Posts Tagged ‘awareness and training’

New MO Breach Notice Law: Encryption Safe Harbor? Yes. Encryption Def Good? No!

Wednesday, July 22nd, 2009

On July 9, 2009 the Missouri governor signed House Bill No. 62 into law, and it included section 407.1500, which is the requirement for giving privacy breach notice.
Since I’m focusing this week on encryption laws, I want to take a moment and point out the horrible way in which encryption is defined within this new Missouri law..

(more…)

Has Massachusetts Encryption Law Stopped It’s Evolution?

Monday, July 20th, 2009

This week I want to take a look at encryption laws. Only a few short years ago no law or regulation really had explicit encryption requirements. HIPAA, passed in 1996 with effective compliance deadline requirements in 2003 (Privacy Rule) and 2005 (Security Rule) included withint the Security Rule that encryption was “addressable” based upon the results of risk assessment.
However, encryption became a more hotly debated topic with the more recent Massachusetts and Nevada laws that explicitly require organizations to encrypt personally identifiable information (PII). Now the question of whether or not the Massachusetts law will indeed be enforced upon the current compliance date of January 1, 2010 is once more in the news…

(more…)

What is PII? How About “Publicly Available” Info?

Thursday, July 16th, 2009

There is much debate about what specific types of items should be considered as personally identifiable information (PII). A common topic of debate is; if information can be found publicly does that mean it is not PII?

(more…)

What is PII? How About Groups Of Otherwise Non-PII?

Wednesday, July 15th, 2009

I want to continue my look at the concept of personally identifiable information (PII), and what types of items, in particular, are considered as such…

(more…)

What is PII? How About IP Addresses?

Monday, July 13th, 2009

This week I want to look at the concept of personally identifiable information (PII), and what types of items, in particular, are considered as such…

(more…)

Crooks Don’t Need to Steal SSNs If They Can Create Valid SSNs Themselves

Friday, July 10th, 2009

I’ve had some very interesting discussions about the CMU SSN study throughout the week, and, before moving on to other topics next week, I wanted to wrap up the week and discussion with some final thoughts on the CMU SSN topic..

(more…)

Implications Of The CMU SSN Study: What Business Leaders Need To Understand

Wednesday, July 8th, 2009

Following the release of the CMU SNN report on Monday, I’ve had some very interesting discussions with privacy and information security folks, and I’ve been pretty amazed at some of the reactions to the study.
I also posted about this to one of the GRC mailing lists I participate in, and I got some questions asking me for my thoughts about some specific issues. I wanted to share those thoughts here as well…

(more…)

Study Proves SSNs Are Easily Guessed; Don’t Use SSNs To Verify Identity Or As Passwords!

Monday, July 6th, 2009

It is nice to have scientific evidence of what we’ve been telling business leaders ever since they wanted to start using SSNs as identifiers and passwords!
Today Carnegie Mellon University (CMU) released a very revealing report, “Predicting Social Security numbers from public data” I want to expand upon some of the issues covered within it, and then urge you to communicate effectively to your business leaders the related concerns of your organization…

(more…)

Study Proves SSNs Are Easily Guessed; Don’t Use SSNs To Verify Identity Or As Passwords!

Monday, July 6th, 2009

It is nice to have scientific evidence of what we’ve been telling business leaders ever since they wanted to start using SSNs as identifiers and passwords!
Today Carnegie Mellon University (CMU) released a very revealing report, “Predicting Social Security numbers from public data” I want to expand upon some of the issues covered within it, and then urge you to communicate effectively to your business leaders the related concerns of your organization…

(more…)

Nevada’s New Encryption Law; Made Moot By Its Own Data Breach Law?

Thursday, July 2nd, 2009

On May 30, 2009, Nevada enacted a new law, SB 227, which will basically replace NRS 597.970 in January 2010.
In many ways the new law is an improvement over the much more vague, and brief, NRS 597.970. I want to focus here on an improvement, but something that still leaves much to interpretation; that is, what is meant by “encryption”?

(more…)