In 1990 when I was an internal auditor I was tasked with determining the overall information security posture of my company. One of the things that I decided would be a good thing to do was to go to the offices Saturday and Sunday evening when there would be the fewest personnel around. I wanted to look at their work areas to see what type of information security risks I could find that were a result of the work habits of the personnel.
Posts Tagged ‘risk management’
18 Common Security and Privacy Work Area Vulnerabilities
Wednesday, September 26th, 2007Canadian Privacy Commissioners Release TJX Investigation Report
Tuesday, September 25th, 2007Yesterday the Office of the Privacy Commissioner of Canada and the Office of the Information and Prrivacy Commissioner of Alberta released their “Report of an Investigation into the Security, Collection and Retention of Personal Information” concerning the TJX breach. The investigation was performed to determine if, and if so to what extent, the incident was a violation of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and/or the Personal Information Protection Act (PIPA).
Security and Privacy Pros Believe…Yes! Privacy Still Does…Or At Least Can…Still Exist!
Monday, September 24th, 2007Last Friday I had the pleasure of discussing the question of, “Do We Have Privacy Anymore” with a group of highly regarded information security and privacy pros, including:
Use COSO for SOX and Other Compliance Activities
Sunday, September 23rd, 2007On September 17 the COSO “Guidance on Monitoring Internal Control Systems” discussion document was released, with public comment on the paper being accepted until October 31.
A Military Grade Encrypting Self-Destructing USB Drive Makes A Great Gift!
Saturday, September 22nd, 2007This morning I was doing some of my Christmas gift shopping…yes, I like to get mine done early! 🙂 Any way, I’m thinking about getting an Ironkey encrypted USB drive for some of my relatives who are in dire need of protecting their information better.
ISO/IEC 17799:2005 By Another Name Is Still The Same
Friday, September 21st, 2007I’ve been doing some compliance gap analysis work comparing the policies of one of my clients with ISO/IEC 17799:2005. It was renamed in July of this year to ISO/IEC 27002:2005. So, along with the name change, did the content also change? Having the 2005 tacked on the end of the new name would seem to possibly indicate not. Hmm…
PII for 60,000 Lost In Yet Another Incident: Know How To Address The Risks Involved With Entrusting PII To Business Partners
Thursday, September 13th, 2007Yesterday yet another incident occurred where a business partner / vendor lost the personally identifiable information (PII) for which they had been entrusted. Americhoice sent a CD containing the PII of 67,000 individuals to TennCare via overnight UPS delivery.
Craig’s Voicemail Error Not Uncommon; Be Sure Your Employees Don’t Do the Same!
Saturday, September 8th, 2007This week Larry Craig, the U.S. Senator embroiled in a sex scandal, left a long, detailed voice mail message for his lawyer. Problem was, he misdialed and left the message on another person’s voice mail!
Craig’s Voicemail Error Not Uncommon; Be Sure Your Employees Don’t Do the Same!
Saturday, September 8th, 2007This week Larry Craig, the U.S. Senator embroiled in a sex scandal, left a long, detailed voice mail message for his lawyer. Problem was, he misdialed and left the message on another person’s voice mail!
