By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security

So the new Cybersecurity Adviser (aka Head Coach) will be announced this week…and as I mentioned previously regarding Step 1 and Step 2, the Head Coach will play a vital role in coordinating people, entities, policies, activities, strategies and ongoing updates as strategies and threats change.  We reviewed how the Head Coach will need to implement an “intelligent playbook” to ensure all appropriate people have access to customized knowledge they need to make better decisions and achieve better results.  The “cybersecurity intelligent playbook” will no doubt need tools that will empower the Head Coach and enable all appropriate personnel to have secure accessibility to theirRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security

Part 2 of several to come… Looking over President Obama’s 10-point action plan, there is no doubt that the key to successfully protecting, deterring, preventing, detecting and defending our digital infrastructure and strategic national assets will be the “playbook” and the “execution of the playbook” by all appropriate individuals. Step 1 of the 10-point action plan is to appoint a cybersecurity policy official responsible for coordinating the nation’s cybersecurity policies and activities and coordinate with National Security Council and National Economic Council to coordinate interagency development of cybersecurity- related strategy and policy.  Sounds like a Head Coach and more to me… The Head Coach isRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security

Part 1 of several to come… Thank you President Obama! As you probably saw in the news, President Obama presented a 10-point action plan aimed at securing federal government’s critical IT infrastructure. I missed the President’s live press conference that day, so when I returned to the office I found the news story about the President’s 10-point action plan.  There is no doubt that cybersecurity has become a significant concern for government and private organizations too and I wanted to see specifically what President Obama’s 10-point action plan looked like and if it targeted some of the challenges I have seen in my 20+ yearsRead More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Incident Reporting, Information Privacy, Information Security, Legal

In 2007 the Swedish Bank, Nordea was stung for $1.1 million, in the “biggest ever” online bank heist.  250 bank customers were affected by the fraud after falling victim to phishing e-mails.  The e-mail contained a trojan horse that redirected customers to a false home page where they entered important login information.  Most of the customers affected had not been running antivirus applications on their computers. The bank covered the attacks and refunded all the affected customers. In 2009 Credit Union Customers received text messages notifying them that their debit cards had been inactivated.  The message gave a number to call to reactivate the cardRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Security, Risk Management

Lost or stolen laptops and other digital media are the cause of more than 40% of data breaches. Business travelers lose more than 10,000 laptops per week in U.S. airports. An estimated 11,300 laptop computers, 31,400 handheld computers and 200,000 mobile telephones were left in taxis around the world during a recent six month period. While these statistics may seem outrageous, I was recently on vacation in Chicago when one of my friends accidentally left his laptop sitting on the train.  While his immediate response was, “Oh, *%$&!”, my thought was “Oh, no, I am going to have to blog about my friend’s company andRead More →

By:
On:
In: *Connecting the Dots Blog*, Incident Reporting, Information Privacy, Information Security, Legal, Regulatory Compliance

The “octuplet mom” story not only created a media frenzy at Kaiser Permanente’s Bellflower hospital , the mom and her eight new born babies also created multiple lessons learned opportunities for every hospital that was paying attention. The lessons learned started in January when the eight new babies were born and making sure hospital personnel were prepared to handle the media frenzy and what they could say and not say and what actions were acceptable and unacceptable.  Does your organization have policies and procedures in place to handle a media frenzy? Then in March, Kaiser Permanente’s Bellflower hospital revealed that 15 employees lost their jobsRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Security, Risk Management

A recent survey revealed that 59% of workers who were laid off, fired or quit their jobs in the last 12 months, admitted to stealing company data.  Many ex-employees are taking information from their organization to help them find new jobs and make them more valuable to competition and other organizations. With the downturn in the economy and layoffs affecting millions of people nation-wide, organizations must realize employees can easily carry out paper documents, CDs, DVDs, USB memory sticks or simply send documents to personal e-mail accounts before exiting, so it is critical for organizations to communicate acceptable and unacceptable actions to all employees andRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Security, Risk Management

A recent incident revealed that thieves installed simple card skimming devices and cameras on bank ATMs, stealing customer account details and recording PIN numbers.  Once the thieves gathered the ATM card data, new ATM cards were easily created with the stolen customer information and the new ATM cards were used to make unauthorized withdrawals. The thieves stole $500,000 from over 250 bank customers, and according to follow up news stories the customers are now being reimbursed by the bank. In this economic  downturn, can  banks afford to put $500,000 back into their customers’ accounts and continue to foot the bill for identity theft? Do youRead More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Incident Reporting, Information Privacy, Information Security, Regulatory Compliance, Risk Management

In one of the largest data breaches to date, Heartland Payment Company compromised the cards of over 100 million people, almost 1/3 of the U.S. population. In addition to dealing with a damaged reputation, expensive notifications and fallout, and continued lawsuits from affected banks and credit Unions, the latest hit to Heartland came from Visa.  Visa recently took action at Heartland by suspending the data breach victim and removing it from Visa’s online list of PCI-DSS compliant providers. Heartland was last certified as PCI-DSS compliant in April 2008 but in a presentation given earlier this month by two Visa executives, Visa was quoted as saying,Read More →

By:
On:
In: *Connecting the Dots Blog*, Information Security, Regulatory Compliance

I was reading a blog the other day and the question presented to readers was do you believe adoption of end-to-end encryption technology throughout the payments industry is the panacea to protecting personal information?  Some experts have indicated that end-to-end encryption is the way to protect sensitive and personal information from being hacked in situations like TJX and Heartland Payment Systems and others.  The Ponemon Institute even released a new survey (sponsored by PGP – an encryption company) saying that their research shows that breaches are more expensive and can lead to losing customers and indicated that a strategic and more holistic use of encryptionRead More →