I generally think everyone should use keepass or similar.

syklops · 22-12-2013 09:55PM

Khannie wrote: »

Two dictionary words might make a long password, but it's potentially very weak. I generally think everyone should use keepass or similar.

Not two. Four or five at least.

Im not convinced with keepass. I tried writing my own, but I couldnt give it the time it needed.

The truth is, in a lot of cases the length and configuration of the password, is irrelevant. What matters is the hash it gets stored as.

Anyway we digress.

ChRoMe · 28-12-2013 12:57PM

syklops wrote: »

Not two. Four or five at least.

Im not convinced with keepass. I tried writing my own, but I couldnt give it the time it needed.

The truth is, in a lot of cases the length and configuration of the password, is irrelevant. What matters is the hash it gets stored as.

Anyway we digress.

Indeed

Keyzer · 30-12-2013 01:18PM

Blowfish wrote: »

I wouldn't say that, I'd have serious questions of the competence of an auditor who leaves the organisation they are auditing open to potential loss of sensitive data. At the very least whomever in the organisation is responsible for InfoSec should be made aware of it.

Agree 100%...

hmmm wrote: »

I've rarely (with only a few exceptions) come across an IT auditor that had much of a clue about security and I'm not surprised one wouldn't be able to figure out how to use an encrypted partition. Tick the box merchants, straight out of college for the most part obsessed with password length and other security settings that were relevant in the 80s.

Agree 100%...

OP: You should've reported it to your information security department. If it was part of a test, which I doubt it was, then you've failed. Regardless, this kind of incompetence should not be tolerated from a company your employer is, most likely, paying a small fortune to for this service.

Doge · 02-01-2014 09:33PM

Keyzer wrote: »

OP: You should've reported it to your information security department.

If they have one that is! I have yet to work for a company that has someone working in information security!

syklops · 03-01-2014 08:54PM

Have we established what the the auditor was auditing yet?

Was it PCI? ISO 27k1? Something else?

Keyzer · 04-01-2014 11:27PM

waveform wrote: »

If they have one that is! I have yet to work for a company that has someone working in information security!

Report it to the IT Manager, if no IT Manager then a senior manager from the business...

IT Auditor Borrowed a Partitioned Encrypted USB of mine

Comments