As a follow-up to my blog post from last Friday, here is the second part of the first article within the June issue of my “IT Compliance in Realtime” journal, “What to Tell Personnel: Messaging Security and Privacy“…
Posts Tagged ‘policies and procedures’
Sending Clear Text Customer Information Is Not Okay Just Because the Customer Says It’s “Okay”
Monday, June 9th, 2008Sending Clear Text Customer Information Is Not Okay Just Because the Customer Says It’s “Okay”
Monday, June 9th, 2008As a follow-up to my blog post from last Friday, here is the second part of the first article within the June issue of my “IT Compliance in Realtime” journal, “What to Tell Personnel: Messaging Security and Privacy“…
Something To Tell Your Personnel: Messaging Includes More Than Email
Friday, June 6th, 2008My June issue of “IT Compliance in Realtime” journal is hot off the press!
I’ve heard from some of you that when I post the articles from my journal that the posts are too long. So, what I will do from now on is to break up the articles into smaller postings to make them easier, and faster, to read.
Here is the first part of the first article within the June journal, “What to Tell Personnel: Messaging Security and Privacy”…
HIPAA Humor: Dumb Robber
Thursday, June 5th, 2008Here’s a story that gave me a bit of a chuckle, “Note leads police to robbery arrest“…
Locational Privacy…And Nonconsenting Research Subjects
Wednesday, June 4th, 2008Here’s an interesting, relatively new, privacy (with regard to publicity any way) issue that was reported today: locational privacy…
Insider Threat Example: Coworkers Accessing Other Coworkers’ Email Messages
Tuesday, June 3rd, 2008Back in the mid-1990’s, a middle manager knew that the print queue messages for all the emails in the large organization were viewable in clear text; all you had to know was which printer queue to open. He would lurk in the print queues each day, all day, for all the printers all the other middle managers, and executives, used, and he would copy all the email messages he found that could be “advantageous” to his career. He amazed a lot of people by always seeming to know what was going on before anyone else did.
I was reminded of this particular mole-manager as I just read a news story, “Philly News Anchor Target in FBI Probe: FBI Investigates Anchor in Suspected Hacking of Fired Co-Anchor’s E-mail”
How To Create Information Security & Privacy Case Studies
Monday, June 2nd, 2008Over the years I’ve done a lot of information security, privacy and compliance training and awareness activities; content creation, delivery, tools, and a large variety of other related activities. I’ve found doing case studies to be one of the most effective, and most interesting and popular, type of training activity.
I’ve created dozens, and perhaps even hundreds, of case studies throughout the years. Case studies engage your personnel in thinking in ways that just telling them information cannot do, noticeably change their work habits, and measurably impact their opinions about information security and privacy.
In the third article of the May 2008 issue of my IT Compliance in Realtime Journal, “Creating Effective Case Studies for Information Security and Privacy Training” I provide direction for how to create effective case studies within any type of organization.
The following is an unformatted copy of the article, without the sidebar information and illustrations; download the PDF version of the article to see those…
Internal Threat Example: Lending Tree Privacy Breach And Civil Suit
Sunday, June 1st, 2008Last month (May 2008…yes, it is June already!) Lending Tree got slapped with a civil suit alleging their personnel allowed mortgage lenders access to customer’s personally identifiable information (PII) and other confidential information.
The suit charges that Lending Tree did not have appropriate or adequate information safeguards in place, resulting in the employees using names, addresses, phone numbers, Social Security numbers, income information, and assorted other personal information, to market their own mortgage loans to the LendingTree customers.
The class-action lawsuit, (this is from a subscription site) represents all Lending Tree customers who submitted loan request forms to the company between Jan. 1 2006 and May 1, 2008.
From the case file…
Let Your Personnel And Family Know About This Phishing Scheme That Spoofs Amazon
Thursday, May 29th, 2008When was the last time you warned your family members, friends and/or personnel about the new phishing schemes that are being launched?
There are many phishing scams going on right now, and they are widely reported and talked about. I want to talk about a new one spoofing Amazon, a popularly spoofed company in phishing messages, because I’ve already had a couple of other folks I know who are not in the info sec biz asking me about it today. I also got it in my email box today, so it will make a good example to discuss…
Business Leader Primer for Effective Information Disposal
Wednesday, May 28th, 2008I’ve been talking a lot lately about the need for business leaders to more effectively address the secure disposal of information, particularly personally identifiable information (PII). Why? Because it seems like more and more attention is being given to security technologies to protect day-to-day business…attention is good and MUST be done…but often it seems it is at the expense of then overlooking, or perhaps shrugging off, how to securely dispose of PII, systems, applications and hardware when they are no longer needed in the business. This has led to many information security incidents and privacy breaches.
I address the reasons why business leaders must give attention to information disposal in the second article of my May issue of IT Compliance in Realtime, “Business Leader Primer for Effective Information Disposal.”
Download a PDF version to get a much nicer-looking copy, the super-duper graphic I put into the article, plus the sidebar information and facts. Here is an unformatted version of the article…
