Now Available:

line

Featured Resources:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Rebecca.

February 18, 2008

Have You Looked In Your Trash Bins Lately?

It shouldn't still amaze me, but it does, how often so many organizations just dump huge amounts of printed paper containing tons of personally identifiable information (PII) right into their dumpster sitting behind their building, in the alley, or some other easily reachable public location.

Here's yet another example of a business throwing away people's privacy in their trash dumpster...

 
Continue reading Have You Looked In Your Trash Bins Lately?...

February 15, 2008

Identity Theft #1 Consumer Fraud Complaint To FTC in 2007

This week the FTC released the list of the top 20 consumer fraud complaints they received in 2007.

Not surprisingly, identity theft topped their list, accounting for 32% of all the complaints.

 
Continue reading Identity Theft #1 Consumer Fraud Complaint To FTC in 2007...

January 14, 2008

Man Pleads Guilty To Loading Keylogger Software On Public Computers Worldwide To Collect PII and Commit Fraud

Here's another good example of an actual cybercrime that was allowed to occur because poor of safeguards on computers provided for public use.

On January 9, 2008, Mario Simbaqueba Bonilla plead guilty to installing keylogger software on hotel business center and Internet cafe computers located in hotels throughout the world that allowed him to access the bank and other financial accounts of over 600 individuals.

 
Continue reading Man Pleads Guilty To Loading Keylogger Software On Public Computers Worldwide To Collect PII and Commit Fraud...

December 6, 2007

Be Aware: Court Ruling Allows Circumstantial Evidence In Court Case Against Company That Experienced Privacy Breach

So many times...actually almost every time...a privacy breach occurs the company that experienced the breach makes a public statement similar to, "We have no evidence that the personal information has been used fraudulently" or "We do not believe the information stolen will be used for identity theft."

Why do companies so often make this statement? Because their lawyers know that it will be hard, if fraud and crime occurs using the compromised personally identifiable information (PII), to directly tie the breach to such fraud crimes.

 
Continue reading Be Aware: Court Ruling Allows Circumstantial Evidence In Court Case Against Company That Experienced Privacy Breach ...

November 5, 2007

Insider Threat Lessons: Posting Threats And Personnel PII On The Internet Establishes Federal Jurisdiction

Here's another insider threat example to know and to discuss with your legal counsel and HR folks. It highlights the need for information security and privacy policies, shows how informatin security and privacy must work with multiple areas on an ongoing basis, and demonstrates the sanctions that can be brought against those who break them.

 
Continue reading Insider Threat Lessons: Posting Threats And Personnel PII On The Internet Establishes Federal Jurisdiction...

November 2, 2007

Definitions For the Identity Theft Prevention Program Rule Under FACTA & Questions For Your Organization

In addition to some great followup questions I got from Andy in response to my blog posting yesterday, "FTC Now Requires Organizations to Have an Identity Theft Prevention Program" I have also received some interesting questions from others about the new Identity Theft Prevention Program Rule, along with having the opportunity to have some interesting discussions with several folks today, such as Linda McGlasson at bankinfosecurity.com.

 
Continue reading Definitions For the Identity Theft Prevention Program Rule Under FACTA & Questions For Your Organization...

November 1, 2007

FTC Now Requires Organizations to Have an Identity Theft Prevention Program

Did you know that if you are a U.S. financial organization, *AND/OR* if you have information about your U.S. customers with which identity theft could occur, you are now legally required to have a documented Identity Theft Prevention Program to help prevent identity theft in connection with new and existing accounts?

 
Continue reading FTC Now Requires Organizations to Have an Identity Theft Prevention Program...

October 26, 2007

Many Kinds of Identity Theft Cause Many Types of Long Lasting Negative Impacts

I want to revisit the blog posting I made a few days ago, "Average Cost of ID Theft Per Victim is $31,356"

Some folks gave me some feedback, saying that they thought this cost was way too high based upon their own experiences when someone had used their credit cards and "it only took a matter of minutes to call the credit card company and report it, cancel the card/number, and get a new card, along with the $50" that they were responsible for.

 
Continue reading Many Kinds of Identity Theft Cause Many Types of Long Lasting Negative Impacts ...

October 24, 2007

Average Cost of ID Theft Per Victim is $31,356

Finally, a report that looks much more accurate with regard to how much identity theft costs the VICTIMS of a privacy breach. Most reported victim costs that I have seen in the past seemed much too low considering all the time that victims talked about trying to repair and recover from identity theft, and how much resources it took, the many years it often takes, and so on.

 
Continue reading Average Cost of ID Theft Per Victim is $31,356...

September 18, 2007

New FTC Report Provides Organizations Good Guidance For Protecting PII

Today the U.S. Federal Trade Commission (FTC) released a report, "Combating Identity Theft: Implementing a Coordinated Plan."

 
Continue reading New FTC Report Provides Organizations Good Guidance For Protecting PII...

line

Rebecca Herold's Bio:

Rebecca Herold,CISSP, CIPP, CISM, CISA, FLMI, has been providing information security, privacy and regulatory assistance and services to organizations from a wide range of industries for over 18 years. Rebecca was instrumental in building the information security and privacy program while at Principal Financial Group, which was awarded the CSI Information Security Program of the Year Award in 1998. IT Security ranked Rebecca as one of the top 59 IT security influencers, and Computerworld put Rebecca their list of the 25 top privacy experts and on their list of the 9 best privacy consulting firms. Rebecca has been CPO for two consulting organizations, and has had her own information privacy, security and compliance business since 2004. Rebecca has written chapters for several books, dozens of articles, and has been writing a monthly privacy column for the CSI Alert newsletter since the beginning of 2001, and is working on her 11th book. Some of her other books include The Privacy Papers, Managing an Information Security and Privacy Awareness and Training Program, The Definitive Guide to Security Inside the Perimeter (Realtime Publishers), The Shortcut Guide to Improving IT Service Support through ITIL (Realtime Publishers), and The Practical Guide to HIPAA Privacy and Security Compliance. In addition, Rebecca is the leader of The Realtime IT Compliance Community where she posts to her IT Compliance weblog. You can contact Rebecca at: rebecca_herold@realtimepublishers.net.