Target has 70 million customers’ credit card and identity information stolen. Oh no! Security clearance and personal data for 21.5 million federal employees is taken from the Office of Personnel Management.
One thing I never see discussed is the wisdom of putting 70M or 21.5M pieces of identity information behind the same security mechanisms. It seems it would be better to partition information behind several different types of security (one for each partition) and thereby reduce the access someone would have from cracking one. Can anyone point to information about that tactic?
I suppose an argument against it would be that any client that provides uniform access across the entire dataset then becomes the weakest point.
One thing I never see discussed is the wisdom of putting 70M or 21.5M pieces of identity information behind the same security mechanisms. It seems it would be better to partition information behind several different types of security (one for each partition) and thereby reduce the access someone would have from cracking one. Can anyone point to information about that tactic?
I suppose an argument against it would be that any client that provides uniform access across the entire dataset then becomes the weakest point.
Additionally, it’s the point most likely to be written by less-experienced developers using in-house (read: crap) tooling.