Okay, I just finished the 3rd conversation in just the past two weeks alone with an organization that is using Social Security Numbers (SSNs) as their primary form of customer and/or employee identification. I’ve written about this topic numerous times over the past 15 years. Seriously; all businesses out there doing this, please make a plan to stop doing this! Why? Here are three good reasons. (more…)
Posts Tagged ‘SSN’
Please Don’t Tell Me You’re Still Using SSNs as IDs!
Tuesday, October 2nd, 2012Tags:awareness, breach, compliance, customers, e-mail, electronic mail, email, employees, employment, hiring, HR, human resources, IBM, ID theft, identifiers, identity theft, IDs, Information Security, information technology, infosec, IT security, job applicants, messaging, midmarket, non-compliance, patients, personal information, personally identifiable information, personnel, PII, policies, privacy, privacy breach, privacy professor, privacyprof, Rebecca Herold, security, sensitive personal information, social security number, SPI, SSN, systems security, training
Posted in Information Security, Laws & Regulations | 1 Comment »
Crooks Don’t Need to Steal SSNs If They Can Create Valid SSNs Themselves
Friday, July 10th, 2009I’ve had some very interesting discussions about the CMU SSN study throughout the week, and, before moving on to other topics next week, I wanted to wrap up the week and discussion with some final thoughts on the CMU SSN topic..
Tags:awareness and training, Carnegie Mellon, CMU, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social engineering, social security number, SSN
Posted in Information Security, Privacy and Compliance | No Comments »
Implications Of The CMU SSN Study: What Business Leaders Need To Understand
Wednesday, July 8th, 2009Following the release of the CMU SNN report on Monday, I’ve had some very interesting discussions with privacy and information security folks, and I’ve been pretty amazed at some of the reactions to the study.
I also posted about this to one of the GRC mailing lists I participate in, and I got some questions asking me for my thoughts about some specific issues. I wanted to share those thoughts here as well…
Tags:awareness and training, Carnegie Mellon, CMU, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social engineering, social security number, SSN
Posted in Information Security, Privacy and Compliance | No Comments »
Study Proves SSNs Are Easily Guessed; Don’t Use SSNs To Verify Identity Or As Passwords!
Monday, July 6th, 2009It is nice to have scientific evidence of what we’ve been telling business leaders ever since they wanted to start using SSNs as identifiers and passwords!
Today Carnegie Mellon University (CMU) released a very revealing report, “Predicting Social Security numbers from public data” I want to expand upon some of the issues covered within it, and then urge you to communicate effectively to your business leaders the related concerns of your organization…
Tags:awareness and training, Carnegie Mellon, CMU, Information Security, IT compliance, IT training, policies and procedures, privacy, privacy training, risk management, security training, social security number, SSN
Posted in Information Security, Privacy and Compliance | 1 Comment »
Study Proves SSNs Are Easily Guessed; Don’t Use SSNs To Verify Identity Or As Passwords!
Monday, July 6th, 2009It is nice to have scientific evidence of what we’ve been telling business leaders ever since they wanted to start using SSNs as identifiers and passwords!
Today Carnegie Mellon University (CMU) released a very revealing report, “Predicting Social Security numbers from public data” I want to expand upon some of the issues covered within it, and then urge you to communicate effectively to your business leaders the related concerns of your organization…
Tags:awareness and training, Carnegie Mellon, Information Security, IT compliance, IT training, policies and procedures, privacy, privacy training, risk management, security training, social security number, SSN
Posted in Information Security, Privacy and Compliance | No Comments »
FTC Publishes Report On SSNs and Identity Theft
Wednesday, December 17th, 2008Today the U.S. Federal Trade Commission (FTC) released a new report about social security numbers (SSNs), identity theft, and recommended 5 ways to help prevend having SSNs being used for identity theft…
Tags:awareness and training, FTC, identity theft, Information Security, IT compliance, IT training, policies and procedures, privacy, privacy training, risk management, security training, social security number, SSN
Posted in Information Security, Laws & Regulations, Privacy and Compliance | No Comments »
Federal Agency SSN Use Mandate Has Been Removed!
Sunday, November 30th, 2008On November 18 President Bush signed Executive Order 13478; see how/if it impacts your organization and how you use social security numbers (SSNs), and how it will impact how you require SSNs. And now you personall should NOT need to provide SSNs as often…
Tags:awareness and training, Executive Order 13478, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social security numbers, SSN
Posted in government, Laws & Regulations | No Comments »
Despite 45+ U.S. Federal and State Laws, SSNs Still Widely Misused & Breached…Why?
Wednesday, August 20th, 2008It amazes me how many news articles are frequently reported that are related to the misuse or breach of social security numbers (SSN). Today just a few the stories that popped up included:
Tags:awareness and training, FTC, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social security number, SSN
Posted in Laws & Regulations | 1 Comment »
Is Your Accountant Sending Your Information Offshore?
Friday, August 15th, 2008Is your accountant or tax preparer sending your personally identifiable information (PII) offshore? Possibly.
Here is the second part of the first article, “(Mis)Using Social Security Numbers in Business,” within my August issue of IT Compliance in Realtime Journal, which discusses the use of SSNs (get the nicest version of the full journal here)…
Tags:awareness and training, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social security number, SSN
Posted in Information Security, Privacy and Compliance | 1 Comment »
How Do You Use Social Security Numbers?
Wednesday, August 13th, 2008Recently I got a call from a representative of one of the free IT magazines I subscribe to. The rep wanted to renew my subscription, and needed to ask me a few “qualifying” questions first. Fine.
When she asked, “What is your Social Security number?” I responded, “You don’t need to know.”
She replied, “Yes, I do. We must verify that you are, indeed, who you say you are, so we need your Social Security number to do that. It is our standard procedure.”
“Well,” I told her, “Don’t you think it is poor business practice to make an unnannounced call to your subscribers and ask them for a Social Security number? After all, you made the contact with me, not the other way around. I answered my phone, didn’t I? And besides, how do I know *YOU* are who you say you are? Can you please give me your Social Security number so I can verify that you are, indeed, who you say you are?”
Tags:awareness and training, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social security number, SSN
Posted in Information Security, Privacy and Compliance | 1 Comment »
