Hi Rebecca

I Blogged about a similar issue a while back (see http://bhconsulting.blogs365.org/wordpress/?p=93). In this case the outsourcing of Visa applicants to various countries, including the US, was to a particular companies online system which was not secure. Applicants were able to view and change the data of other applicants.

A prime example of when you outsource a process you should ensure the security of that process is maintained by the supplier to at least the same level you would do in-house.

Brian

Thanks for your message, Brian, and the link to your great post! :)

Indeed there is much that needs to be addressed when outsourcing any type of processing or information handling to a vendor. I agree, the vendor security must be at least as strong as your own, and in many cases, depending upon the activity being outsourced, may need to be even more stringent.

This outsourcing of the actual physical passports story, which includes the vendor embedding electronic chips in them, has gotten a lot of press here in the U.S. today. Seems that the vendor it was outsourced to subsequently outsources a portion of the passport book creation to yet another vendor in yet another country. The fully functional but blank passports are then shipped back to the U.S. Perhaps lots of opportunities to have criminals get their paws on the blank passports and create a whole new revenue stream for themselves?

I'd love to do a data flow analysis of the entire process, from creation to delivery...I wouldn't be surprised if you could find many gaps in the process big enough to drive Mac trucks through... :)

Rebecca