Email Address:
I read a story about a city government agency actually asking job applicants to provide their IDs and passwords for any online social networking type of site they participate in...
Continue reading Don't Manage Employee Online Activities By Requiring Their IDs & Passwords!...
Today Kevin Beaver posted a nice article, "Dumb things IT consultants do" that included more than one warning about making assumptions. Kevin's nice post made me think about all the dangerous assumptions consulants and practitioners often make when it comes to evaluating privacy practices...
Continue reading 5 Common, Dumb and Dangerous Privacy Assumptions...
Today the FTC issued a consent order against mortgage lender James B. Nutter & Company for GLBA Privacy Rule and Safeguards Rule violations resulting from having an inadequte information security program and safeguards. The requirements will result in, among other actions, 20 years of ongoing activities by James B. Nutter & Company; much more costly than it would have been to have established appropriate information security safeguards to begin with...
Continue reading FTC Issued Consent Order for GLBA Privacy Rule and Safeguards Rule Violations...
As I've mentioned a few times before, I'm in the final lap of finishing the 2nd edition of my book, "Managing an Information Security and Privacy Awareness and Training Program." Woo hoo!
Over the weekend I updated "Appendix N - Designated Security and Privacy-Related Days." Here are the days, weeks and months I've found are devoted to raising awareness about various info sec and privacy issues (this is in a much nicer-looking table format in my book)...
Today a report discussed how a healthcare worker obtained medical information about a patient with HIV that was then posted on the Internet...
I'm doing research while working on the 2nd edition of my book, "Managing an Information Security and Privacy Awareness and Training Program"...
Continue reading Privacy Enhancing Technologies (PETs) & Privacy Threatening Technologies...
There has been much written in the past week about Merrick Bank suing the audit firm, Savvis, because a breach occurred at CardSystems in 2005 even though Savvis had given passing marks for the CardSystems audit that Merrick Bank hired them to perform in 2004 to ensure they were following Visa's Cardholder Information Security Program (CISP); basically a forerunner of the current PCI DSS program. Savvis found that CardSystems was following the CISP requirements. Within a year after the audit, CardSystems experienced a major breach that basically put them out of business.
I have had the great privilege to work as an IT auditor early in my career, for a while as an internal auditor at a large multi-national financial and insurance company, and then doing periodic audits since in various organizations in a wide range of industries since. All wonderful learning experiences!
There are a couple of important points that the judge in this situation should consider, and the lawyers in this case should understand:
I got my week's issue of Time magazine in the mail today, and lo-and-behold the cover and feature story was about Twitter!
Continue reading Great InfoSec and Privacy Info and Resources This Week On Twitter...
Last month Iowa State University, in Ames, held a unique type of IT Olympics for teens...
The topic for my Q2 2009 issue of Protecting Information was helping employees to understand why different types of information need different levels of security. Yes, this is information classification, but I describe it in a way that employees of all levels and responsibilities throughout an organization can understand, here's how...
Continue reading Effectively Explaining the Purpose of Information Classification to Employees...
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine