Over the past few months I’ve been keeping a fairly close eye on the evolution of social networks and the security and privacy impacts they have not only on the individuals participating, but also on the businesses that allow their personnel to use the sites from the company’s network. Or, what is more often the case, the large amount of employees using the sites from the company network during work hours unbeknownst to their bosses.
Posts Tagged ‘security training’
3 Creative Ways to Fund Information Security and Privacy Awareness
Thursday, November 8th, 2007Several years ago I helped the information protection program at a large organization with getting supplies and prizes for the awareness program on an extremely limited budget. Having some type of prizes and/or recognition for awareness activities and contests is a very good motivator to get your folks involved, and to raise their awareness of important information security, privacy and compliance issues in the process!
New PCI Standard Draft Released Today; the Payment Application Data Security Standard (PA-DSS)
Wednesday, November 7th, 2007The PCI Security Standards Council announced today the release of draft for a new standard for payment application software; the Payment Application Data Security Standard (PA-DSS).
Judge Rules University Policy & FERPA Allow Student PII To Be Released
Tuesday, November 6th, 2007Here’s a case I found interesting…the U.S. District Court for the Eastern District of Tennessee ruled on October 24th that providing a group of record company plaintiffs with student personally identifiable information (PII) does not violate the U.S. Family Educational Rights and Privacy Act (FERPA).
Judge Rules University Policy & FERPA Allow Student PII To Be Released
Tuesday, November 6th, 2007Here’s a case I found interesting…the U.S. District Court for the Eastern District of Tennessee ruled on October 24th that providing a group of record company plaintiffs with student personally identifiable information (PII) does not violate the U.S. Family Educational Rights and Privacy Act (FERPA).
Insider Threat Lessons: Posting Threats And Personnel PII On The Internet Establishes Federal Jurisdiction
Monday, November 5th, 2007Here’s another insider threat example to know and to discuss with your legal counsel and HR folks. It highlights the need for information security and privacy policies, shows how information security and privacy must work with multiple areas on an ongoing basis, and demonstrates the sanctions that can be brought against those who break them.
Insider Threat Lessons: Posting Threats And Personnel PII On The Internet Establishes Federal Jurisdiction
Monday, November 5th, 2007Here’s another insider threat example to know and to discuss with your legal counsel and HR folks. It highlights the need for information security and privacy policies, shows how information security and privacy must work with multiple areas on an ongoing basis, and demonstrates the sanctions that can be brought against those who break them.
Do Something To Change Information Security, Privacy and Compliance…Contact Congress!
Sunday, November 4th, 2007I, along with a very large number of other bloggers, writers and instructors, often pick apart data protection and privacy laws and regulations, and point out how certain portions of them are infeasible for most organizations to implement, and talk about the types of laws that should be inacted to protect personally identifiable information (PII) and privacy. But how many of us actually do something about it and contact our lawmakers to communicate this information?
Do Something To Change Information Security, Privacy and Compliance…Contact Congress!
Sunday, November 4th, 2007I, along with a very large number of other bloggers, writers and instructors, often pick apart data protection and privacy laws and regulations, and point out how certain portions of them are infeasible for most organizations to implement, and talk about the types of laws that should be inacted to protect personally identifiable information (PII) and privacy. But how many of us actually do something about it and contact our lawmakers to communicate this information?
Definitions For the Identity Theft Prevention Program Rule Under FACTA & Questions For Your Organization
Friday, November 2nd, 2007In addition to some great followup questions I got from Andy in response to my blog posting yesterday, “FTC Now Requires Organizations to Have an Identity Theft Prevention Program” I have also received some interesting questions from others about the new Identity Theft Prevention Program Rule, along with having the opportunity to have some interesting discussions with several folks today, such as Linda McGlasson at bankinfosecurity.com.
