By:
On:
In: *Connecting the Dots Blog*, Financial, Human Resources, Information Privacy, Information Security, Regulatory Compliance, Risk Management

  Recent attacks continue to show that spear phishing is quickly emerging as one of the society’s greatest threats.  Technology alone is NOT going to solve this problem.  It is critical for consumers to be more vigilant and aware of what they are clicking on, sites they are visiting, e-mails they are responding to, etc. Lessons Learned:  Financial insitutions should make consumer education a higher priority.  Awareness training, handouts, seminars, etc. can be a great way for organizations to connect with their customers, improve trust, enhance reputations and help prevent potential incidents, breaches, lawsuits, etc. down the road.  Security awareness training and education can become aRead More →

By:
On:
In: *Connecting the Dots Blog*, Regulatory Compliance, Risk Management

  Miami-based Pacific National was fined a $7 million penalty for violations to the Bank Secrecy and USA Patriot acts. Lessons Learned: Fines for gaps in AML practices are becoming more severe.  Financial organizations must ensure they have the appropriate policies and procedures in place and ensure their people are aware and accountable for their decisions to meet ongoing compliance requirements.  Organizations also need legal-ready and audit-ready documentation to avoid expensive fines, lawsuits, and embarrassing headlines.Read More →

By:
On:
In: *Connecting the Dots Blog*, Campus Safety, Emergency Management, Incident Reporting, Legal, Regulatory Compliance, Risk Management, School Safety

  Virginia Tech was fined the maximum fine allowed under the Clery Act of $55,000 for waiting almost two hours before warning students, faculty and staff of an active shooter on campus. Lessons Learned: Colleges and Universities must develop, implement and follow clearly defined policies and procedures for notifying students and staff in emergency situations.  School Administrators may want to create customizable, organizational and situational specific templates prior to an incident so the warning messages are already defined and the appropriate processes are understood by all appropriate personnel.   Organizations must also have customized emergency and crisis management plans and ensure all individuals (students, faculty, staff,Read More →

By:
On:
In: *Connecting the Dots Blog*, Campus Safety, Emergency Management, Incident Reporting, Legal, Regulatory Compliance, Risk Management, School Safety

  The U.S. Department of Education released the Handbook for Campus Safety and Security Reporting providing step-by-step procedures, examples, and references for higher education institutions to follow in meeting campus safety and security requirements. Lessons Learned:  College and University administrators are overwhelmed with responsibilities for HEOA, FERPA, HIPAA, Clery Act, OCR ‘Dear Colleague’ Letters, and much more and therefore guidance from the Federal Government can be helpful.  It is critical for School Administrators to utilize resources and develop comprehensive campus safety programs and create a culture of compliance and preparedness that is ongoing.  Traditional methodologies are clearly not working based on new handbooks, new regulationsRead More →

By:
On:
In: *Connecting the Dots Blog*, Campus Safety, Risk Management, School Safety

  Lawsuits targeting school districts for allowing students to be bullied by other students are escalating. Lessons Learned: With new guidelines outlined in an OCR “Dear Colleague” Letter and an increase in bullying, harassment, discrimination and school violence, schools need to be aware of the potential risk of lawsuits.  School leaders must ensure all individuals (staff, faculty, parents, students, counselors, etc.) understand their roles and responsibilities for preventing and responding to bullying and how to report incidents of bullying.  Schools must implement comprehensive and ongoing protocols for responding to ALL incidents of bullying and cyber bullying with legal-ready documentation to avoid “deliberate indifference” claims andRead More →

By:
On:
In: *Connecting the Dots Blog*, Incident Reporting, Information Privacy, Information Security, Risk Management

  CVS Caremark Corp has agreed to pay $17.5 million to resolve claims that it overbilled Medicaid.  The case was brought to the Justice Department by a whistleblower in Minnesota, who will receive $2.6 million. Which makes more sense to you and your bottom line?  A) Having employees report illegal and unethical situations internally so your organization can address situations and document them for legal and CYA purposes or B) having employees report illegal and unethical situations to the federal government and then dealing with expensive multi-million dollar fines, spending time and money and resources on repairing reputations and having the whistleblower get paid millions too?Read More →

By:
On:
In: *Connecting the Dots Blog*, Emergency Management, Risk Management, School Safety

  Brazilian gunman fatally shot 11 children and wounded 18 others at a Rio de Janeiro public school… One person dead and three others hurt in a shooting at Southern Union Community College… Student Planned to Shoot “As Many as He Could”… If you followed the headlines last week, we saw multiple tragedies at schools and colleges around the globe.  However, one high school in Missouri was able to prevent what could have been a potentially devastating attack. An 18 year old student was arrested with conspiring to shoot other students at his school.  There were multiple warning signs identified and fortunately two brave students cameRead More →

By:
On:
In: *Connecting the Dots Blog*, Campus Safety, Human Resources, Incident Reporting, Risk Management, School Safety

  Already in 2011, tragedies in Tucson and Omaha have reminded each of us about the consequences of missed opportunities involving red flags and warning signs.  Lives were lost and lives will be changed forever because of these and many other tragic incidents. We are now learning numerous red flags and warning signs existed involving the gunman in each tragedy, which has many people asking why these two tragedies were not prevented and how can we prevent future incidents like these from occurring? Some people are suggesting new gun control laws in Arizona or new laws that do not allow guns within 1000 feet ofRead More →

By:
On:
In: *Connecting the Dots Blog*, Business Continuity, Regulatory Compliance, Risk Management

  Is Measuring Risk Possible? I saw a discussion question recently asking how to measure risk? My first reaction was…do you measure risk?  I say no. Do you measure security?  Do you measure prevention?   I would say no and no. Do you measure cake? Not usually, unless you are paying for cake by the pound, but measuring the cake does not guarantee the cake is any good. Determining if the cake is any good depends on how the cake looks and how the cake tastes.  To make a good cake, you need to measure each of the ingredients for the cake (internal) and you needRead More →

By:
On:
In: *Connecting the Dots Blog*, Human Resources, Information Privacy, Information Security, Risk Management

  In a recent Dark Reading article, new research from Trusteer revealed that mobile users are the most likely to fall victim to fake e-mail messages and visit phishing sites. Once they arrive at the fraudulent site they are also three times more likely than users on PCs to provide sensitive login information. Why are mobile users more vulnerable? Availability – smartphones are with their users 24/7 so e-mails are checked more frequently. Phishing attacks generally get their victims during their initial launch, as after a certain time frame sites are taken down, blocked or shut down. Size – the smaller screens of mobile devicesRead More →