Bad: sending confidential info in email as password-protected PDFsWorse: using the client’s account number as the passwordWorst: including the account number in the subject of the email and in the file name itself

[shac@ioc.exchange]

Bad: sending confidential info in email as password-protected PDFs
Worse: using the client’s account number as the password
Worst: including the account number in the subject of the email and in the file name itself

Literally a thing I just encountered with what is supposedly a big financial institution.

[siguza@infosec.space]

@shac and yet, I'm sure they are somehow compliant because security compliance is all bullshit...

[whophd@ioc.exchange]

@siguza @shac Sounds like it would be fun to start our own security compliance business

You could draw very straight, very short lines from the bad behaviours to the customer impacts

[siguza@infosec.space]

@whophd @shac but you'd need massive lobbying in order to get your standards adopted into law...