Today CNN announced the Internet now has 100 million (100,000,000) web sites “with domain names and content on them.” They provided several interesting accompanying statistics.
Posts Tagged ‘privacy’
100 Million Internet Web Sites
Wednesday, November 1st, 2006100 Million Internet Web Sites
Wednesday, November 1st, 2006Today CNN announced the Internet now has 100 million (100,000,000) web sites “with domain names and content on them.” They provided several interesting accompanying statistics.
Consumers Want Identity Theft Protection Through Homeowner Insurance
Tuesday, October 31st, 2006An interesting article was released yesterday in the Insurance Journal, “J.D. Power: Homeowners Want Carriers to Offer Identity Theft.”
It indicates that the 2006 Homeowners Insurance Study, results of feedback from 9,045 homeowners insurance policy holders in the U.S., finds 40% wants their home policy to include identity theft coverage.
Information Security Compliance Webcast
Tuesday, October 31st, 2006My friend and professional colleague, Kevin Beaver, is giving a webcast on Tuesday, November 14, “How to manage the ongoing information security requirements for SOX, HIPAA, GLBA and other key regulations: A single solution.” Kevin has great experience with information security planning and implementation, and has been addressing compliance issues in a wide range of industries and organizations for the past several years. If you are struggling with how to comply with all the multiple information security compliance requirements and have the opportunity to attend this event, it will provide some useful information to help you with your efforts.
Technorati Tags
information security
IT compliance
policies and procedures
privacy incident
awareness and training
privacy
Website Privacy and Security Lessons From the USPS
Monday, October 30th, 2006Last Friday (10/27) Washington Technology published an interesting article, “USPS site is much more than just a presence on the Web” about the privacy challenges of the United States Postal Service (USPS) website.
It is interesting and revealing to see how the concerns and threats have evolved from primarily worrying about web defacements and hackers to now needing to address information security and privacy protections throghout the entire enterprise, right on out to the user endpoints (desktop computers, laptops, etc.).
How often do organizations re-evaluate the adequacy of their information security and privacy programs? If they depend completely upon their own personnel to do this, it is likely it is not often enough. Except for those comparatively few security/privacy stellar organizations, such evaluation activities often take back seat to other activities and day-to-day security/privacy fire-fighting activities.
If you cannot reliably use your own personnel to perform periodic evaluation of the adequacy of your organization’s information security and privacy efforts because they cannot realistically fit such activities in with their other job responsibilities (which is all too common), then seriously consider hiring an independent third party to perform such evaluation. You should have a third party occasionally perform independent reviews anyway to provide a level of objectivity you cannot get with your own personnel, and also to catch vulnerabilities and identify new threats that your personnel may not have the experience or up-to-date knowledge to identify.
Technorati Tags
information security
IT compliance
policies and procedures
privacy incident
awareness and training
privacy
GPS Tracking Urged As a Laptop Security Measure
Saturday, October 21st, 2006A solution for addressing laptop thefts and losses was described in a press release today. The product uses GPS in combination with encryption to locate stolen and lost laptops quickly in addition to being able to delete sensitive files from lost or stolen computers.
I know nothing about this particular product, "MyLaptopGPS," beyond this press release, but the concept is good, and there may be other products out there that do the same thing. Security in layers does not just apply to networks; it applies to all aspects of information security.
In fact, with regard to mobile computing devices it is good to take MANY safeguards, a few of which include:
- Encrypt all sensitive data on the device. This often is most efficient to accomplish by encrypting the entire hard drive.
- Use boot and login passwords…GOOD passwords!
- Configure the device to automatically lock, requiring requiring password based re-authentication, after a specified period of inactivity. 5 or 10 minutes is reasonable.
- Use privacy screens to cut down the amount of information onlookers, nosy neighbors and other looky-loos can see, like on planes, in airports and so on.
- Use asset monitoring tags and services, such as StuffBak. The GPS product also serves a similar purpose.
- Require unique devices for each person; don’t allow the devices or passwords on the devices to be shared; this destroys accountability.
- Maintain an inventory of all mobile computing devices used, along with the data stored upon them.
- Do not allow mobile computin devices used for business to also be used for personal activities or to be shared with others, such as friends and family members.
- Do not allow employee-owned mobile computing devices to be used for business purposes. Organizations should own all the computing devices used for business purposes to ensure all business policies and procedures can be applied to them.
- Provide locking devices and other methods for physically protection mobile computing devices when personnel have them outside the more protected confines of the corporate facilities.
- Do not allow large amounts of PII to be stored on mobile computing devices.
- Implement malicious code prevention software and personal firewalls on mobile computing devices.
- Very importantly, provide awareness and training for your folks who use mobile computing devices!!! You can’t expect that they will provide appropriate safeguards if you do not tell them what the appropriate safeguards are that they need to take.
Technorati Tags
information security
IT compliance
policies and procedures
encryption
awareness and training
laptop theft
privacy
How the HIPAA Enforcement Rule Impacts the Compliance Efforts of Covered Entities
Wednesday, August 16th, 2006In this episode, I speak with two highly experienced HIPAA compliance experts, Kevin Beaver and Brad Smith to get their views and opinions about this much discussed but often debated regulation. In particular we discuss the relatively new HIPAA Administrative Simplification Enforcement Final Rule, and how it impacts providers and payers. We explore and try to determine what, if any, impact the HIPAA Enforcement Rule has on Covered Entities.
Instead of clarifying compliance enforcement issues for covered entities (CEs), the Enforcement Rule has seemed to confuse and mislead many CEs into believing that they really don’t need to do much with regard to HIPAA compliance unless the Department of Health and Human Services (HHS), the Office for Civil Rights (OCR) or the Centers for Medicare and Medicaid Services (CMS) come knocking at their door and tell them they specifically need to do something.
Not all CEs are lackadaisical, though; Kevin, Brad and I discuss some of the CEs that have been very diligent in their HIPAA compliance efforts. However, we also discuss some examples of blatent disregard for HIPAA, and the resulting risks to organizations from such action. We also discuss the importance of addressing compliance through partnering information security, privacy, legal and compliance areas.
What IT Leaders Need to Know About Using Production Data for Testing
Friday, July 14th, 2006There are many issues involved with using live production data, particularly real personally identifiable information (PII), for test and demo purposes. For many years it has been the norm within organizations to use copies of production data for testing during applications and systems development. However, over the past few years this practice is becoming more and more of a bad idea with all the new privacy laws and regulations, identity theft cases, insider instigated fraud, increased customer awareness, and the growing number of companies using outsourced companies to manage applications development, testing and quality assurance.
In my latest podcast I discuss the importance of and reasons for using data that does not include real, production PII for test and development purposes.
MP3: Rebecca Herold – What IT Leaders Need to Know About Using Production Data for Testing
Demystifying Privacy Laws: What You Need to Know to Protect Your Business
Friday, June 30th, 2006We are undergoing a data protection renaissance. New laws have considerably expanded corporate obligations regarding security and privacy for information in all forms. A significant obligation of the laws is applicable to basically all organizations; the duty to provide reasonable security for all corporate information. Bottom line, generally all organizations have some legal obligation to establish effective information security programs. It is important to realize that in most cases there are no hard and fast rules regarding which specific security measures a company should implement to satisfy its legal and privacy law obligations. In this podcast I discuss what you need to know to protect your business when trying to comply with the multitude of privacy laws, and I describe a unified, process oriented best practice approach organizations can use to address the requirements of such laws as HIPAA, GLBA, Canada’s PIPEDA, the EU Data Protection Directive, among many, many others.
MP3: Rebecca Herold – Demystifying Privacy Laws: What You Need to Know to Protect Your Business
