By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Emergency Management, Risk Management

  Reviewing the bipartisan Commission on the Prevention of Weapons of Mass Destruction Proliferation and Terrorism report card reveals lessons learned have not become lessons implemented. The report card included an ‘F’ grade in Biological Risks due to the nation’s capabilities lacking to:  Coordinate and deploy rapid response to prevent biological attacks causing mass casualties   Under Government Reform, the report card included two more ‘F’ grades for: Reform congressional oversight to better address intelligence, homeland security, and crosscutting 21st century national security missions Implement education and training programs to recruit and retain the next generation of national security experts   The two ‘F’ gradesRead More →

By:
On:
In: *Connecting the Dots Blog*, Emergency Management, Incident Reporting, Risk Management

  I re-read this NTSB story a couple times and it still left me scratching my head…installing cameras will prevent what? The USA Today article stated: The NTSB found that the Sept. 12, 2008, crash between commuter and freight trains that killed 25 people was caused by an engineer who sped through a stop signal as he was texting. The engineer, who died in the crash, had been warned about cell phone use on the job twice before. Accident investigators uncovered such egregious behavior by train operators in the fatal 2008 accident near Los Angeles that they suggested Thursday that all railroads monitor crews withRead More →

By:
On:
In: *Connecting the Dots Blog*, Uncategorized

  If you made resolutions to lose weight, which of the following options would you choose? Option 1 – cut off an arm or a leg or both. Option 2 – change your eating patterns and identify new ways to burn calories. Both options will help you cut weight, but… Option 1 would most likely limit your capabilities to achieve short term and long term goals and limit your ability to achieve better results overall. Option 2 would most likely make you feel better and increase your ability overall to do and achieve better results. As more and more organizational leaders face budget cuts, organizationalRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security, Risk Management

Teachable Moments vs. Ongoing Awareness Reminders As a follow up to the previous blog regarding the sensitive ethics document from the Committee on Standards that ended up in the hands of The Washington Post, I wanted to take a look at teachable moments vs. ongoing awareness reminders. If you go to the Committee on Standards of Official Conduct web site and look up their training requirements for 2009 you will see an example of once-a-year training requirements and you will see individual training requirements are based on pay scales.  This seems ironic to me since the Committee on Standards blamed a low-level staffer for theRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security, Risk Management

Low-Level Staffer Blamed for Committee on Standards Breach In case you missed the story last week, multiple lessons learned and teachable moments have emerged from an incident involving a sensitive ethics committee document that ended up in the hands of the Washington Post.  The ethics document exposed numerous ongoing investigations into the conduct of more than two dozen House members.   Most articles seem to be blaming the unauthorized access to the sensitive ethics document on a low-level staffer working from home on their personal laptop using a peer-to-peer file-sharing program which provided unauthorized access to the ethics document.  Asking good questions can be a greatRead More →

By:
On:
In: *Connecting the Dots Blog*, Incident Reporting, Information Privacy, Information Security, Regulatory Compliance

We have all heard the wise old saying….’One man’s trash is another man’s treasure’ and potentially we have yet another lesson learned for organizations who are obligated to protect their client’s personal information. In this lesson learned from Ohio, three large storage bins were stolen from outside of three different bank branches in three different cities.  Each of the three large storage bins contained paper that was waiting to be shredded and at least one of the storage bins contained personal documents of bank customers. A few questions this incident brings to mind: Should personal data be stored outside of buildings? Should trash/storage bins beRead More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Regulatory Compliance, Risk Management

Yes, I admit it…I was surfing the FDIC web site this past weekend and I was spending some time reviewing past Financial Institution Letters that the FDIC releases to advise the banking industry of supervisory changes and guidelines. I came across a Financial Institution Letter for Newly Insured FDIC-Supervised Depository Institutions that included the new changes, as well as a list of common elements from troubled or failed institutions. The list offers some potential lessons learned for organizational leaders (board of directors, executive management, compliance and others) and so I thought I would share the list. Rapid growth Over-reliance on volatile funding, including brokered depositsRead More →

By:
On:
In: *Connecting the Dots Blog*, Incident Reporting, Information Privacy, Regulatory Compliance

If you were busy getting your costume ready for Halloween, you might have missed the news release from HHS on October 30, 2009.  This news release should be taken seriously by all covered entities and organizational leaders that have responsibilities for protected health information (PHI) The news release announces that HHS has issued an interim final rule to strengthen its enforcement of the rules within HIPAA to conform to the HIPAA enforcement regulations made by the HITECH Act. As you may remember, the Health Information Technology for Economic and Clinical Health (HITECH) Act was enacted as part of the American Recovery and Reinvestment Act (ARRA)Read More →

By:
On:
In: *Connecting the Dots Blog*, Information Security

The battle of the megaphones…it’s on! The California Public Employees’ Retirement System (CalPERS) has launched a web site to target misinformation and offers a way to let its members, employees, employers and others keep up with issues in national health care reform, pension investments and security. CalPERSResponds.com is the new web site that will also link to its social media posts on Twitter, Facebook and YouTube. According to Patricia Macht, CalPERS director of external affairs, “There’s a lot of information and misinformation about CalPERS” and “We hope this site will help separate the facts from fiction and provide some education, insight and clarity to theseRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Security, Risk Management

According to news reports, a spear-phishing experiment conducted over the past few days has revealed some disturbing new risks for organizations using enterprise e-mail products and services:  Most major enterprise e-mail products and services were unable to detect a fake LinkedIn invitation that looked like it was from Bill Gates inviting people to join his professional network.  Once the ‘victim’ clicked on the ‘invite’ link, they were sent to the phishing site where information about the ‘victim’ was captured. The article in Dark Reading detailed comments from CEO of PacketFocus including: “I tested the spoofed e-mail on six different enterprise networks using the latest e-mailRead More →