Welcome to the December 2018 issue of the Computing Security Newsletter.

With Christmas almost upon us, and the New Year celebrations not far behind that, it’s time for some sober reflection on the plight of those who’ve been looking forward to spending the festive season on some sunny beach far from our cold shores or with family and friends overseas.

Many are now facing a miserable time, if travelling with Virgin Atlantic, whose pilots were planning to strike from 22 December to Christmas Day in a dispute over union recognition. Meanwhile, for those intending to fly into the UK from Australia for the holiday period, tens of thousands of airline passengers could be left grounded, if a planned strike goes ahead. Air New Zealand has been informed that the Aviation and Marine Engineers Association and E tu', which represent nearly 1,000 aircraft maintenance engineers and logistics staff, were walking out on December 21 over an on-going pay dispute. The airline has 10 flights scheduled out of Sydney on that day and nine from Melbourne. In all, it is reported that 42,000 people have already booked on to its flights for what is the busiest travel day of the year.

Which brings me to another concern for those who travel by air – the failings of Heathrow Airport – which has been fined £120,000 by the Information Commissioner's Office for "serious" data protection failings after an employee lost a memory stick containing more than 1,000 files that was not encrypted or password protected.

As John O’Keefe, VP EMEA of enterprise SaaS company Looker, points out: "If the data was instead stored in a more centralised and flexible data platform – meaning employees no longer need to extract data to analyse it – the risk and potential impact of a leak like this is minimal. In addition, staff can interpret data more quickly and act on it directly, accessing only the data they need to answer their immediate questions.”

Perhaps fortunately for the airport, the incident occurred before the General Data Protection Regulation (GDPR) came into effect in May. Under GDPR, it could have risked the maximum penalty of £17 million or 4% of its global revenues. Undoubtedly, such failures do need to incur the most punitive consequences, if such negligence is to be discouraged. It seems the duties of care and sound management that should underpin the functioning of many organisation today, in the face of the most severe cyber threats, simply aren’t enough.

To make sure you get your copy of the Newsletter emailed to you personally, every time, click here to register.

Brian Wall, Editor
Computing Security

Follow us :