Experts say Aussie Government data deletion an avoidable fiasco

Australian Government data deletion fiasco easily avoided

London 17th March 2009 - Cyber-Ark, the digital data vaulting expert, says the deletion of more than 10,000 Government records in Australia's Northwest Territory by the drunken ex-fiancee of an IT staffer highlights the need for protection of critical user IDs and passwords.

"Reports are coming in of the deletion of 10,475 user accounts on the North West Territories' health, court and prison service's computer systems in a drunken rage after one member of IT staff terminated a relationship with another IT employee," said Mark Fulbrook, Cyber-Ark's UK and Ireland Director.

"The plain fact of the incident - which cost five days and around A$1.25 million to resolve - is that high level IDs such as that operated by the lady concerned should never have been accessible to ordinary members of staff. They should have been stored digitally and only accessed on an auditable basis by designated members of staff with specific authority for a given user session," he added.

According to Fulbrook, high level administrator IDs such as the one misused in the Northwest Territories data deletion incident, should have been protected by an authenticated protection system and the use of one-time transaction access numbering (TAN) technology.
By using an auditable data vaulting protection system, allied with one-time TANs, even if the male member of staff had been able to discover his fiancee's login details, the staffer could not have deleted the user account data without a TAN, he said.

The incident, says Fulbrook, is a classic case of insufficient multi-stage security being applied to high level administrator IDs and passwords.

The technology required to protect administrator IDs and passwords, he explained, is now available at relatively low cost, and is therefore deployable in a wide variety of IT situations.
"Data vaulting technology is no longer the expensive option that many people think it is. It's cost-effective, easily deployable and, perhaps more importantly, can be integrated with other audit and user account control systems," he said.

For more on the Australian `drunken rage' data deletion incident: http://tinyurl.com/cxkpd4

For more on Cyber-Ark: http://www.cyber-ark.com

Yvonne Eskenzi, Eskenzi PR
<>