Security management Toolkit
Story: PGP: Encryption alone no cure for data breaches
Sure: no silver bullets
First you have to close the stable door. Point solutions do this.
Citadels have always had strength in depth from the moat to the keep, unlike HMRC (or firewalls) which neglected basic data security, and the breach took place outside the citadel.
HMRC have to take the minimum precautions of not allowing everyone to browse or download the whole database. And understand password protected zip files are not the state of the art data security, and why data security matters and what is your responsibility. Junior (inadequately trained) staff were required to supply the whole database (in password protected zip files) by people who should know better (but didn't).
Encryption is necessary for mobile data, mobile data is not necessary for HMRC, and supplying the whole database was not a alternative to sterilising the data, for it's intended use, and distribution outside the citadel.
Corporate experimentation and learning is an important activities in their own right. Simple rules can drive complex behavior and solutions come from iteration and experience.
Full Talkback thread
