By:
On:
In: *Connecting the Dots Blog*, Incident Reporting, Information Privacy, Information Security, Regulatory Compliance

Step 8 of President Obama’s 10-point action plan is: Prepare a cybersecurity incident response plan; initiate a dialog to enhance public-private partnerships with an eye toward streamlining, aligning, and providing resources to optimize their contribution and engagement. Keywords in Step 8 include: Prepare, Initiate, Dialog, Partnership, Streamlining, Aligning, Optimize. Preparing an incident response plan is a great idea and can play a critical role in the success of a cybersecurity action plan, however a lot organizations have incident response plans that are not producing much if any feedback.   Why are traditional response plans not working? Problems with traditional incident response plans lack anonymity on theRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security

As I mentioned in previous blogs, the new Cybersecurity Adviser will essentially be the “Head Coach” and he/she will need to create an “intelligent playbook” to lead the offense and the defense and to ensure all appropriate individuals are aware of their roles and responsibilities. Action Step 4 in President Obama’s Cybersecurity plan is: Designate a privacy and civil liberties official to the NSC Cybersecurity directorate. On paper, designating an official or officials to focus on privacy and civil liberties makes good sense, however lessons learned have clearly shown that government officials continue to look at privacy and civil liberties as too much of aRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security, Risk Management

The good news is that Social Networking is experiencing explosive growth. The bad news is that Social Networking is experiencing explosive growth. According to the third annual Deloitte LLP Ethics & Workplace survey, organizational leaders have some decisions to make when it comes to employee beliefs and management beliefs regarding online Social Networking. 60% of business executives believe they have the right to know how employees portray themselves and their organizations in online social networks 53% of employees disagree and say their social networking pages are not an employer’s concern 63% of younger employees (age 18-34)  say employers have no business monitoring their online activityRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security

So the new Cybersecurity Adviser (aka Head Coach) will be announced this week…and as I mentioned previously regarding Step 1 and Step 2, the Head Coach will play a vital role in coordinating people, entities, policies, activities, strategies and ongoing updates as strategies and threats change.  We reviewed how the Head Coach will need to implement an “intelligent playbook” to ensure all appropriate people have access to customized knowledge they need to make better decisions and achieve better results.  The “cybersecurity intelligent playbook” will no doubt need tools that will empower the Head Coach and enable all appropriate personnel to have secure accessibility to theirRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security

Part 2 of several to come… Looking over President Obama’s 10-point action plan, there is no doubt that the key to successfully protecting, deterring, preventing, detecting and defending our digital infrastructure and strategic national assets will be the “playbook” and the “execution of the playbook” by all appropriate individuals. Step 1 of the 10-point action plan is to appoint a cybersecurity policy official responsible for coordinating the nation’s cybersecurity policies and activities and coordinate with National Security Council and National Economic Council to coordinate interagency development of cybersecurity- related strategy and policy.  Sounds like a Head Coach and more to me… The Head Coach isRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security

Part 1 of several to come… Thank you President Obama! As you probably saw in the news, President Obama presented a 10-point action plan aimed at securing federal government’s critical IT infrastructure. I missed the President’s live press conference that day, so when I returned to the office I found the news story about the President’s 10-point action plan.  There is no doubt that cybersecurity has become a significant concern for government and private organizations too and I wanted to see specifically what President Obama’s 10-point action plan looked like and if it targeted some of the challenges I have seen in my 20+ yearsRead More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Incident Reporting, Information Privacy, Information Security, Legal

In 2007 the Swedish Bank, Nordea was stung for $1.1 million, in the “biggest ever” online bank heist.  250 bank customers were affected by the fraud after falling victim to phishing e-mails.  The e-mail contained a trojan horse that redirected customers to a false home page where they entered important login information.  Most of the customers affected had not been running antivirus applications on their computers. The bank covered the attacks and refunded all the affected customers. In 2009 Credit Union Customers received text messages notifying them that their debit cards had been inactivated.  The message gave a number to call to reactivate the cardRead More →

By:
On:
In: *Connecting the Dots Blog*, Incident Reporting, Information Privacy, Information Security, Legal, Regulatory Compliance

The “octuplet mom” story not only created a media frenzy at Kaiser Permanente’s Bellflower hospital , the mom and her eight new born babies also created multiple lessons learned opportunities for every hospital that was paying attention. The lessons learned started in January when the eight new babies were born and making sure hospital personnel were prepared to handle the media frenzy and what they could say and not say and what actions were acceptable and unacceptable.  Does your organization have policies and procedures in place to handle a media frenzy? Then in March, Kaiser Permanente’s Bellflower hospital revealed that 15 employees lost their jobsRead More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Incident Reporting, Information Privacy, Information Security, Regulatory Compliance, Risk Management

In one of the largest data breaches to date, Heartland Payment Company compromised the cards of over 100 million people, almost 1/3 of the U.S. population. In addition to dealing with a damaged reputation, expensive notifications and fallout, and continued lawsuits from affected banks and credit Unions, the latest hit to Heartland came from Visa.  Visa recently took action at Heartland by suspending the data breach victim and removing it from Visa’s online list of PCI-DSS compliant providers. Heartland was last certified as PCI-DSS compliant in April 2008 but in a presentation given earlier this month by two Visa executives, Visa was quoted as saying,Read More →

By:
On:
In: *Connecting the Dots Blog*, Human Resources, Incident Reporting, Information Privacy, Information Security, Regulatory Compliance, Risk Management

In case you didn’t notice among all the TARP and Stimulus Bill news…the Veterans Affairs Department has agreed to pay $20M to settle a lawsuit filed by veterans due to a VA laptop containing sensitive information stolen in 2006.  (Before I go any further, I want to be clear that I completely support veterans receiving compensation for out-of-pocket expenses that resulted from the computer theft, credit monitoring to protect against identity loss and medical expenses that were the result of severe emotional distress.) So how is “customized knowledge” and “individual-level accountability” worth at least $20M of your and my money (tax payer dollars)? For starters,Read More →