I have spent the evening reading the figures and information disclosed in the first tranche of the WikiLeaks "cable gate" release.
It would be very easy for me to spend this blog post discussing the aforementioned figures and information. However, as an information security professional I am starting to think that WikiLeaks is actually positive for my chosen profession.
Before I continue and explain my thinking, I must point out that I think the actions of WikiLeaks are deplorable, morally questionable and above all else a danger to the World.
There are some things that must be kept private, even in this world of social media where sharing lots of information about oneself seems to be the norm. Some things are best left unsaid, are they not?
However, returning to my original point, WikiLeaks is making my job easier. Can you think of a better Security Awareness campaign than to have Security and unauthorized disclosure issues so widely reported on every news channel, in every news paper, across the web in it's entirety?
Suddenly those risks which you have been discussing and getting looked at in a funny way with regard to Database security, make sense. The 1.6GB of information was downloaded onto a RW CD containing a Lady Gaga album and distributed.
They were then passed to various news outlets via USB stick, another "tool" with huge risks attached but, I would suggest, risks that have never been so publicly exposed.
What it does highlight though, is the need for pragmatic, effective security controls to be in place, allegedly, these releases were only possibly because the Siprnet database security controls were relaxed to make the system as easy to use as possible.
Of the 251,297 "documents" 133,887 were either unclassified or were "marked" for official use only. Of the rest 15,662 were classified Secret.
In that instance I would question what they were doing on a networked database in the first place. The remaining 101,748 were classified as Confidential.
From this analysis, I would question the levels of marking and the protection required for these levels of classified documents.
Information classification was born in the military, for the system to be exposed in this manner is a cause for concern, from the security control perspective.
This was originally posted at www.markgardner.co.uk
