Data-leak lessons learned from the ‘Climategate’ hack.

Hacking is not my cup of tea, but there are certainly things to be garnered by this security breech.  Someone had the cajones to out the lies about global warming.

Lesson 1: Don’t let users put passwords in their signatures.  One of the scientists included both on his e-mail signature — which means that anyone receiving an e-mail from this guy had access to his files

Lesson 2: Don’t evade Freedom of Information requests. As noted in the Science Magazine link above, many of the e-mails discuss how to destroy documents in anticipation of Freedom of Information requests.

Lesson 3: Lock down sensitive servers.  Another theory behind the supposed “hack” is that the files were compiled in response to a FOIA request — then stored on an unlocked server.

Lesson 4: Advise your users that all e-mails (and indeed, voice, message and video communications) may be the subject of public disclosure.  You may work in an industry that’s not subject to FOIA — but anyone can get sued. And the process of “e-discovery” may make plenty of data public.

H/T GR

Oh yeah, and you should NOT throw out your raw data.

Advertisement