Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Comment So Buttery (Score 1) 27

My post probaly should be a new story, but anyway it is on the same lines of keeping personal information secure. Not to many years ago I worked for a food franchise that did buisness under a nation wide chain. Our product was fast pizza delivery (30 mins or less ring bells?). The corporation bought out a Point of Sale System (or rights of) and began redevoloping the program with input from various people of the company to make it user friendly and usable in our line of buisness. A clunky and slow POS system was something that we could not manage in our fast pace enviroment. It turned out really well on usablity and such but brought micromanaging to a buisness that did not require it which was not accepting very well at first. Enough of the jabber, what I was writing about is the lack of any security on the way back ups are done. There are no user logins other than a generic login for everyone to use and the administrator logins. The only user specific logins was in the POS system itself. The database was ran by MS SQL Server and the databases where not accesible to regular users of course. If they were encrypted I am not sure, but I am assuming they were not. The reason being I was snooping around under various public folders on the server and found the backup files for the databases. The first problem is I was able to access these and open these files with wordpad/notepad under the user login everyone knows. The worse problem is these backups are not encrypted in any way. You can easily browse through employee records and to my horror customer information, credit card numbers en al. Anyone with knowledge of the general user login (which includes all employees) can access these files. After notifiying the franchisee which was also a bit shocked that customer credit card numbers were being stored even though our credit card merchant agreement strickly forbid the storing of that information (atleast before he signed a new agreement with another merchant that handled internet transactions). It seems the area corporate supervisor was not to worried about this, so I took it to the forums. We had at the time a web forum that all employees could access for various reasons. New food promotions, general talk support ect. After making a post about this without responce from the corporation a forum mod finaly was able to forward the problem to one of the people that worked on the design team. It turns out these public accessable database files are part of the design... To allow the server administrator to make what ever semi perm backups , cd/dvd tape ect. And no they will not make changes to secure these databases as it will cost to much money to do. The sad thing which I brought up it cost 0$ to change where the backup file goes... never got a reply from that.

Slashdot Top Deals

Thus mathematics may be defined as the subject in which we never know what we are talking about, nor whether what we are saying is true. -- Bertrand Russell

Working...