And that’s why you want to have backups of your data.

But if the worse happens, and you lose your data, a backup isn’t going to be any help at all if you find you can’t restore from it, or if the backup is corrupted.

This truth is underlined quite delightfully in this video about how Pixar’s fantastic movie “Toy Story 2″ was nearly flushed down the toilet due to not checking that the backups were working properly.

 For those who are interested, it appears that the backup software being used by Pixar at the time was failing to deal elegantly with a “full disk” situation, and thus hiding messages that the backup was falling over.

Lesson – CHECK YOUR BACKUPS!

Need Help? – 08456 800 139 – Email Matt Torrens

The US Patriot Act has struck fear into European users but don’t forget that our authorities have powers too.

The USA Patriot Act probably ranks alongside Sarbanes-Oxley in terms of recognition and fear of US legislation outside the US. It is widely known that this is the means by which FBI can get access to confidential data and the reason that some UK businesses may be holding back from cloud adoption, preferring an on-premise solution. But are they right to fear the Patriot Act?

The EU data protection regime prevents the transfer of data outside the European Economic Area to a country with inadequate data protection laws or unless the recipient will provide the adequate protection. The European Commission keeps a list of safe countries. Canada and Switzerland are on this list and so is the EU-US negotiated self-regulated Safe Harbor. Most of the large US cloud providers have signed up to the Safe Harbor principles which allow them to transfer data from the EU to the US. The EU Commission is proposing to extend data protection in its proposed new data protection regulation by stating that it applies to EU data held outside the EU.

The USA Patriot Act was passed shortly after the atrocities of 11 September and served to revise and consolidate counter-terrorism laws. This includes sweeping surveillance and search powers without the need for court order. The American Civil Liberties Union has challenged the issue of “National Security Letters” which allows the FBI to collect information and to prevent anyone receiving a letter from publicising it. While they have had some success, the Act remains in force.

Impact outside the US
Keeping data in the EU is not enough. In June 2011, the managing director of Microsoft UK admitted that it would comply with the Patriot Act as its headquarters are based in the US. While it would try to inform its customers before this happens, it would not guarantee this. This means that if you do business with a UK subsidiary of a US-based cloud operator and you specify that English law applies and you choose a UK-based data centre operating under EU data protection laws, the FBI can still get access to your data. While this had already been suspected, this was the first clear affirmation and is true for any US-based cloud provider.

So what can you do?
The UK Information Commissioner has warned of the effect of the Patriot Act but has not really provided substantive guidance as to how to overcome it. Legitimate use of the US Patriot Act for anti-terrorism surveillance is likely to fall within an exemption under the existing and revised EU data protection regimes.

You can keep your data away from US organisations. This means checking your entire supplier chain to make sure that there is no US company involved in the chain and not even a back-up or failover in the US.

UK, EU and Swiss owned and based cloud service providers have used this as an opportunity to promote their cloud services based in EU or Switzerland-based data centres with no US involvement and therefore immunity from the Patriot Act.

There have been some high profile examples of this recently. The Norwegian data protection regulator has warned the public sector about use of Google Apps over fears of the Patriot Act and the Dutch government looks set to exclude US IT providers from government contracts. Also, BAE Systems revealed in December 2011 that it was all set to adopt Microsoft Office 365 but had abandoned it after its lawyers warned about the effects of the Patriot Act.

Of course, it is worth remembering that the US is not the only country with anti-terrorism legislation. For example, the UK has its Anti-terrorism, Crime and Security Act and the Regulation of Investigatory Powers Act. The Telegraph reported on the use of RIPA by councils to tackle dog fouling, the unauthorised sale of pizzas, the abuse of the blue badge scheme for disabled drivers and even to take sound recordings of noisy children.

Although this led to some tightening of these powers, the UK government still has broad powers to intercept communications and gain access to data including where it is protected by encryption or passwords. And don’t forget, the UK government shares intelligence with the US government.

Ultimately, the best way to keep data completely secure is to keep it on-premise solution. But you do have to ask yourself: is it really likely that the US or UK government will want to access your data for anti-terrorism reasons?  In the case of some Solicitors and Chambers, the answer may well, of course, be YES.

________________________

First posted on cloupro.co.uk

Training is going well. Well, training is on-going, put it that way……..

If you haven’t donated yet, but want to, all the details are below – thank you very much in advance!

Please sponsor Matt!!

Anyone with access to the disk can read the file containing the password and use it to log into the encrypted area of the disk, rendering the encryption pointless and permitting access to potentially sensitive documents. This could occur through theft, physical access, or a piece of malware that knows where to look.

The best course of action is to implement a full disk encryption solution like Sophos SafeGuard for Mac or Apple’s included FileVault 2 – the former is compliant (FIPS 140-2) in the UK legal word with bodies such as the NHSLA, ISO, TSOL and CJSM.

Additionally, vulnerable users who do not encrypt their Time Machine backups risk replicating this log file to their backups, which could mean long-term storage of their unencrypted password.

This proves a very important point when it comes to encryption. While choosing a secure algorithm is important, it’s rarely the most important factor. How products store, manage and secure keys and passwords is the most common failure point in assuring data protection.
This incident demonstrates the importance of implementation over technical arguments like key strength and password complexity. That Apple promises AES encryption doesn’t mean anything if it chooses to store your password in an accessible log file.

Let’s hope Apple is able to fix this problem quickly. However, the possibility that the plain text password has been backed up and the difficulty of ensuring both copies and the original plain text password are securely erased means retrieval could still be possible even after the fix is applied. Once Apple users receive and apply the fix, they would be well advised to consider this password compromised, change it and ensure it is not used on any other systems.

Confused? Get help – email Matt Torrens with any questions…….

Source:- NakedSecurity

This qualification demonstrates Sprout’s commitment to the provision of outstanding technical resources to our clients.

Well done Matt – that’s a fantastic achievement!

Click here to MEET THE TEAM!!

The demand for Sprout’s services continues to grow and so does our desire to remain ahead of the game. We’re dedicated to working as hard as possible for all of our clients, all of the time, and that’s the reason we’ve expanded the team.

If you have any comments or questions, please feel free to leave them on this blog, or to email Matt Torrens.

For those of you who may not know, Richard first joined Sprout in 2009 before returning home to Australia in 2011 once his visa had expired. It didn’t take him long to realise how much he missed his Sprout life back in the UK (and how much better the cricket is over here) and so the protracted exercise of visa applications began.

I didn’t quite believe we could bluff him through customs until a few moments ago when I heard his dulcet tones………….through four tightly closed doors and a long corridor!

He’s here and raring to go – Welcome back Rich!