Over the past few months during some of my presentations I’ve discussed how easily PII can be stored on mobile storage devices that most business leaders and information security folks often do not think about or overlook. One of those devices is the innocent-looking and seemingly benign MP3 player, such as the cool ipod. You gotta love’em! I know I love mine. However, a couple of times when I talked about how easy it is to store large amounts of company data, including personally identifiable information (PII), onto MP3 players, I got some noticeable snickers and sneers from a few in the audience who apparently thought such an idea was preposterous!
Well, here are a couple of different news articles that demonstrates otherwise; both about the same incident, but each with slightly different information…
“NZ man accesses US military secrets” and “NZ man finds US military files on MP3 player“.
Files…reportedly 60 pages worth…of PII about U.S. military members were on an MP3 player a young man from New Zealand purchased for $15 – $18 from an Oklahoma thrift shop.
NOTE: The U.S. Department of Defense banned the use of “portable data storage devices” in November 2008.
If data can be stored on any type of device, you can bet that it will be, even if the primary use for the device is not for data storage
Tags: awareness and training, Information Security, ipod security, IT compliance, IT training, mobile security, policies and procedures, privacy breach, privacy training, risk management, security incident, security training