Posts Tagged ‘policies and procedures’
Wednesday, July 15th, 2009
I want to continue my look at the concept of personally identifiable information (PII), and what types of items, in particular, are considered as such…
(more…)
Tags:awareness and training, de-identification, HIPAA, Information Security, IT compliance, IT training, personally identifiable information, PII, policies and procedures, privacy training, security training
Posted in Information Security, Privacy and Compliance | No Comments »
Monday, July 13th, 2009
This week I want to look at the concept of personally identifiable information (PII), and what types of items, in particular, are considered as such…
(more…)
Tags:awareness and training, HIPAA, Information Security, IT compliance, IT training, personally identifiable information, PII, policies and procedures, privacy training, security training
Posted in Laws & Regulations, Privacy and Compliance | No Comments »
Friday, July 10th, 2009
I’ve had some very interesting discussions about the CMU SSN study throughout the week, and, before moving on to other topics next week, I wanted to wrap up the week and discussion with some final thoughts on the CMU SSN topic..
(more…)
Tags:awareness and training, Carnegie Mellon, CMU, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social engineering, social security number, SSN
Posted in Information Security, Privacy and Compliance | No Comments »
Wednesday, July 8th, 2009
Following the release of the CMU SNN report on Monday, I’ve had some very interesting discussions with privacy and information security folks, and I’ve been pretty amazed at some of the reactions to the study.
I also posted about this to one of the GRC mailing lists I participate in, and I got some questions asking me for my thoughts about some specific issues. I wanted to share those thoughts here as well…
(more…)
Tags:awareness and training, Carnegie Mellon, CMU, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social engineering, social security number, SSN
Posted in Information Security, Privacy and Compliance | No Comments »
Monday, July 6th, 2009
It is nice to have scientific evidence of what we’ve been telling business leaders ever since they wanted to start using SSNs as identifiers and passwords!
Today Carnegie Mellon University (CMU) released a very revealing report, “Predicting Social Security numbers from public data” I want to expand upon some of the issues covered within it, and then urge you to communicate effectively to your business leaders the related concerns of your organization…
(more…)
Tags:awareness and training, Carnegie Mellon, Information Security, IT compliance, IT training, policies and procedures, privacy, privacy training, risk management, security training, social security number, SSN
Posted in Information Security, Privacy and Compliance | No Comments »
Monday, July 6th, 2009
It is nice to have scientific evidence of what we’ve been telling business leaders ever since they wanted to start using SSNs as identifiers and passwords!
Today Carnegie Mellon University (CMU) released a very revealing report, “Predicting Social Security numbers from public data” I want to expand upon some of the issues covered within it, and then urge you to communicate effectively to your business leaders the related concerns of your organization…
(more…)
Tags:awareness and training, Carnegie Mellon, CMU, Information Security, IT compliance, IT training, policies and procedures, privacy, privacy training, risk management, security training, social security number, SSN
Posted in Information Security, Privacy and Compliance | 1 Comment »
Thursday, July 2nd, 2009
On May 30, 2009, Nevada enacted a new law, SB 227, which will basically replace NRS 597.970 in January 2010.
In many ways the new law is an improvement over the much more vague, and brief, NRS 597.970. I want to focus here on an improvement, but something that still leaves much to interpretation; that is, what is meant by “encryption”?
(more…)
Tags:awareness and training, encryption, Information Security, IT compliance, IT training, Nevada, PII personally identifiable informaton, policies and procedures, privacy training, risk management, SB 227, SB 347, security training
Posted in Laws & Regulations, Privacy and Compliance | No Comments »
Wednesday, July 1st, 2009
Tags:awareness and training, identity fraud, identity theft, Information Security, IT compliance, IT training, personally identifiable information, PII, policies and procedures, privacy breach, privacy training, risk management, security training
Posted in Privacy Incidents | No Comments »
Wednesday, July 1st, 2009
Tags:awareness and training, identity fraud, identity theft, Information Security, IT compliance, IT training, personally identifiable information, PII, policies and procedures, privacy breach, privacy training, risk management, security training
Posted in Privacy Incidents | No Comments »
Tuesday, June 30th, 2009
Today I will be on MyTechnologyLawyer.com radio show to an hour program talking about the common privacy mistakes and assumptions made by businesses. This will be a more in-depth look at the issues from my post from a couple of weeks ago, “5 Common, Dumb and Dangerous Privacy Assumptions”
Here are the details:
(more…)
Tags:awareness and training, Information Security, IT compliance, IT training, mytechnologylawyer, policies and procedures, privacy training, risk management, security training
Posted in Privacy and Compliance | No Comments »
