4 ms·

Anyone who had any confidential data in Dropbox (medical research data, credit card transaction data) must now file a data breach report.

abofh 15y ago
And anyone who stored that sort of data in dropbox more or less had it coming. HIPAA & finance laws are very clear about the security they require -- dropbox has always been hand-wavey in their explanation of their security.
- tptacek 15y ago
  What's your point? The IT guys can't catch a break, can they? If they say "no you can't install stuff on your machine", message board geeks are up in arms. But when normal people, for whom these computer systems are designed in the first place, make (layperson-) reasonable decisions about what folders to put files in, there's the message board geek again, harassing them for not understanding how transparent cloud file sync works under the covers and interacts with regulated data.
  - abofh 15y ago
    If you're a 'normal person', you shouldn't be making decisions about the security of my health-care or financial data; If you're in the position to make that decision, you should have been aware that dropbox was not a "safe" third party; On the part of the _users_ of dropbox, I have empathy; In part of those running their medical/finance business on assumptions of dropboxes security, I have nothing but emnity.
    - tptacek 15y ago
      I hate to be the one to break this to you†, but normal people make up almost the entire chain of custody for regulated data. Normal people write your health records. Normal people check them out of databases and read them. Normal people load them into spreadsheets. Normal people generate reports. Businesses do not exist to support super-savvy BOFH's. It is rather the other way around. † Ok, no I don't
      - abofh 15y ago
        I didn't say they do, but they should hire people competent to make educated decisions in the regulatory environment they're in. That's why they pay bofhs -- not because they like our views, but because we _read_ the specs. EDIT: To phrase less hostilely -- HIPAA and various finance laws consist of thousands of pages of what to do and what not to do. Dropbox is a shiney webpage that isn't PCI certified or HIPAA certified. If you chose to operate in a business that requires HIPAA/PCI, and used dropbox for that data, _you_ are at fault, not dropbox, not the bofhs, and not the coder. In the case of HIPAA - you would be the criminal.
        ZoFreX 15y ago
        Friend of mine worked for a drug company, medical data on patients (they were handling the side-effect reports) was just emailed around, and I know they had work documents on their home computer.
        abofh 15y ago
        I would never be foolish enough to say it _doesn't_ happen, simply that the rules say it _mustn't_ happen. Anyone who ends up complaining that they're forced to disclose because they didn't follow best practices, just learned why they're best practices. I admit readliy it's mostly the problem of bad luck (being targeted) or careless (losing emailed reports w/ identifying data <g>) - but if and when that drug company gets sued for something like that, guess which side the law will be on?
        kevin_morrill 15y ago
        HIPAA does not have thousands of pages on what and what not to do. It's actually quite vague, and mostly comes down to fines after the fact. There's also no such thing as a government sanctioned HIPAA certification. There's just random people willing to 'certify' you.
        tptacek 15y ago
        The HIPAA data security requirements are tiny and largely boil down to "data should be encrypted in transit and at rest and require access control". http://law.justia.com/cfr/title45/45-1.0.1.3.70.3.33.6.html http://law.justia.com/cfr/title45/45-1.0.1.3.70.3.33.6.html
- MarketingMuppet 15y ago
  The problem is just that they haven't been! According to their TOS until just over a month they were HIPAA compliant as a secure online service abiding by the set rules.
pavel_lishin 15y ago
Do people really store confidential business data like that in dropbox?
- tptacek 15y ago
  Very yes (we don't allow Dropbox† on our machines, but we know of companies that rely on it). Grandalf's point is extremely well taken. It's actually true. Not only that, but regulated companies (in health care and finance) that have a reasonable belief that any of their systems might have had Dropbox on them technically need to audit now. I point this out not to bag on Dropbox, but as an illustration of how sane some unreasonable-sounding IT policies (like, "you don't get to install random software on your desktop") turn out to be. † (Or Tarsnap or SpiderOak, for what it's worth.)
  - lawnchair_larry 15y ago
    Why not Tarsnap?
    - tptacek 15y ago
      I like Tarsnap. If I had to recommend a 3rd party storage vendor, it would be Tarsnap.
      - lawnchair_larry 15y ago
        I know, but that doesn't answer my question. Why is it banned at your shop?
        pavel_lishin 15y ago
        If I had to guess, I'd say it's because they cannot prove to a third party that it meets all HIPAA (or insert your own group here) requirements.

abofh 15y ago

And anyone who stored that sort of data in dropbox more or less had it coming. HIPAA & finance laws are very clear about the security they require -- dropbox has always been hand-wavey in their explanation of their security.

tptacek 15y ago
What's your point? The IT guys can't catch a break, can they? If they say "no you can't install stuff on your machine", message board geeks are up in arms. But when normal people, for whom these computer systems are designed in the first place, make (layperson-) reasonable decisions about what folders to put files in, there's the message board geek again, harassing them for not understanding how transparent cloud file sync works under the covers and interacts with regulated data.
- abofh 15y ago
  If you're a 'normal person', you shouldn't be making decisions about the security of my health-care or financial data; If you're in the position to make that decision, you should have been aware that dropbox was not a "safe" third party; On the part of the _users_ of dropbox, I have empathy; In part of those running their medical/finance business on assumptions of dropboxes security, I have nothing but emnity.
  - tptacek 15y ago
    I hate to be the one to break this to you†, but normal people make up almost the entire chain of custody for regulated data. Normal people write your health records. Normal people check them out of databases and read them. Normal people load them into spreadsheets. Normal people generate reports. Businesses do not exist to support super-savvy BOFH's. It is rather the other way around. † Ok, no I don't
    - abofh 15y ago
      I didn't say they do, but they should hire people competent to make educated decisions in the regulatory environment they're in. That's why they pay bofhs -- not because they like our views, but because we _read_ the specs. EDIT: To phrase less hostilely -- HIPAA and various finance laws consist of thousands of pages of what to do and what not to do. Dropbox is a shiney webpage that isn't PCI certified or HIPAA certified. If you chose to operate in a business that requires HIPAA/PCI, and used dropbox for that data, _you_ are at fault, not dropbox, not the bofhs, and not the coder. In the case of HIPAA - you would be the criminal.
      - ZoFreX 15y ago
        Friend of mine worked for a drug company, medical data on patients (they were handling the side-effect reports) was just emailed around, and I know they had work documents on their home computer.
        abofh 15y ago
        I would never be foolish enough to say it _doesn't_ happen, simply that the rules say it _mustn't_ happen. Anyone who ends up complaining that they're forced to disclose because they didn't follow best practices, just learned why they're best practices. I admit readliy it's mostly the problem of bad luck (being targeted) or careless (losing emailed reports w/ identifying data <g>) - but if and when that drug company gets sued for something like that, guess which side the law will be on?
      - kevin_morrill 15y ago
        HIPAA does not have thousands of pages on what and what not to do. It's actually quite vague, and mostly comes down to fines after the fact. There's also no such thing as a government sanctioned HIPAA certification. There's just random people willing to 'certify' you.
        tptacek 15y ago
        The HIPAA data security requirements are tiny and largely boil down to "data should be encrypted in transit and at rest and require access control". http://law.justia.com/cfr/title45/45-1.0.1.3.70.3.33.6.html http://law.justia.com/cfr/title45/45-1.0.1.3.70.3.33.6.html
MarketingMuppet 15y ago
The problem is just that they haven't been! According to their TOS until just over a month they were HIPAA compliant as a secure online service abiding by the set rules.

pavel_lishin 15y ago

Do people really store confidential business data like that in dropbox?

tptacek 15y ago
Very yes (we don't allow Dropbox† on our machines, but we know of companies that rely on it). Grandalf's point is extremely well taken. It's actually true. Not only that, but regulated companies (in health care and finance) that have a reasonable belief that any of their systems might have had Dropbox on them technically need to audit now. I point this out not to bag on Dropbox, but as an illustration of how sane some unreasonable-sounding IT policies (like, "you don't get to install random software on your desktop") turn out to be. † (Or Tarsnap or SpiderOak, for what it's worth.)
- lawnchair_larry 15y ago
  Why not Tarsnap?
  - tptacek 15y ago
    I like Tarsnap. If I had to recommend a 3rd party storage vendor, it would be Tarsnap.
    - lawnchair_larry 15y ago
      I know, but that doesn't answer my question. Why is it banned at your shop?
      - pavel_lishin 15y ago
        If I had to guess, I'd say it's because they cannot prove to a third party that it meets all HIPAA (or insert your own group here) requirements.