7 ms·
I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but
by semi-extrinsic 4y ago
I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but I'm sure that this will eventually blow up hard in some company's face - like 9-digit settlement for breach of contract, or worse things like breach of export control laws.
Enterprise data security on the "MS Office level" at this point is like driving 60 mph on a road with no lane dividers. You just pray that you never meet a drunk driver or someone texting in oncoming traffic who suddenly swerves into your lane. You pray that none of your employees click the wrong button and bankrupt the company.
- real_dogbert 4y agoYeah, I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. HIPAA is a hell of a drug.
- colechristensen 4y agoHIPAA is tame compared to export control and classified information handling. Single occurrences can get you 7 or 8 digit fines and prison sentences.
- reaperducer 4y agoI'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. I work in healthcare, and the legal department bars me from using Google Analytics for HIPAA reasons. Meanwhile, IT made Chrome the only browser the employees are allowed to use on every Windows machine in the org.
- happythebob 4y agoDid you read the article? I find your jaded sense of cynicism to be different than critical thought. I don't see any proof in the article posted about its claims. It's just very easy to get jaded, cynical people to support the right headlines on social media. Hacker News, be better.
- nocman 4y agoI don't find reaperducer's comment to be jaded or cynical. It sounds perfectly reasonable to me.
- MichaelCollins 4y agoPowerpoint is the raison d'etre of an entire class of middling bureaucrats. They'll fight tooth and nail to protect their turf and preserve their role in society.
- ohbtvz 4y agoCan you point to the provision of HIPAA that this is violating?
- AyyWS 4y agoYeah. The HIPAA data needs to be encrypted and you have to report everyone who has access and you need patient permission to share. HIPAA is bad, but ITAR violations put you in jail!
- SamuelAdams 4y agoIf you work in healthcare you know not to put HIPPA data in PowerPoint slides to begin with.
- criddell 4y agoWouldn't it be easier to ban putting HIPAA protected information into a PowerPoint? We don't ban telephones just because an employee can read patient records over the phone.
- kibwen 4y agoPowerPoint should be banned for other reasons, we're just looking for an excuse. :)
- real_dogbert 4y agoOf course putting ePHI in PowerPoint presentations should be against policy. The thing is, when it does happen, it's almost always inadvertent. Unfortunately, the "oops, my bad" defense isn't valid against violations of the HIPAA privacy rule.
- giaour 4y agoIf you're putting PHI in a presentation, you probably already have HIPAA problems.
- zmmmmm 4y agoDoctors routinely need to present cases to each other. It often involves pictures of the patient and other identifying information that is essential to describe the case in detail. They need some way to do this.
- jayknight 4y agoAny healthcare institution is going to have a Business Associate Agreement[1] with Microsoft. OneDrive is one of the allowed/suggested ways to transmit PHI where I work. [1] https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
- zmmmmm 4y agoexactly .... people here suggesting that putting any PHI into an office document is intrinsically a HIPAA violation are bonkers.
- giaour 4y agoIsn't the "Design Ideas" request going to the same Sharepoint server that is storing your doctor's OneDrive? I didn't capture and inspect the traffic myself, but https://support.office.com/client/53c77d7b-dc40-45c2-b684-81415eac0617?NS=PPTIM https://support.office.com/client/53c77d7b-dc40-45c2-b684-81... makes the feature sound like it's built into M365 and not sending data to some centralized web service.
- californical 4y agoSure, but a Word document seems much more likely
- thereddaikon 4y agoHIPAA is prescriptive, not descriptive. It does not lay out specific standards to reach. Only overly vague and broad guidelines. Because of this the industry has more or less developed its own best practices that should be good enough. What this means is that healthcare providers have annual audits performed by third parties who check compliance with these "best practices" which may or may not have any relation to what the lawmakers intended. Its ultimately about checking boxes. yada yada security is hard. You can't write a law that describes a security posture and expect to be relevant for more than a year at most.
- autoexec 4y agoI can't believe how many companies in general are leaking massive amounts of sensitive data to Microsoft. With Outlook alone MS much have an incredible amount of data on nearly every business and an unprecedented amount of insight into what they are doing. Windows 10 has only made the problem worse. The last desktop PC I got from my company's IT department had windows 10 on it and it was configured to send every last keypress to MS. Why they had the Windows 10 keylogger enabled I'll never understand, but at least it was easy enough to disable.
- Semaphor 4y ago> is like driving 60 mph on a road with no lane dividers That’s somewhat funny, because a Landesstraße in Germany has no lane dividers and the speed limit is 100 km/h (about 60 mp/h). Unless I’m misunderstanding and lane dividers mean the printed lines.
- cultofmetatron 4y agothe bar to drive in Germany is significantly higher than in the united states. Requirements for getting a drivers license in America is ridiculously lenient because the American lifestyle is completely car centric. taking someone's license away is tantamount to sentencing someone to poverty.
- mejutoco 4y agoI think the other possible effect is the maintenance construction work in the Autobahn, which can create an upper speed limit anyway. Also, only about 70% have no speed limit. https://en.wikipedia.org/wiki/Autobahn https://en.wikipedia.org/wiki/Autobahn (ctrl+f "No speed limit" for a nice table)
- hnbad 4y agoThe Autobahn has a recommended speed of 130 km/h. OP was talking about Landstraßen having a speed limit of 100 km/h. The two are very different kinds of roads. The Autobahn does have concrete dividers and hard shoulders for example. It also has a much more predictable design compared to a Landstraße.
- mmmpop 4y agoGermany makes you get a license to play golf. It sounds extreme at first blush but when you start to think about it...
- rjsw 4y agoSame speed limit in the UK, and there are roads without painted lines.
- i_am_proteus 4y agoAfter the issues with Github Copilot and copyrighted code, my mind is drawn towards similar inadvertent leaking of proprietary information via a model trained on that information.
- hef19898 4y ago+1 for the export control stuff, even if I think it might be worse for MS than for the actual customer. At least I hope... Edit: As was pointed out elsewhere, the phoning home stuff can be turned off at org level. So MS will not be affected by any fallout of potential export control violations.
- thomascgalvin 4y ago> worse things like breach of export control laws The entire Department of Defense runs on PowerPoint, along with all of their contractors. It is not at all uncommon to produce slide decks that are either classified or covered by ITAR; this is a disaster waiting to happen.
- jimnotgym 4y agoDo they run on the same infrastructure as the rest of us?
- 0xbadcafebee 4y agoNo. DOD/Gov projects can be hosted in completely secure locations, and Azure for Government follows all the required standards. Office365/Sharepoint supports FedRAMP High. Most agencies are in the process of finishing migrations so that both their desktop and online apps use the same data in secure cloud installations.
- ssteel 4y agoSometimes classified leaks onto unclassified networks via human mistake, coincidence, or ignorance. I've literally seen classified PowerPoint slides marked unclassified due to ignorance. This situation requires security to confiscate all machines the data may have leaked to.
- jyrkesh 4y agoOh, I've absolutely seen similar, and I don't doubt it's extremely commonplace. But Microsoft generally supports policies for enforced disabling features like the one referenced in the post. Similarly, data exfiltration from managed to non-managed devices is an entire cottage industry. And generally that's why govt employees are expected to use separate, locked down devices where their compliance-obsessed (hopefully, but not always in practice) admin has total root. And I don't believe you're implying this, but certainly I don't think it makes sense for companies to _not_ build internet/cloud-connected experiences and features just because there's a possibility that govt officials won't follow their own security policies and best practices.
- andylynch 4y agoThis kind of thing in particular should make banks' compliance departments more nervous than usual - Powerpoint is a really key tool for deal teams, and the behaviour is here might just be obscure enough to be missed by people tasked with stopping price-sensitive information slipping out the door.
- phpisthebest 4y agoI am surprised you believe the vast majority of power point users would be handling information that could even breach export laws, or that even the majority of users are making power points to present to people of other nations... I bet that is less than .01% of all power points created in the world