Posts Tagged ‘awareness and training’

Hey, Developers! Save Privacy in the IoT Explosion

Thursday, July 2nd, 2015

I’ve been concerned with and writing about the information security and privacy risks involved with the data created, transmitted and processed by smart devices in the Internet of Things (IoT) for several years since they first started emerging (e.g., here) and will likely be writing on it even more in the coming months and years. According to a new IDC research report, the IoT market will grow from $655.8 billion in 2014 to $1.7 trillion in 2020 with a compound annual growth rate (CAGR) of 16.9%. Will privacy die in this IoT explosion? If IoT developers and manufacturers take action now, I’m optimistic that they can save privacy in the IoT explosion. (more…)

It is Time to Set Social Media Rules

Sunday, June 28th, 2015

Over the past couple of weeks, I have spent a lot of time speaking with one of my clients about social media and posts from employees and contractors that may have a negative impact on the business. And the client is right to be concerned.

Most businesses are now using social media sites to communicate with their customers, potential customers, patients, employees, and everyone in between. However, such communications can often go awry at best, and result in privacy and security violations at worst. Here are just a few examples of what can go wrong. (more…)

Change Controls Are Still Necessary

Friday, June 5th, 2015

In the past week I helped a client whose programming staff had just caused a business disruption for the fifth time in two months because of the changes they made in the program code of their online service. The programmers, and so many of my other clients, have expressed the opinion that they can just code something and plop it out into production, without testing. And then they try to tell me that is “agile programming.” No, it is not. It is unsecure and, quite frankly, lazy programming. (more…)

Reining In Mobile Computing Risks

Sunday, October 3rd, 2010

As demonstrated over and over again over the past several years, mobile computing devices and storage media present a huge risk to business and personal information.  Because of the portability of these devices, organizations are basically entrusting the security of the information stored upon them into the hands of the people using them.  It is vital that an effective mobile computing device and storage media security and privacy management program is in place.

A mobile computing device and storage media security and privacy management program should be able to answer the questions: (more…)

Smart Grid Privacy: Possible Privacy Standards To Address Concerns

Saturday, November 28th, 2009

Sorry to be so tardy in getting a blog post out. As many of you know I’ve been working with the NIST Smart Grid Privacy Subgroup since late June. The work done for this group is through time volunteered by all involved.
As a quick recap, I led the privacy impact assessment (PIA) for the consumer-to-utility portion of the planned smart grid during the late June to late August/early September time frame. On Friday, 11/20, I provided an update on our NIST groups activities during the Gridwise Alliance phone conference; perhaps some of you were on that call?
Here are some links showing information about our NIST Smart Grid privacy group’s work:

(more…)

15 Smart Grid Privacy Concerns + Other Smart Grid Thoughts

Monday, November 9th, 2009

I’ve had about half a dozen folks ask me how things are going with the work I’m doing with the NIST Smart Grid privacy group, and if I could provide an update since my last couple of posts on the topic here and here.
The time is going by much too quickly, and I am getting a bit nervous as we get closer to when we need to have the next draft of the NISTIR ready, tentatively set for December 31; there is so much more to do in this VOLUNTEER group effort…

(more…)

HIPAA And Surveillance In Hospitals

Thursday, November 5th, 2009

Over the years there have been many…too many…instances where doctors have performed the wrong types of surgeries on patients, and even the wrong surgeries on completely wrong patients…

(more…)

CEs and BAs: Be HIPAA/HITECH Compliant Or Pay A Hefty Penalty

Thursday, October 29th, 2009

The HHS released HITECH Act Enforcement Interim Final Rule today…

(more…)

Smart Grid Privacy: Laws and Implications

Wednesday, October 21st, 2009

I was recently asked several questions about my work with the NIST Smart Grid privacy group and associated issues. Here are a couple of those questions, and my answers to them…

(more…)

6 Critical Factors for Effective Information Security & Privacy Policies

Wednesday, October 14th, 2009

I’ve been feeling bad about not posting to my blog as often as I have historically…

(more…)