Infosec Blunder by Infosec Specialist (supposedly)

Seven days ago I received 'Infosec Consultant' job prospect news from **** Recruitment by email, but did not reply; an Infosec Consultancy wants to contract security consultants.

Today I received unsolicited news update direct from ****'s client, which included the email contact details of hundreds of job seekers listed in ****'s data base including the name of ****' staff... oops!

Update: One week on, the same from a Financial Services firm!

Now the question is - who is the more stupid?

1)

Dear Terry,

Please accept my apologies on behalf of **** Recruitment for this unfortunate incident. **** has strict procedures and controls in place for sending out e-shots and electronic mailers to candidates to ensure that incidents of this nature do not occur. The recruitment consultants all receive training on their obligations under the Data Protection Act and are required to use an email maker system that ensures all recipient email addresses are blind copied.

I can assure you that we take incidents of this nature very seriously and a full investigation will be conducted. Disciplinary action will be taken if it is found that the consultant concerned has not followed the correct procedure for sending communications to multiple recipients.

I can confirm your details have been unsubscribed from our database.

I trust that I have been able to provide sufficient clarification and I thank you for bringing this matter to our attention.

Kindest Regards,

****

2)

Dear Mr McKenna,

I can only apologise for the distress the inadvertent disclosure of your contact details has caused, and as requested I have removed your contact details from our database.

Whilst this disclosure was caused by human error on the part of a ***** employee, I have taken internal disciplinary action against the employee concerned as we are committed to protecting our clients Personal Data and a disclosure of this nature even if it was unintentional, is simply unacceptable.

Should you wish to discuss this matter further please do not hesitate to contact me directly on Tel ...

Kind regards

James

How To Evade Job-Scam Victimization

A Job seekers Guide to Basic Digital Forensic Investigation using actual Email Phoney Job Invitation Dear Terry, We decided to include you in the list of potential candidates after we reviewed your resume on Jobsite. We decided to offer you the position of TS Associate in our company. This is Part-time home based role and most of the work can be done in a comfort of your own home. We invite you to apply online on our website: http://marfigroup.com/careers/tsa/ Please include your telephone numbers along with your application and our HR staff will be back with you for telephone interview. We hope that our offer will make a positive influence on your potential career change and you will become one of our valued employees. Thank you, Charles Panter HR Department First Glance At first glance nothing alarming stands out and 'Jobsite' does have a copy of my CV. The mandatory unsubscribe link is there and is managed by 'Constant Contact' which, so far, all seems ...

All things Internet - a List of References

Published guidance NCSC’s guidance is aimed at helping UK government departments, agencies, the critical national infrastructure and its supply chains protect their information and systems. It also has relevance for local government and the wider public sector. https://www.ncsc.gov.uk/index/guidance?page=1 ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of expertise for cyber security in Europe. https://www.enisa.europa.eu/topics Expectations for Computer Security Incident Response https://tools.ietf.org/rfc/rfc2350 Internet Security Glossary https://www.ietf.org/rfc/rfc2828.txt PKCS #10: Certification Request Syntax Specification Version 1.7 https://tools.ietf.org/rfc/rfc2986.txt Guidelines for Evidence Collection and Archiving https://www.ietf.org/rfc/rfc3227.txt

SOCIAL MEDIA IN RURAL AREA: A COMMUNITY POLICE CASE STUDY

"MyPolice" proprietary social media software product, which was studied in this investigation, has not yet been deployed commercially and appears to be dormant. My conclusion that community-run rather than enterprise-run is the better method to manage this sort of social media tool might be correct, given than MyPolice seems to be dormant. Social_Media_in_Rural_Area.pdf Abstract: Computer-Mediated Communication (CMC) has evolved from email and simple bulletin boards to live text feeds and elaborate Social Networking Sites (SNS) some of which have gained cult-like status. The pervasiveness of Social Media (SM) within the CMC landscape has inspired social-entrepreneurs and software developers to create civic-centric communication platforms for civic engagement rather than vanity-centric for personal satisfaction. As the Internet becomes the default communication method by the will of Government the need to be connected to the world by the Ethernet increases. Bu...

Terry McKenna

Search This Blog