Archive for the ‘Information Security’ Category
Monday, August 10th, 2009
There’s been a lot in the news lately about “Web 2.0” security and privacy problems. A lot of folks, though, don’t know what that term really means. Do your personnel know what it means? Probably not. This is certainly understandable since Web 2.0 really is a reference to many different things. The common link is that Web 2.0 represents what is considered to be the “second generation” of Internet activities and tools…
(more…)
Tags:awareness and training, Information Security, IT compliance, IT training, policies and procedures, privacy training, security training, Web 2.0
Posted in Information Security | No Comments »
Monday, July 20th, 2009
This week I want to take a look at encryption laws. Only a few short years ago no law or regulation really had explicit encryption requirements. HIPAA, passed in 1996 with effective compliance deadline requirements in 2003 (Privacy Rule) and 2005 (Security Rule) included withint the Security Rule that encryption was “addressable” based upon the results of risk assessment.
However, encryption became a more hotly debated topic with the more recent Massachusetts and Nevada laws that explicitly require organizations to encrypt personally identifiable information (PII). Now the question of whether or not the Massachusetts law will indeed be enforced upon the current compliance date of January 1, 2010 is once more in the news…
(more…)
Tags:awareness and training, breach law, breach response, enryption, HIPAA, Information Security, IT compliance, IT training, Morrissey, personally identifiable information, PII, policies and procedures, privacy training, security training
Posted in Information Security, Laws & Regulations, Privacy and Compliance | No Comments »
Wednesday, July 15th, 2009
I want to continue my look at the concept of personally identifiable information (PII), and what types of items, in particular, are considered as such…
(more…)
Tags:awareness and training, de-identification, HIPAA, Information Security, IT compliance, IT training, personally identifiable information, PII, policies and procedures, privacy training, security training
Posted in Information Security, Privacy and Compliance | No Comments »
Friday, July 10th, 2009
I’ve had some very interesting discussions about the CMU SSN study throughout the week, and, before moving on to other topics next week, I wanted to wrap up the week and discussion with some final thoughts on the CMU SSN topic..
(more…)
Tags:awareness and training, Carnegie Mellon, CMU, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social engineering, social security number, SSN
Posted in Information Security, Privacy and Compliance | No Comments »
Wednesday, July 8th, 2009
Following the release of the CMU SNN report on Monday, I’ve had some very interesting discussions with privacy and information security folks, and I’ve been pretty amazed at some of the reactions to the study.
I also posted about this to one of the GRC mailing lists I participate in, and I got some questions asking me for my thoughts about some specific issues. I wanted to share those thoughts here as well…
(more…)
Tags:awareness and training, Carnegie Mellon, CMU, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social engineering, social security number, SSN
Posted in Information Security, Privacy and Compliance | No Comments »
Monday, July 6th, 2009
It is nice to have scientific evidence of what we’ve been telling business leaders ever since they wanted to start using SSNs as identifiers and passwords!
Today Carnegie Mellon University (CMU) released a very revealing report, “Predicting Social Security numbers from public data” I want to expand upon some of the issues covered within it, and then urge you to communicate effectively to your business leaders the related concerns of your organization…
(more…)
Tags:awareness and training, Carnegie Mellon, Information Security, IT compliance, IT training, policies and procedures, privacy, privacy training, risk management, security training, social security number, SSN
Posted in Information Security, Privacy and Compliance | No Comments »
Monday, July 6th, 2009
It is nice to have scientific evidence of what we’ve been telling business leaders ever since they wanted to start using SSNs as identifiers and passwords!
Today Carnegie Mellon University (CMU) released a very revealing report, “Predicting Social Security numbers from public data” I want to expand upon some of the issues covered within it, and then urge you to communicate effectively to your business leaders the related concerns of your organization…
(more…)
Tags:awareness and training, Carnegie Mellon, CMU, Information Security, IT compliance, IT training, policies and procedures, privacy, privacy training, risk management, security training, social security number, SSN
Posted in Information Security, Privacy and Compliance | 1 Comment »
Thursday, June 18th, 2009
I read a story about a city government agency actually asking job applicants to provide their IDs and passwords for any online social networking type of site they participate in…
(more…)
Tags:awareness and training, Bozeman, Information Security, insider threat, IT compliance, IT training, personal privacy, policies and procedures, privacy training, risk management, security training
Posted in government, Information Security, Privacy and Compliance | 2 Comments »
Wednesday, June 17th, 2009
Today Kevin Beaver posted a nice article, “Dumb things IT consultants do” that included more than one warning about making assumptions. Kevin’s nice post made me think about all the dangerous assumptions consulants and practitioners often make when it comes to evaluating privacy practices…
(more…)
Tags:awareness and training, Information Security, IT compliance, IT training, personally identifiable information, PIA, PII, policies and procedures, privacy impact assessment, privacy training, risk management, security training
Posted in Information Security, Privacy and Compliance | 2 Comments »
Tuesday, June 16th, 2009
Today the FTC issued a consent order against mortgage lender James B. Nutter & Company for GLBA Privacy Rule and Safeguards Rule violations resulting from having an inadequte information security program and safeguards. The requirements will result in, among other actions, 20 years of ongoing activities by James B. Nutter & Company; much more costly than it would have been to have established appropriate information security safeguards to begin with…
(more…)
Tags:awareness and training, GLBA, Gramm Leach Bliley Act, Information Security, IT compliance, IT training, policies and procedures, privacy rule, privacy training, risk management, Safeguards Rule, security training
Posted in Information Security, Laws & Regulations, Non-compliance Sanctions Examples, Privacy and Compliance | No Comments »
