By:
On:
In: *Connecting the Dots Blog*, Connect the Dots, Information Security, Regulatory Compliance

Connecting the dots with Cyber Security failures…Why are so many Cyber Security failures occurring? The data doesn’t lie.  The 2018 Global State of Information Security Survey from PwC surveyed 9,500 executives across 120 countries which helps explain why so many organizations and failing to prevent Cyber Security incidents: 48% of the 9,500 executives said they do not have an employee security awareness training program 54% of the 9,500 executives said they do not have an incident response process The Equifax breach exposed why PATCHING systems is critical and costly if you fail. (see VIDEO here) I also shared the DAM Analogy for why PATCHING yourRead More →

By:
On:
In: *Connecting the Dots Blog*, Education, Regulatory Compliance, Risk Management, School Safety, Success

Awareity’s Rick Shaw recently had the opportunity to speak with Tulsa Public Schools’ Assistant Athletic Director Mick Wilson.   TPS is always looking for ways to save time and improve the way the athletic department manages their obligations and Wilson shares several tips for improving compliance and touches on hot topics like concussions, training, etc. A quick excerpt from the interview is below.  To hear the full 15 minute segment, click here.   How is TIPS improving the way you make coaches aware of new information and training? The biggest thing we have been able to do so far is really to get the information outRead More →

By:
On:
In: *Connecting the Dots Blog*, Human Resources, Legal, Regulatory Compliance

  I recently came across a discussion between Markkula Center for Applied Ethics’ Executive Director Kirk Hanson and Craig Nordlund, former general counsel of Agilent Technologies.  Nordlund believes the concern for ethics must be shared by everyone in the organization, but suggests ethics programs will be ineffective without leadership from the company’s top executives. It is hard to argue with his comment stating “ethics programs will not work unless there is leadership on ethics from the company’s top executives”. However, lessons learned and incidents seem to clearly reveal that leadership from the company’s top executives is not enough. So why is creating an ethics cultureRead More →

By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security, Regulatory Compliance

  A review of security practices and investments at 46 global organizations finds that compliance with industry security standards actually saves money over the long-term.   A recent Ponemon Study revealed that companies that consistently comply with security requirements and standards save three times more in security-related expenses annually than non-compliant companies. Lessons Learned: Compliance does not equal security, but security can benefit from compliance.  Organizations investing in comprehensive compliance programs are better prepared to prevent expensive breaches, lawsuits, fines, etc. and save money and resources over time.Read More →

By:
On:
In: *Connecting the Dots Blog*, Financial, Human Resources, Information Privacy, Information Security, Regulatory Compliance, Risk Management

  Recent attacks continue to show that spear phishing is quickly emerging as one of the society’s greatest threats.  Technology alone is NOT going to solve this problem.  It is critical for consumers to be more vigilant and aware of what they are clicking on, sites they are visiting, e-mails they are responding to, etc. Lessons Learned:  Financial insitutions should make consumer education a higher priority.  Awareness training, handouts, seminars, etc. can be a great way for organizations to connect with their customers, improve trust, enhance reputations and help prevent potential incidents, breaches, lawsuits, etc. down the road.  Security awareness training and education can become aRead More →

By:
On:
In: *Connecting the Dots Blog*, Human Resources, Regulatory Compliance

  OCEG recently announced poll results from a One Minute Poll about Policy Management.  In their poll, 429 members replied to the following question: How do you primarily manage lifecycle of internal policies, procedures and guidelines? 32% use an internally developed database or intranet system 24% have no formal structure 18% use file folders or centralized network drive 14% use document or policy management software  8% track changes in Word  4% use other methods   Lessons learned:  Bad guys already know what the results from this poll clearly reveal…People are an organization’s weakest links.  As long as 86% or more of organizations continue to useRead More →

By:
On:
In: *Connecting the Dots Blog*, Regulatory Compliance, Risk Management

  Miami-based Pacific National was fined a $7 million penalty for violations to the Bank Secrecy and USA Patriot acts. Lessons Learned: Fines for gaps in AML practices are becoming more severe.  Financial organizations must ensure they have the appropriate policies and procedures in place and ensure their people are aware and accountable for their decisions to meet ongoing compliance requirements.  Organizations also need legal-ready and audit-ready documentation to avoid expensive fines, lawsuits, and embarrassing headlines.Read More →

By:
On:
In: Campus Safety, Education, Government, Incident Reporting, Regulatory Compliance, School Safety

  The Department of Education and Office of Civil Rights sent out a “Dear Colleague” letter in October 2010 outlining schools’ responsibilities for being aware of, responding to and preventing future incidents of bullying, discrimination and harassment.  In response to the National School Board Association’s letter questioning a school’s responsibilities, the  Department of Education response clearly states it did not overreach in its original guidance to school officials— it only reiterated existing laws and policies and gave examples of how school districts can help combat bullying and harassment. Lessons Learned:  Schools have been put on notice and must develop comprehensive programs to respond to incidentsRead More →

By:
On:
In: *Connecting the Dots Blog*, Campus Safety, Emergency Management, Incident Reporting, Legal, Regulatory Compliance, Risk Management, School Safety

  Virginia Tech was fined the maximum fine allowed under the Clery Act of $55,000 for waiting almost two hours before warning students, faculty and staff of an active shooter on campus. Lessons Learned: Colleges and Universities must develop, implement and follow clearly defined policies and procedures for notifying students and staff in emergency situations.  School Administrators may want to create customizable, organizational and situational specific templates prior to an incident so the warning messages are already defined and the appropriate processes are understood by all appropriate personnel.   Organizations must also have customized emergency and crisis management plans and ensure all individuals (students, faculty, staff,Read More →

By:
On:
In: *Connecting the Dots Blog*, Campus Safety, Emergency Management, Incident Reporting, Legal, Regulatory Compliance, Risk Management, School Safety

  The U.S. Department of Education released the Handbook for Campus Safety and Security Reporting providing step-by-step procedures, examples, and references for higher education institutions to follow in meeting campus safety and security requirements. Lessons Learned:  College and University administrators are overwhelmed with responsibilities for HEOA, FERPA, HIPAA, Clery Act, OCR ‘Dear Colleague’ Letters, and much more and therefore guidance from the Federal Government can be helpful.  It is critical for School Administrators to utilize resources and develop comprehensive campus safety programs and create a culture of compliance and preparedness that is ongoing.  Traditional methodologies are clearly not working based on new handbooks, new regulationsRead More →