Irs Blamed In Massive South Carolina Data Breach

#1 PCWorld

Advanced Member

Group: PCWorld BOT
Posts: 103,722
Joined: 01-August 07

Posted 21 November 2012 - 06:01 AM

Post your comments for IRS blamed in massive South Carolina data breach here

#2 SirTekaLotw6xs

Advanced Member

Group: Members
Posts: 111
Joined: 07-August 11

Posted 21 November 2012 - 06:10 AM

I don't understand why Mr. Etter has to resign if he did nothing wrong?

#3 Victarr

Newbie

Group: Members
Posts: 1
Joined: 23-January 08

Posted 21 November 2012 - 06:54 AM

As with all government jobs, its not what he did, its what others think he could have done. It seems that all government employers like to use others as scape goats to make themselves look like they are addressing the problems that occurred on their watch. So Mr. Etter pays the price.

(

#4 ReadandShare

Advanced Member

Group: Members
Posts: 204
Joined: 31-January 12

Posted 21 November 2012 - 10:30 AM

SC blamed the IRS because the IRS did not mandate encryption of sensitive data?? C'mon!! SC's own DOR personnel should know better.

Now, if the IRS had forbade encryption, then it would deserve blame -- but that wasn't the case, was it?

#5 mikearm

Newbie

Group: New Member
Posts: 2
Joined: 24-October 12

Posted 21 November 2012 - 10:34 AM

Encrypting SSN's has long been a "best practice" and any IT manager should know that.

#6 samies

Newbie

Group: New Member
Posts: 1
Joined: 05-November 12

Posted 21 November 2012 - 12:57 PM

Quote

Encrypting SSN's has long been a "best practice" and any IT manager should know that.

They would have had to pay some IT person more than $10 an hour to do that... I'm in IT and SC taxpayer. I want blood! But it isn't the IRS'!

#7 KrystalKlear

Newbie

Group: New Member
Posts: 1
Joined: 22-November 12

Posted 22 November 2012 - 05:13 AM

It's the fault of the 1970's equipment! It's the fault of the IRS for not requiring the encryption of Social Security numbers! I'm surprised they didn't include sun spots, solar flares and bad juju.

#8 johnsiem

Newbie

Group: New Member
Posts: 1
Joined: 22-November 12

Posted 22 November 2012 - 12:04 PM

There are so many questions I want to ask. Did their endpoint security detect an intrusion? Was someone asleep at the security console? How aggressive is their user security awareness training? What countermeasures and detection systems did they have to prevent an information breach? How compliant were they with PCI DSS?

I've dealt and worked in security circles for awhile and understand two universal truths. One, while company decision makers watch the news on breaches, they've convinced themselves that breaches won't happen to them and therefore avoid the whole topic. Two, cybercriminals are attacking employees with the good ole fashion email. Further complicating things, truth ONE keeps truth TWO from being a topic for action in executive meetings.