By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security

Part 2 of several to come… Looking over President Obama’s 10-point action plan, there is no doubt that the key to successfully protecting, deterring, preventing, detecting and defending our digital infrastructure and strategic national assets will be the “playbook” and the “execution of the playbook” by all appropriate individuals. Step 1 of the 10-point action plan is to appoint a cybersecurity policy official responsible for coordinating the nation’s cybersecurity policies and activities and coordinate with National Security Council and National Economic Council to coordinate interagency development of cybersecurity- related strategy and policy.  Sounds like a Head Coach and more to me… The Head Coach isRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security

Part 1 of several to come… Thank you President Obama! As you probably saw in the news, President Obama presented a 10-point action plan aimed at securing federal government’s critical IT infrastructure. I missed the President’s live press conference that day, so when I returned to the office I found the news story about the President’s 10-point action plan.  There is no doubt that cybersecurity has become a significant concern for government and private organizations too and I wanted to see specifically what President Obama’s 10-point action plan looked like and if it targeted some of the challenges I have seen in my 20+ yearsRead More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Incident Reporting, Information Privacy, Information Security, Legal

In 2007 the Swedish Bank, Nordea was stung for $1.1 million, in the “biggest ever” online bank heist.  250 bank customers were affected by the fraud after falling victim to phishing e-mails.  The e-mail contained a trojan horse that redirected customers to a false home page where they entered important login information.  Most of the customers affected had not been running antivirus applications on their computers. The bank covered the attacks and refunded all the affected customers. In 2009 Credit Union Customers received text messages notifying them that their debit cards had been inactivated.  The message gave a number to call to reactivate the cardRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Security, Risk Management

Lost or stolen laptops and other digital media are the cause of more than 40% of data breaches. Business travelers lose more than 10,000 laptops per week in U.S. airports. An estimated 11,300 laptop computers, 31,400 handheld computers and 200,000 mobile telephones were left in taxis around the world during a recent six month period. While these statistics may seem outrageous, I was recently on vacation in Chicago when one of my friends accidentally left his laptop sitting on the train.  While his immediate response was, “Oh, *%$&!”, my thought was “Oh, no, I am going to have to blog about my friend’s company andRead More →

By:
On:
In: *Connecting the Dots Blog*, Incident Reporting, Information Privacy, Information Security, Legal, Regulatory Compliance

The “octuplet mom” story not only created a media frenzy at Kaiser Permanente’s Bellflower hospital , the mom and her eight new born babies also created multiple lessons learned opportunities for every hospital that was paying attention. The lessons learned started in January when the eight new babies were born and making sure hospital personnel were prepared to handle the media frenzy and what they could say and not say and what actions were acceptable and unacceptable.  Does your organization have policies and procedures in place to handle a media frenzy? Then in March, Kaiser Permanente’s Bellflower hospital revealed that 15 employees lost their jobsRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Security, Risk Management

A recent survey revealed that 59% of workers who were laid off, fired or quit their jobs in the last 12 months, admitted to stealing company data.  Many ex-employees are taking information from their organization to help them find new jobs and make them more valuable to competition and other organizations. With the downturn in the economy and layoffs affecting millions of people nation-wide, organizations must realize employees can easily carry out paper documents, CDs, DVDs, USB memory sticks or simply send documents to personal e-mail accounts before exiting, so it is critical for organizations to communicate acceptable and unacceptable actions to all employees andRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Security, Risk Management

A recent incident revealed that thieves installed simple card skimming devices and cameras on bank ATMs, stealing customer account details and recording PIN numbers.  Once the thieves gathered the ATM card data, new ATM cards were easily created with the stolen customer information and the new ATM cards were used to make unauthorized withdrawals. The thieves stole $500,000 from over 250 bank customers, and according to follow up news stories the customers are now being reimbursed by the bank. In this economic  downturn, can  banks afford to put $500,000 back into their customers’ accounts and continue to foot the bill for identity theft? Do youRead More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Emergency Management

This past Sunday I was watching and listening to DHS and HHS officials talk about the Swine Flu Alert. During the announcement I found it interesting that Secretary Napolitano made a special point to clarify the declaration of emergency by saying she wished they could call it a declaration of emergency preparedness, because that is really what it is in this context.   I agree with Secretary Napolitano that a declaration of emergency preparedness is needed because most organizations are not well prepared for a Pandemic flu outbreak….but that is another topic for another day. Then I came across a headline on CNN about TwitterRead More →

By:
On:
In: *Connecting the Dots Blog*, Emergency Management

On Sunday, Secretary Napolitano declared an Emergency of Preparedness, stating, ‘…we’re preparing in an environment where we really don’t know ultimately what the size or seriousness of this outbreak is going to be.’ I agree that this declaration is needed because most organizations are not well prepared for a Pandemic flu outbreak.  Studies show that organizations need to have pandemic plans that address workforce absenteeism rates of 40 percent or higher. What if 40% of your employees were staying home because: 1) They are home sick 2) Family Members are sick 3) Schools are closed 4) Employees fear becoming sick What if your vendors areRead More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Incident Reporting, Information Privacy, Information Security, Regulatory Compliance, Risk Management

In one of the largest data breaches to date, Heartland Payment Company compromised the cards of over 100 million people, almost 1/3 of the U.S. population. In addition to dealing with a damaged reputation, expensive notifications and fallout, and continued lawsuits from affected banks and credit Unions, the latest hit to Heartland came from Visa.  Visa recently took action at Heartland by suspending the data breach victim and removing it from Visa’s online list of PCI-DSS compliant providers. Heartland was last certified as PCI-DSS compliant in April 2008 but in a presentation given earlier this month by two Visa executives, Visa was quoted as saying,Read More →