Ernst and Young Screws Sun Microsoystems

Yesterday, I blogged about how McAfee was screwed over by their own auditing company that they hired to make sure that they were in compliance with Federal Law and best practices. Well now, Sun Micrososystems has been screwed over by their own auditing company too.

TheRegister has the exclusive scoop here:

Ernst & Young fails to disclose high-profile data loss

Sun CEO’s social security number exposed

Ernst and Young has lost a laptop containing data such as the social security numbers of its customers. One of the people affected by the data loss appears to be Sun Microsystems CEO Scott McNealy, who was notified that his social security number and personal information have been compromised.

“We deeply regret that a laptop containing confidential client information was stolen, in what appears to be a random act, from the locked car of one of our employees,” said Ernst and Young spokesman Charles Perkins. “The security and confidentiality of our client information is of critical importance to us. The computer was password-protected, and we have no reason to believe the data itself was targeted or that the information was accessed by anyone. We are notifying those clients whose information was contained on the computer.”

Ernst and Young declined to comment on whether or not McNealy was affected.

However, at last week’s RSA security conference, McNealy noted that he received an e-mail from an “anonymous partner” detailing a loss of his private data. “We determined that your name and social security number were among the data (lost),” the partner wrote to McNealy.

“This is an organization that we spend an enormous amount of money on to determine whether we are Sarbanes-Oxley compliant,” McNealy said.

Translation: These assholes who charge us a fortune to make sure we follow the rules were negligent with the our data.

Digging through Sun’s financial filings, you’ll discover that Ernst and Young serves as the company’s auditor and handles Sarbanes-Oxley consulting for Sun. A spokesman at Sun confirmed that Ernst and Young is still the company’s auditor but declined to out the firm that lost McNealy’s data.

Ernst and Young declined to return our phone calls seeking more information about the breach and why it has “no reason to believe” the password could be cracked. It makes no mention of stronger security than simple password protection.

Auditing companies need to be held to a higher standard than the typical corporation. After all, the level of trust is much higher with auditing companies, and more than anyone, they should practice what they preach. In addition, auditing companies need to put their money where their mouth is, at least contractually. When they begin an audit, they become keepers of the trust of much private corporate and personal data. If that trust gets broken, then the auditor should have to pay recompence for their error.

A self-encrypting shell overlay would also be very useful for protecting all mobile data processing equipment, be it laptop, thumbdrive or CDRom. If any personal or corporate data is allowed to exit its internal layers of security, it should do so only in an encrypted manner. And auditing companies should ensure that this is the case as well.

And someone should smack that E&Y employee across the back of his head for being so stupid as to leave the laptop in his car.