As I’ve mentioned a few times before, I’m in the final lap of finishing the 2nd edition of my book, “Managing an Information Security and Privacy Awareness and Training Program.” Woo hoo!
Over the weekend I updated “Appendix N – Designated Security and Privacy-Related Days.” Here are the days, weeks and months I’ve found are devoted to raising awareness about various info sec and privacy issues (this is in a much nicer-looking table format in my book)…
Info Sec & Privacy Days/Weeks/Months
June 15th, 2009FTC’s New Red Flags Rules FAQ
June 11th, 2009Today the US FTC released “Frequently Asked Questions: Identity Theft Red Flags and Address Discrepancies.”
Here are a couple important things to take away from this FAQ…
Healthcare Worker Gets 1 Year In Prison For Posting HIV Victim’s Medical Records On Internet
June 10th, 2009Today a report discussed how a healthcare worker obtained medical information about a patient with HIV that was then posted on the Internet…
Privacy Enhancing Technologies (PETs) & Privacy Threatening Technologies
June 9th, 2009I’m doing research while working on the 2nd edition of my book, “Managing an Information Security and Privacy Awareness and Training Program“…
Audits Show Things At a Moment in Time; Silly To Sue For Breaches That Happen 1 Year After Audit Conclusion?
June 8th, 2009There has been much written in the past week about Merrick Bank suing the audit firm, Savvis, because a breach occurred at CardSystems in 2005 even though Savvis had given passing marks for the CardSystems audit that Merrick Bank hired them to perform in 2004 to ensure they were following Visa’s Cardholder Information Security Program (CISP); basically a forerunner of the current PCI DSS program. Savvis found that CardSystems was following the CISP requirements. Within a year after the audit, CardSystems experienced a major breach that basically put them out of business.
I have had the great privilege to work as an IT auditor early in my career, for a while as an internal auditor at a large multi-national financial and insurance company, and then doing periodic audits since in various organizations in a wide range of industries since. All wonderful learning experiences!
There are a couple of important points that the judge in this situation should consider, and the lawyers in this case should understand:
Great InfoSec and Privacy Info and Resources This Week On Twitter
June 5th, 2009I got my week’s issue of Time magazine in the mail today, and lo-and-behold the cover and feature story was about Twitter!
Not Providing Training and Awareness Is The Dumbest Idea For Information Security
June 4th, 2009As time goes on, and more and more information security incidents and privacy breaches occur, I continue to hear otherwise smart people say silly and completely wrong statements about the need (or lack of) for information security and privacy training and awareness!
Rights for Privacy Breach Victims
June 3rd, 2009I received a provacative question on Twitter last week from idExperts, “If you had a wish list of rights for identity theft victims, what would that be?”
Sounds like a great blog topic! 🙂 Here are my thoughts…
Common InfoSec & Privacy Training Mistakes
June 1st, 2009I’ve been reviewing some of the information security and privacy training and awareness content for some organizations; some large and some small. Most of the training is ineffective…
Insider Threat: Horrible Tragedy Highlights Need For Policies & Training
May 27th, 2009I got the June 1 issue of Newsweek today, and something that’s bothered me ever since I first heard about it was on page 4…
