What if ISO knew the truth?

Summary: There are no proper and truly compliance-driven procedures that are being followed, actively used, or even vaguely specified by poor leadership at Sirius ‘Open Source’; it’s all improvised, hugely deficient, not even remotely compliant, and changes are sometimes made retroactively due to lapses and mistakes (compliance or merely appearance thereof, albeit only “after the act”); eventually there are attempts to shoot the messengers — those who have actually cautioned about those concerning things for several years already

THE “Conclusion” part of the report (a document we’ll publish tomorrow as PDF) is included at the bottom of this post. Worry not, it’s not the end of the series, only the end of this report; we have plenty left to show and to explain after that. We’re eager to show to the world what Sirius ‘Open Source’ Inc./Limited/Corporation truly is.

As a teaser of sorts, consider how poorly the company was handling data and information. It was getting worse over time because skilled people were leaving the company, making way for the “Google is your friend” mantra. This aforementioned mantra was something along the lines of, “trust big companies”, you can give them any data we have. Trust them, they’re big! Sure, they also spy for a government.

Data of high-profile clients, both past and present, was naturally left scattered all over the place, sometimes even outside the country. And to give just one example (there are so many; some will be covered later this month and next month), colleagues have cognition reports and incremental/full load reports on local — as in personal and offsite — machines (this is indirectly related to patients’ data) with no protocol or guidelines for removing these. There’s potentially sensitive data on people’s machines at home and we’ve already witnessed mistakes made by the clients themselves (like patients’ names or similar data showing up by mistake/accident).

THIS SHOULD NEVER HAPPEN!

In a saner world, everything would be uploaded to a firewalled file server located on the client’s own network, accessible in some secure fashion, without the data ever leaving the network, not even metadata. But when a company like Sirius handles its E-mail via AWS and AWS is also the host of OTRS (ticketing), one is expected to just upload files to AWS and transmit the stuff over E-mail (i.e. open relays). No encryption. I was repeatedly told off for using PGP in my E-mails.

There are serious ramifications for data protection and adherence to law, as there are unpatched old machines and perhaps backups that contain such files — a ticking time bomb. And even way after they’re no longer a client (years later), the example above serves to show that the problem does not go away. Not even when the contract ends (or gets terminated).

The sad reality is that the company, Sirius (so-called ‘open source’), is terrified about clients finding out how reckless and incompetent the company gradually became. Clients simply come to assume the reputation earned in past decades persists to date. They’re trusting a company run by a person divorced twice, whose kids refuse to even speak to him. How can deep trust be established with people who (if they get caught) simply pretend nothing bad happened and instead of apologising would rather get aggressive, even combative, to cover up the abuse?

The text below mentions ISO, security incidents, and then the company’s attempts to shoot the messenger (who cautioned about those issues along with many other issues). The in-depth analysis of the witch-hunt will follow after this report is published in full (some time tomorrow).

---

Conclusion

To summarise, Sirius should simply admit out in the open: “we’ve deviated away from our mission,” and moreover Sirius ignores warnings about security (ISO deserves to know about phonies and posers at security).

Roy internally cautioned about this several times over the years. Later, when some providers suffers security breaches (as Roy predicted) Sirius neither reset the passwords nor left the compromised providers.

To reiterate what was stated at the start, what’s alleged here is factually correct and evidence-backed. No URLs are provided, but URLs can be provided shall they be requested. Brevity still matters and much remains to be told.

In regards to the weak accusations leveraged to avoid paying compensation to Roy and Rianne, here again is the gist of the underlying issue/s:

1. no due process
2. no evidence presented (or claims merely alluded to without context/link)
3. gross accusation inflation
4. guilt by association (identical letter, too)
5. the company has a history doing this to couples, e.g. one blind colleague based in Germany; it was very serious and it went to court (cost the company or its Directors — the founder and his wife — a lot of money, went on for a long time, settled at the end)

The document is far from complete. Roy and Rianne have documents, have screenshots, links to official documents from Companies House etc.

This entry was posted on Tuesday, January 3rd, 2023 at 2:48 am and is filed under Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.