Realtime Community | IT Compliance

Nevada's New Encryption Law; Made Moot By Its Own Data Breach Law?

Thu, 02 Jul 2009 17:55:52 -0500

On May 30, 2009, Nevada enacted a new law, SB 227, which will basically replace NRS 597.970 in January 2010. In many ways the new law is an improvement over the much more vague, and brief, NRS 597.970. I want to focus here on an improvement, but something that still leaves much to interpretation; that is, what is meant by "encryption"?

Stolen Print Documents With PII Found On Crook; Otherwise UCM Would Not Have Known The Reports Were Stolen

Wed, 01 Jul 2009 21:31:08 -0500

Late last week one of my alma maters, the University of Central Missouri, reported that two printed computer reports containing 7000 students' names, social security numbers, phone numbers, addresses, and birthdates were stolen from somewhere on the campus.

Hear Common, Dumb and Dangerous Privacy Assumptions On The Radio!

Tue, 30 Jun 2009 07:48:24 -0500

Today I will be on MyTechnologyLawyer.com radio show to an hour program talking about the common privacy mistakes and assumptions made by businesses. This will be a more in-depth look at the issues from my post from a couple of weeks ago, "5 Common, Dumb and Dangerous Privacy Assumptions" Here are the details:

South Carolina & Alaska Privacy Breach Notice Laws Go Into Effect July 1

Mon, 29 Jun 2009 13:20:55 -0500

This week two more U.S. breach notice laws go into effect...

Voice Recognition Software Puts Top Cop In Hot Water

Thu, 25 Jun 2009 20:42:17 -0500

Yesterday I read a fascinating story from Australia...

Movies and TV Shows to Use for Infosec and Privacy Training and Awareness

Tue, 23 Jun 2009 09:03:18 -0500

After many long hours, I've finally submitted the draft manuscript for the 2nd edition of my "Managing an Information Security and Privacy Awareness and Training Program" book. However, I will still have one more chance to make changes. One of the 23 appendices within my book provides lists of resources; books, web sites, activities, games and so on. One of my lists is for movies and television shows that can be used in training or for awareness activities...

Don't Manage Employee Online Activities By Requiring Their IDs & Passwords!

Thu, 18 Jun 2009 21:24:49 -0500

I read a story about a city government agency actually asking job applicants to provide their IDs and passwords for any online social networking type of site they participate in...

5 Common, Dumb and Dangerous Privacy Assumptions

Wed, 17 Jun 2009 21:29:55 -0500

Today Kevin Beaver posted a nice article, "Dumb things IT consultants do" that included more than one warning about making assumptions. Kevin's nice post made me think about all the dangerous assumptions consulants and practitioners often make when it comes to evaluating privacy practices...

FTC Issued Consent Order for GLBA Privacy Rule and Safeguards Rule Violations

Tue, 16 Jun 2009 16:56:54 -0500

Today the FTC issued a consent order against mortgage lender James B. Nutter & Company for GLBA Privacy Rule and Safeguards Rule violations resulting from having an inadequte information security program and safeguards. The requirements will result in, among other actions, 20 years of ongoing activities by James B. Nutter & Company; much more costly than it would have been to have established appropriate information security safeguards to begin with...

Info Sec & Privacy Days/Weeks/Months

Mon, 15 Jun 2009 10:06:33 -0500

As I've mentioned a few times before, I'm in the final lap of finishing the 2nd edition of my book, "Managing an Information Security and Privacy Awareness and Training Program." Woo hoo! Over the weekend I updated "Appendix N - Designated Security and Privacy-Related Days." Here are the days, weeks and months I've found are devoted to raising awareness about various info sec and privacy issues (this is in a much nicer-looking table format in my book)...

FTC's New Red Flags Rules FAQ

Thu, 11 Jun 2009 21:12:46 -0500

Today the US FTC released "Frequently Asked Questions: Identity Theft Red Flags and Address Discrepancies." Here are a couple important things to take away from this FAQ...

Healthcare Worker Gets 1 Year In Prison For Posting HIV Victim's Medical Records On Internet

Wed, 10 Jun 2009 19:22:16 -0500

Today a report discussed how a healthcare worker obtained medical information about a patient with HIV that was then posted on the Internet...

Privacy Enhancing Technologies (PETs) & Privacy Threatening Technologies

Tue, 09 Jun 2009 16:23:48 -0500

I'm doing research while working on the 2nd edition of my book, "Managing an Information Security and Privacy Awareness and Training Program"...

Audits Show Things At a Moment in Time; Silly To Sue For Breaches That Happen 1 Year After Audit Conclusion?

Mon, 08 Jun 2009 10:10:25 -0500

There has been much written in the past week about Merrick Bank suing the audit firm, Savvis, because a breach occurred at CardSystems in 2005 even though Savvis had given passing marks for the CardSystems audit that Merrick Bank hired them to perform in 2004 to ensure they were following Visa's Cardholder Information Security Program (CISP); basically a forerunner of the current PCI DSS program. Savvis found that CardSystems was following the CISP requirements. Within a year after the audit, CardSystems experienced a major breach that basically put them out of business. I have had the great privilege to work as an IT auditor early in my career, for a while as an internal auditor at a large multi-national financial and insurance company, and then doing periodic audits since in various organizations in a wide range of industries since. All wonderful learning experiences! There are a couple of important points that the judge in this situation should consider, and the lawyers in this case should understand:

Great InfoSec and Privacy Info and Resources This Week On Twitter

Fri, 05 Jun 2009 20:24:39 -0500

I got my week's issue of Time magazine in the mail today, and lo-and-behold the cover and feature story was about Twitter!