Skip to main content

Infosec Blunder by Infosec Specialist (supposedly)

Seven days ago I received 'Infosec Consultant'  job prospect news from **** Recruitment by email, but did not reply;  an Infosec Consultancy wants to contract security consultants.

Today I received unsolicited news update direct from ****'s client, which included the email contact details of hundreds of job seekers listed in ****'s data base including the name of ****' staff... oops! 

Update: One week on, the same from a Financial Services firm! 

Now the question is - who is the more stupid?



1)
 
Dear Terry,

Please accept my apologies on behalf of **** Recruitment for this unfortunate incident. ****  has strict procedures and controls in place for sending out e-shots and electronic mailers to candidates to ensure that incidents of this nature do not occur. The recruitment consultants all receive training on their obligations under the Data Protection Act and are required to use an email maker system that ensures all recipient email addresses are blind copied. 

I can assure you that we take incidents of this nature very seriously and a full investigation will be conducted.  Disciplinary action will be taken if it is found that the consultant concerned has not followed the correct procedure for sending communications to multiple recipients.

I can confirm your details have been unsubscribed from our database.

I trust that I have been able to provide sufficient clarification and I thank you for bringing this matter to our attention.

Kindest Regards,

 ****  

2)
 
Dear Mr McKenna,

I can only apologise for the distress the inadvertent disclosure of your contact details has caused, and as requested I have removed your contact details from our database. 

Whilst this disclosure was caused by human error on the part of a ***** employee, I have taken internal disciplinary action against the employee concerned as we are committed to protecting our clients Personal Data and a disclosure of this nature even if it was unintentional, is simply unacceptable.

Should you wish to discuss this matter further please do not hesitate to contact me directly on Tel ...

Kind regards

James

Labels:

Popular posts from this blog

How To Evade Job-Scam Victimization

A Job seekers Guide to Basic Digital Forensic Investigation using actual Email Phoney Job Invitation Dear Terry, We decided to include you in the list of potential candidates after we reviewed your resume on Jobsite. We decided to offer you the position of TS Associate in our company. This is Part-time home based role and most of the work can be done in a comfort of your own home. We invite you to apply online on our website: http://marfigroup.com/careers/tsa/ Please include your telephone numbers along with your application and our HR staff will be back with you for telephone interview. We hope that our offer will make a positive influence on your potential career change and you will become one of our valued employees. Thank you, Charles Panter HR Department First Glance At first glance nothing alarming stands out and 'Jobsite' does have a copy of my CV.   The mandatory unsubscribe link is there and is managed by 'Constant Contact' which, so far, all seems ...
Read more

Amazon must be missing me - really!

Christmas goods are appearing on shop shelves now and email offers are filling the inbox -but that's not really news. What's news to me is Amazon.com must be missing me as they have sent me email telling me they have products that would interest me - really! You see, being such a big spender (a whopping £90 in just 12 months) on Amazon.co.uk they (Amazon.com) have got this jealousy hang up right before Christmas and sent me SPAM - really! On the otherhand it may be a test - they've been looking at my LinkedIn profile recently and perhaps want to test my information assurance knowledge. So, if you're reading, the email had no obligatory unsubscribe or update preference option and I didn't give Amazon UK permission to share my details. By the way, since I use DuckDuckGo most ads are irrelevant and would I want to import Bluetooth earphones and pay all that shipping - really!
Read more

All things Internet - a List of References

Published guidance NCSC’s guidance is aimed at helping UK government departments, agencies, the critical national infrastructure and its supply chains protect their information and systems. It also has relevance for local government and the wider public sector. https://www.ncsc.gov.uk/index/guidance?page=1 ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of expertise for cyber security in Europe. https://www.enisa.europa.eu/topics Expectations for Computer Security Incident Response https://tools.ietf.org/rfc/rfc2350 Internet Security Glossary https://www.ietf.org/rfc/rfc2828.txt   PKCS #10: Certification Request Syntax Specification Version 1.7 https://tools.ietf.org/rfc/rfc2986.txt   Guidelines for Evidence Collection and Archiving https://www.ietf.org/rfc/rfc3227.txt
Read more