My friend and professional colleague, Kevin Beaver, is giving a webcast on Tuesday, November 14, “How to manage the ongoing information security requirements for SOX, HIPAA, GLBA and other key regulations: A single solution.” Kevin has great experience with information security planning and implementation, and has been addressing compliance issues in a wide range of industries and organizations for the past several years. If you are struggling with how to comply with all the multiple information security compliance requirements and have the opportunity to attend this event, it will provide some useful information to help you with your efforts.
Last Friday (10/27) Washington Technology published an interesting article, “USPS site is much more than just a presence on the Web” about the privacy challenges of the United States Postal Service (USPS) website.
It is interesting and revealing to see how the concerns and threats have evolved from primarily worrying about web defacements and hackers to now needing to address information security and privacy protections throghout the entire enterprise, right on out to the user endpoints (desktop computers, laptops, etc.).
How often do organizations re-evaluate the adequacy of their information security and privacy programs? If they depend completely upon their own personnel to do this, it is likely it is not often enough. Except for those comparatively few security/privacy stellar organizations, such evaluation activities often take back seat to other activities and day-to-day security/privacy fire-fighting activities.
If you cannot reliably use your own personnel to perform periodic evaluation of the adequacy of your organization’s information security and privacy efforts because they cannot realistically fit such activities in with their other job responsibilities (which is all too common), then seriously consider hiring an independent third party to perform such evaluation. You should have a third party occasionally perform independent reviews anyway to provide a level of objectivity you cannot get with your own personnel, and also to catch vulnerabilities and identify new threats that your personnel may not have the experience or up-to-date knowledge to identify.
I know nothing about this particular product, "MyLaptopGPS," beyond this press release, but the concept is good, and there may be other products out there that do the same thing. Security in layers does not just apply to networks; it applies to all aspects of information security.
In fact, with regard to mobile computing devices it is good to take MANY safeguards, a few of which include:
Encrypt all sensitive data on the device. This often is most efficient to accomplish by encrypting the entire hard drive.
Use boot and login passwords…GOOD passwords!
Configure the device to automatically lock, requiring requiring password based re-authentication, after a specified period of inactivity. 5 or 10 minutes is reasonable.
Use privacy screens to cut down the amount of information onlookers, nosy neighbors and other looky-loos can see, like on planes, in airports and so on.
Use asset monitoring tags and services, such as StuffBak. The GPS product also serves a similar purpose.
Require unique devices for each person; don’t allow the devices or passwords on the devices to be shared; this destroys accountability.
Maintain an inventory of all mobile computing devices used, along with the data stored upon them.
Do not allow mobile computin devices used for business to also be used for personal activities or to be shared with others, such as friends and family members.
Do not allow employee-owned mobile computing devices to be used for business purposes. Organizations should own all the computing devices used for business purposes to ensure all business policies and procedures can be applied to them.
Provide locking devices and other methods for physically protection mobile computing devices when personnel have them outside the more protected confines of the corporate facilities.
Do not allow large amounts of PII to be stored on mobile computing devices.
Implement malicious code prevention software and personal firewalls on mobile computing devices.
Very importantly, provide awareness and training for your folks who use mobile computing devices!!! You can’t expect that they will provide appropriate safeguards if you do not tell them what the appropriate safeguards are that they need to take.
In this episode, I speak with two highly experienced HIPAA compliance experts, Kevin Beaver and Brad Smith to get their views and opinions about this much discussed but often debated regulation. In particular we discuss the relatively new HIPAA Administrative Simplification Enforcement Final Rule, and how it impacts providers and payers. We explore and try to determine what, if any, impact the HIPAA Enforcement Rule has on Covered Entities.
Not all CEs are lackadaisical, though; Kevin, Brad and I discuss some of the CEs that have been very diligent in their HIPAA compliance efforts. However, we also discuss some examples of blatent disregard for HIPAA, and the resulting risks to organizations from such action. We also discuss the importance of addressing compliance through partnering information security, privacy, legal and compliance areas.
There is increasing concern about the use of real/actual personally identifiable information (PII) for test and development purposes. I’m also increasingly concerned about the use of PII by sales representatives who are showing demos to potential clients. I was recently surprised to see a vendor showing me a demo of his security software using the actual production data of his clients, which included a vast amount of PII about his clients‚Äô customers, such as names, social security numbers and credit card numbers. He had accumulated this information while doing work for the clients with the software. Needless to say, his demo turned into a long discussion about the risks involved with this practice. Such a practice is an incident and lawsuit waiting to happen. Unfortunately the sales staff at many companies use production data for demo purposes. And it’s not just software vendors. Insurance representatives often show their potential clients demos using PII, as do financial organizations, and healthcare companies, plus potentially other industries. Do you know if your sales staff is using your production data?
I just posted a new podcast, "Data De-identification and Masking Methods," a follow-up to my last podcast, “What IT Leaders Need to Know About Using Production Data for Testing.” I discuss some of the ways in which data can be de-identified, or masked, to use for not only test purposes, but also for demo and other purposes. There are many ways to de-identify and mask data. Some are better than others. It all depends upon the type of data you’re working with, and the associated application or system. I briefly describe seven ways in which data can be masked and de-identified, in addition to an alternative in the slim chance that there is absolutely no way in which anything other than production data can be used for testing. The ultimate goal is to protect the privacy and confidentiality of PII while also making meaningful data available for purposes of testing, demos or analysis.
