Delicious/delimiterau
- Early investors drop Facebook
- Victoria kills HealthSMART IT project
- Woz not great - mUmBRELLA
- Santos' thin client starts big-data plans
- Nokia Lumia 800 revs up at Bridgestone
- Telstra privacy breach was 'one little oops'
- 'Battleground of the future' the focus of new agreement with US
- The rise of the vendor management office
- NSW Government signs mega data centre deal
- NBN FUD: will Abbott ever learn?
Enterprise IT - Written by Renai LeMay on Tuesday, October 18, 2011 16:50 - 3 Comments
First State rewards security tip with legal threat
blog Whoah. It looks like Australian superannuation fund First State Super has had a massive, corporate-style over-reaction to a security analyst, Patrick Webster who politely let it know about an obvious, glaring security hole in its online platform.
The full details have been published by Secure Computing Magazine (and we recommend you also check out their earlier article here). But basically it looks like it’s a case of the poor analyst reported the flaw, was politely thanked by First State, and then had his details summarily handed over to the cops, who showed up on his doorstop shortly after. Further information comes from security podcast Risky.Biz, which reports:
“Perhaps instead of contacting the law, First State Superannuation would have done well to send Webster, who ironically enough spent much of his career working in information security for NSW Police, a nice bottle of single malt and a sun hat.”
We agree. Surely there is someone with an iota of sense in First State Super? Anyone? Someone, perhaps, who could listen to the NSW Police on this matter, which has decided to take no action on the issue, describing Webster as “a civic-minded person”?
Related posts:
- Legal threat: Cudo warns deals aggregator site
- WA Auditor slams agencies’ woeful IT security
- NSW Govt can’t guarantee IT security
- Vodafone investigates reported security breach
- Hacks focus CIOs on IT security
| Tweet | |
![]() |
3 Comments
Leave a Comment
Enterprise IT, News - May 21, 2012 13:32 - 15 Comments
The ABC didn’t sack Bitcoin miner
More In Enterprise IT
- Victoria dumps HealthSMART e-health project
- HP completes giant new NSW datacentre
- Microsoft beats Salesforce to utility CRM deal
- NSW finalises colossal datacentre consolidation
- Two good Australian CIO interviews
News, Telecommunications - May 21, 2012 10:48 - 5 Comments
iiNet ramps up Internode digestion
More In Telecommunications
- China concerned by Huawei NBN ban, says Bob Carr
- Parliament knocks back surveillance terms
- Evidence: Rural Australia is demanding the NBN
- Pristine Telstra network photos: We sourced our own
- NBN no CommBank or Qantas, says Hockey
Gadgets, News - May 21, 2012 12:32 - 5 Comments
Galaxy S III listed for Telstra, Optus and Vodafone
More In Gadgets
- Will Telstra skip Nokia’s Lumia 900?
- New BlackBerry OS 7.1 hits Australia
- ASUS Transformer Pad tablet hits Australia
- HTC One XL on sale: Compatible with Telstra 4G
- Optus a “disgusting” company, says AFL chief
Reviews - May 7, 2012 18:16 - 2 Comments
Telstra Mobile Wi-Fi 4G: Review
More In Reviews
- Samsung Galaxy S III: Preview
- HTC Titan II 4G: Preview
- Nokia Lumia 710: Review
- Sony Xperia S: Review
- Samsung Omnia W: Review








sponsored post ING Direct recently implemented a private cloud solution to virtualise its entire banking platform, allowing it to provision a new copy of itself -- a so-called 'bank in a box' -- within minutes. 
Reading the article on The Age about this he apparently made a script to go through and download details of people from the site.
Which I’d say where the issue actually is.
It also may just be policy to report all security breaches to the Police. Even if he did have good intentions it still was a security breach
It does sound like he went a bit far beyond the call of duty … but I’d still say First State should award the guy a little more cred, given he used to work for the police himself.
What if this was a real-world security breach? I think the equivalent would be ringing their call centre repeatedly, trying different member numbers to identify oneself, and noting how many times the phone monkey on the other end gave up a real customer’s policy details. Would that be worthy of punishment? Not if the prank-caller was benign, and let the company know about the problem. Hysteria around information security is what keeps the good guys from wanting to help!