I had the opportunity to be the guest editor for the October Cutter IT Journal for an issue I called “Avoiding Privacy Pitfalls;” Cutter recently published notice of it.
It was great to put this together through the fantastic and greatly insightful as well as useful contributions of Dr. Andrew Jones, D.J. Vogel, Mark Fischer, David Lineman, Khaled El Emam, Roger CLarke and Timothy Virtue. They discussed privacy issues that organizations often overlook, ignore, or are completely oblivious about. For example, Dr. Andrew Jones describes his very interesting research into all the personally identifiable infromation (PII) on discarded equipment, and Roger Clarke discusses how to use privacy as a strategic factor within an organization.
There are many diverse, and often insidious, privacy pitfalls that will send organizations downstream to fines, penalties and litigation without a legal defense paddle. Organizations must consider what privacy incidents are possible and probable within their organizations. An excerpt from this issue:
“Herold highlights 10 security pitfalls to avoid:
Inappropriate access to the network or computer systems
Lost or stolen computers and computer storage media (backup tapes, hard drives, CDs, etc.)
E-mail messages with clear-text confidential information sent or forwarded inappropriately
Fraud activities perpetrated by outsiders, insiders, and combinations of both
Hackers gaining unauthorized access to personally identifiable information
Information exposed online because of inadequate controls
Insiders inappropriately using personally identifiable information
Confidential paper documents being given to people outside the organization (e.g., donated to schools/churches as scrap paper) instead of being shredded
Improper disposal of media containing personally identifiable information
Password compromise that allows access to personally identifiable information”
I have many more I could have listed, but space was limited…
Check it out and let me know what you think!
Tags: awareness and training, Information Security, IT compliance, policies and procedures, privacy