privacy - sandy ingram on Diigo

22 Nov 09

Twitter security risks, popularity spark regulatory concerns

"Is using Twitter always right for the enterprise, or is it a risk to a business?"

searchcompliance.techtarget.com/...9142,sid195_gci1359732,00.html - Preview

twitter Privacy Security Risk Best Practice

"Is using Twitter always right for the enterprise, or is it a risk to a
business?"
"If a corporate employee puts out information in a tweet that's IP or private,
anyone in the world can see it.

FTC Announces Expanded Business Education Campaign on 'Red Flags' Rule

The three-month extension, coupled with this new guidance, should enable
businesses to gain a better understanding of the Rule and any obligations that
they may have under it. These steps are consistent with the House Appropriations
Committee’s recent request that the Commission defer enforcement in conjunction
with additional efforts to minimize the burdens of the Rule on health care
providers and small businesses with a low risk of identity theft problems.
Today’s announcement that the Commission will delay enforcement of the Rule
until November 1, 2009, does not affect other federal agencies’ enforcement of
the original November 1, 2008, compliance deadline for institutions subject to
their oversight.

www.ftc.gov/...redflag.shtm - Preview

Red Flags Rule FTC Privacy Security Enforcement Education

The Red Flags Rule is an anti-fraud regulation, requiring “creditors” and
“financial institutions” with covered accounts to implement programs to
identify, detect, and respond to the warning signs, or “red flags,” that could
indicate identity theft. The financial regulatory agencies, including the FTC,
developed the Rule, which was mandated by the Fair and Accurate Credit
Transactions Act of 2003 (FACTA).
The FTC’s Red Flags Web site, www.ftc.gov/redflagsrule, offers resources to help
entities determine if they are covered and, if they are, how to comply with the
Rule. It includes an online compliance template that enables companies to design
their own Identity Theft Prevention Program through an easy-to-do form, as well
as articles directed to specific businesses and industries, guidance manuals,
and Frequently Asked Questions to help companies navigate the Rule.

21 Nov 09

Consumer Form Letters and Opt Out Information | Privacy Rights Clearinghouse

Note: The information, advice, and suggestions contained in these letters should be used as an information source and not as legal advice. Send your letter by Certified Mail-Return Receipt Requested. If possible, fax the letter first. Make a copy of your letter for your records before sending.

www.privacyrights.org/...letters.htm - Preview

Privacy Security Forms Best Practice Opt-out

12 Nov 09

Cyber Security Audit Spanks Department of Interior | Government Tech | ITBusinessEdge.com

The report sharply criticizes the agency's cyber security performance, calling its personnel "substantially under-qualified." Interior required that staff only get self-certified training; only 13.5 percent of self certifications were relevant and complete.

www.itbusinessedge.com/...-spanks-department-of-interior - Preview

security privacy workplace training

The report sharply criticizes the agency's cyber security performance, calling
its personnel "substantially under-qualified." Interior required that staff only
get self-certified training; only 13.5 percent of self certifications were
relevant and complete.
The report goes on to say that IT and cyber security governance at the
department is inefficient, wasteful and lacks accountability

11 Nov 09

Building a Culture of Data Security and Related Privacy Interests in the Workplace

"While employees necessarily forfeit a good deal of privacy when
using company-owned equipment and facilities for their personal interests and
benefits, employers today must be concerned about maintaining privacy and
confidentiality for customers and employees alike with respect to those
individuals’ legally protected personal information such as social security and
driver’s license numbers."

www.hrtools.com/...nterests_in_the_workplace.aspx - Preview

security privacy culture data workplace

In preparing for this Insight, I read an enlightening article
published by the Society for Human Resource Management (SHRM) in its August 2008
issue of HR Magazine titled, "Out of the Breach: Reduce the Risk of Litigation
and Build Confidence in Data Handling by Becoming a Privacy Champion." In this
cover story, senior writer Rita Zeidner presents a case for building a "culture
of privacy" in the workplace. According to Zeidner, privacy experts recommend
training, along with taking other precautionary steps, as the best defense for
avoiding breaches of privacy.
it is the required thing to do in order to comply with the numerous federal and
state laws that may be applicable, which both define protected employee/customer
data and identify related restrictions with respect to the access, use, storage
and dissemination of the same. If you want to build a culture of privacy in your
workplace with respect to the protection of personal data, the following summary
of Zeidner’s steps might serve as a useful reference:
2 more annotations...
- Finally employers should train employees so they know how to
  recognize threats to the security of protected data and report suspicious
  activities. If employees cannot attend and participate in this training, their
  access to such information should be blocked until they attend the training.
  Once employees are trained, and as a way to encourage and reinforce these
  behaviors, employers should publicly acknowledge and reward employees who alert
  the company of potential problems.
- Since you want to make sure that rank-and-file employees are well
  trained, you will initially want to provide complementary, mandatory training
  and development opportunities for the managers to whom these employees report.
  In doing so, you can develop a benchmarking program, which can be used as a tool
  for checking on and evaluating managerial goals. For instance, managers can be
  held responsible for signing off on benchmarks such as follows:.
  
  Completing a privacy-data inventory that identifies where information is
  stored.
  Establishing and communicating a privacy policy statement program.
  Verifying policies and practices for security measures.
  Setting aside off-network computers that employees can use during break
  times or off-hours that will not compromise your network files; and
  Taking steps to ensure that contractor-software providers take regard for
  ensuring protection, the same as you do.

06 Nov 09

Google Dashboard Creates Security and Privacy Concerns

"The new Google Dashboard addresses concerns that users have regarding just how
much Google knows about them. Providing a resource like the Google Dashboard
that presents all associated information in one place may actually create more
privacy and security issues than it solves though."

news.idg.no/...art.cfm - Preview

identity theft privacy security Google dashboard

Providing a resource like the Google Dashboard that presents all associated
information in one place may actually create more privacy and security issues
than it solves though.
If you know the right queries to use you can find usernames and passwords,
financial spreadsheets, confidential documents, and more by leveraging the vast
database of indexed information stored at Google.
3 more annotations...
- Google delivers all of the juicy details it has about you in a one-stop-shopping
  resources like the Google Dashboard which also provides a juicy
  one-stop-shopping target for attackers
- "Google Dashboard is akin to putting all of one's eggs in a single basket. The
  problem is that the average end-user is clueless on how to guard that digital
  basket.
- So once that Google account is breached/hacked, the victim has their entire
  Google experience compromised."

05 Nov 09

Digital Data Make For A Really Permanent Record : NPR

www.npr.org/...story.php - Preview

privacy digital data secuity

29 Oct 09

Study Finds U.S. Small Businesses Lack Cybersecurity Awareness and Policies | Reuters

"Small business owners' cybersecurity policies and actions are not adequate enough to ensure the safety of their employees, intellectual property and customer data, according to the 2009 National Small Business Cybersecurity Study. The study, co-sponsored by the National Cyber Security Alliance (NCSA) and Symantec [Nasdaq: SYMC], as part of this year's National Cyber Security Awareness Month, surveyed nearly 1,500 small business owners across the United States
about their cybersecurity awareness policies and practices."

www.reuters.com/...144244+27-Oct-2009+PRN20091027 - Preview

privacy security Fraud employees Cybersecurity

The
study found that while more than 9 in 10 small businesses said they believe
they are safe from malware and viruses based on the security practices they
have in place, only 53 percent of firms check their computers on a weekly
basis to ensure that anti-virus, anti-spyware, firewalls and operating systems
are up-to-date and 11 percent never check them.
Small business owners'
cybersecurity policies and actions are not adequate enough to ensure the
safety of their employees, intellectual property and customer data, according
to the 2009 National Small Business Cybersecurity Study. The study,
co-sponsored by the National Cyber Security Alliance (NCSA) and Symantec
[Nasdaq: SYMC], as part of this year's National Cyber Security Awareness
Month, surveyed nearly 1,500 small business owners across the United States
about their cybersecurity awareness policies and practices.
8 more annotations...
- The survey shows discrepancies between needs and actions regarding security
  policies and employee education on security best practices.
- "The 20 million small businesses in the U.S. are a critical part of the
  nation's economy. While small business owners may understandably be focused
  on growing their business and the bottom line, it is imperative to understand
  that a cybersecurity incident can be disruptive and expensive,"
- small businesses seem out of sync with some Internet security
  risks. 75 percent of small businesses said that they use the Internet to
  communicate with customers yet only 6 percent fear the loss of customer data
  and only 42 percent believe that their customers are concerned about the IT
  security of their business.
- Laptops, PDAs and wireless networks are great conveniences to businesses, yet
  they carry with them an added responsibility to ensure the data is secure.
  Today, more than 66 percent of employees take computers or PDAs containing
  sensitive information off-site.
- Wireless networks are gateways for hackers
  and cyber criminals and must be secured by complex passwords
- "Security threats are becoming more complex and employees of small businesses
  are increasingly the target of attacks that expose their organizations to
  data loss,"
- "Security awareness and education, combined with a comprehensive
  security solution, can empower small businesses and their employees to protect
  themselves and their information."
- The demographic makeup of the small business polled

Sunbelt Blog: Facebook “change-your-password” spam scam[s] are circulating

"Facebook “change-your-password” spam scam[s] are
circulating

There are at least two Facebook "change-your-password" scams circulating in
spam. Here's the first one. It tries to lure you to a malicious site to steal
your Facebook login information."

sunbeltblog.blogspot.com/...change-your-password-spam.html - Preview

privacy security Fraud Cybersecurity sunbelt changeyourpassword

Facebook “change-your-password” spam scam[s] are
circulating

There are at least two Facebook "change-your-password" scams circulating in
spam. Here's the first one. It tries to lure you to a malicious site to steal
your Facebook login information.

No anti-virus software or procedures = compliance i$$ue

"Commonwealth Equity Services LLP of Waltham, Mass., agreed to pay the penalty
for failing to have anti-malware software on its reps computers or written
security policies to deal with security breaches. Securities brokers and
registered investment advisors are required by SEC regulations to have written
procedures to protect customer information."

sunbeltblog.blogspot.com/...us-software-or-procedures.html - Preview

privacy security Fraud Cybersecurity sunbelt compliance Anti-Virus penalty

18 Oct 09

Identity Theft: How to Respond to the New National Crisis

"Your identity - it's the gold standard of the Internet, and fraudsters are out to capture it. Smart card technology provides one potential solution to the identity theft crisis. Watch this video to hear Neville Pattinson, VP of Government Affairs at Gemalto, discuss: \n\nThe advantages of smart card technology; \n\nHow to apply these solutions specifically in e-government and healthcare \nreform; \n\nHow to take back control of your identity in the real and virtual worlds."

www.govinfosecurity.com/onDemand.php - Preview

Best Practice compliance IT regulatory Information security Privacy

13 Oct 09

AMA - Red Flags Rule - SAMPLE POLICY

"Red Flags Rule

Protect your Patients, Protect Your Practice: What You Need to Know
about the Red Flags Rule

Compliance Date: Nov. 1, 2009

Update: The Federal Trade Commission (FTC) has delayed the compliance
deadline of the Red Flags Rule until Nov. 1, 2009
(read the full press
release)
.
The AMA will utilize this time to convince the FTC and
Congress to republish the rule so that there is sufficient opportunity to
formally comment and state the AMA's objections to physician inclusion in the
program."

www.ama-assn.org/...red-flags-rule.shtml - Preview

Identity Theft Security Privacy Awareness cybersecurity fraud ama

08 Oct 09

electronic verification systems.com

"Welcome to the EVS Blog, our blog dedicated to discussing the latest industry trends, current events, and EVS solution and product information. The EVS Blog is updated each week, so be sure to visit frequently to stay up to date on all
the latest news."

www.electronicverificationsystems.com/...blog - Preview

Identity Theft Security Privacy Awareness Information cybersecurity fraud

Fighting Fraud with the Red Flags Rule

"The Red Flags Rule requires many businesses and organizations to implement a written Identity Theft Prevention Program designed to detect the warning signs –
or "red flags" – of identity theft in their day-to-day operations. Are you covered by the Red Flags Rule? Read Fighting Fraud
with the Red Flags Rule: A How-To Guide for Business
to:

Find out if the rule applies to your business or organization;

Get practical tips on spotting the red flags of identity theft, taking steps to prevent the crime, and mitigating the damage it inflicts; and

Learn how to put in place your written Identity Theft Prevention Program.

By identifying red flags in advance, you'll be better equipped to spot suspicious patterns when they arise and take steps to prevent a red flag from escalating into a costly episode of identity theft.

Take advantage of other resources on this site to educate your employees and colleagues about complying with the Red Flags Rule."

www.ftc.gov/...index.shtml - Preview

Identity Theft Security Privacy Awareness Information fraud cybersecurity

25 Aug 09

External attacks start with unintentional mistakes, survey finds

The four walls around a company's data servers are continuing to erode as end users are finding it increasingly easier to use Web-based tools and bring their work home and on the road. The latest survey finds that companies are more concerned than ever about unintentional employee errors that can lead to data leakage.

searchsecurity.techtarget.com/...89142,sid14_gci1365927,00.html - Preview

unintentional data breach employee Privacy Security

"Companies are finding more than ever before that they really need to have good access policies and the right level of controls associated with those policies," said Chris Young, senior vice president of products at RSA. "Organizations often try to start out with a model of trust between permanent and temporary employees, but they also have to balance that trust with controls."

Security & Privacy Lawyer & Attorney : Foley Hoag Law Firm : About : Security, Privacy and The Law

About

The Foley Hoag Security, Privacy and the Law Blog focuses on the security and privacy issues encountered by businesses that often require immediate and discreet solutions. Here we cover topics that arise from guiding our clients through the process of complying with the ever-growing number of state, federal and international laws governing information security, identity theft, surveillance and other privacy issues.

www.securityprivacyandthelaw.com/...about - Preview

Privacy Security Partner LLP e-discovery

18 Aug 09

SANS Institute - 20 Critical Security Controls - Version 2.1

Version 2.1: August 10, 2009

Update: Added NIST SP 800-53 Revision 3 mapping to each control, and updated appendix to include each area of direct mapping between 20 Critical Controls and 800-53 Rev 3 Priority 1 controls.

www.sans.org/guidelines.php - Preview

sans NIST sp800-53 Privacy Security Best Practice

Version 2.1: August 10, 2009

Update: Added NIST SP 800-53 Revision 3 mapping to each control, and updated appendix to include each area of direct mapping between 20 Critical Controls and 800-53 Rev 3 Priority 1 controls.
knowledge of actual attacks that have compromised systems provides the essential foundation on which to construct effective defenses.
9 more annotations...
- This consensus document of 20 crucial controls is designed to begin the process of establishing that prioritized baseline of information security measures and controls
- The consensus effort that has produced this document has identified 20 specific technical security controls that are viewed as effective in blocking currently known high-priority attacks, as well as those attack types expected in the near future.
- Fifteen of these controls can be monitored, at least in part, automatically and continuously. The consensus effort has also identified a second set of five controls that are essential but that do not appear to be able to be monitored continuously or automatically with current technology and practices.
- The Twenty Critical Controls
- The list includes 15 controls that can be validated at least in part in an automated manner and five that must be validated manually. It is important to note that the 20 control categories are not presented in order of priority. The process of gathering these specific controls and subcontrols focused on identifying the highest priority defenses and represent a subset of controls found in other audit guidelines and documents. Each of the 20 categories is important and offers high-priority techniques for thwarting real-world attacks.
- Critical Controls Subject to Automated Collection, Measurement, and Validation:
  
  Inventory of Authorized and Unauthorized Devices
  Inventory of Authorized and Unauthorized Software
  Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers
  Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
  Boundary Defense
  Maintenance, Monitoring, and Analysis of Security Audit Logs
  Application Software Security
  Controlled Use of Administrative Privileges
  Controlled Access Based on Need to Know
  Continuous Vulnerability Assessment and Remediation
  Account Monitoring and Control
  Malware Defenses
  Limitation and Control of Network Ports, Protocols, and Services
  Wireless Device Control
  Data Loss Prevention
  Secure Network Engineering
  Penetration Tests and Red Team Exercises
  Incident Response Capability
  Data Recovery Capability
  Security Skills Assessment and Appropriate Training to Fill Gaps
- Insider Threats vs. Outsider Threats
  
  A quick review of the critical controls may lead some readers to think that they are heavily focused on outsider threats and may, therefore, not fully deal with insider attacks. In reality, the insider threat is well covered in these controls in two ways. First, specific controls such as maintenance of security audit logs, control of administrative privileges, controlled access based on need to know, data loss prevention, and effective incident response all directly address the key ways that insider threats can be mitigated
- Second, the insider and outsider threats sometimes merge as outsiders penetrate security perimeters and effectively become "insiders." All of the controls that limit unauthorized access within the organization work to mitigate both insider and outsider threats. It is important to note that these controls are meant to deal with multiple kinds of computer attackers, including but not limited to
- Periodic and Continual Testing of Controls
  
  Each control included in this document describes a series of tests that organizations can conduct on a periodic or, in some cases, continual basis to ensure that appropriate defenses are in place. One of the goals of the tests described is to provide as much automation of testing as possible.

17 Aug 09

Bill Gives DHS Lead on Fed IT Security Policy

The responsibility to oversee information security among federal agencies would shift to DHS from the White House Office of Management and Budget under revisions of the measure, nicknamed U.S. ICE, that updates IT security guidance detailed in the seven-year-old Federal Information Security Management Act (FISMA), according to a senior cybersecurity staff member on the Senate Committee of Homeland Security and Government Affairs.

www.govinfosecurity.com/articles.php - Preview

dhs privacy security FISMA IT

The thinking behind shifting responsibility to DHS from OMB is that Homeland Security has the cybersecurity expertise whereas OMB's proficiency is budgeting. "Already, the Department of Homeland Security is the coordinating agency on cybersecurity," the staffer said. "Now, what you're doing is drastically strengthening the role of DHS by putting into law and then also, giving them the ability to say, with FISMA, approve or not to approve agencies plans, controls, frameworks, the way they secure their systems."
The bill also continues the role of the National Institute of Standards and Technology as the key government agency to develop IT security guidance, but leaves it to DHS the decision which guidance has priority.

15 Aug 09

Cloud Computing Poses E-Discovery, Legal Risks - www.enterprisestorageforum.com

In a presentation titled "Computing (strike that — Litigation) in the Cloud," Steven Teppler, senior counsel at KamberEdelson in New York, said cloud computing and services are a corporate counsel's nightmare.

www.enterprisestorageforum.com/...3814821 - Preview

cloud e-discovery Privacy Security

13 Aug 09

Information Assurance Client and Partner Support - NSA/CSS

The IA Mission at NSA supports clients and works with partners across government and industry to provide guidance, to ensure the availability of information assurance solutions, and to broaden IA knowledge and skills.

The web sites linked below are provided for the purpose of client and partner collaboration with the IA Mission.

www.nsa.gov/...index.shtml - Preview

IA NSA Privacy Security

sandy ingram's Library tagged privacy → View Popular

Twitter security risks, popularity spark regulatory concerns

FTC Announces Expanded Business Education Campaign on 'Red Flags' Rule

Consumer Form Letters and Opt Out Information | Privacy Rights Clearinghouse

Cyber Security Audit Spanks Department of Interior | Government Tech | ITBusinessEdge.com

Building a Culture of Data Security and Related Privacy Interests in the Workplace

Google Dashboard Creates Security and Privacy Concerns

Digital Data Make For A Really Permanent Record : NPR

Study Finds U.S. Small Businesses Lack Cybersecurity Awareness and Policies | Reuters

Sunbelt Blog: Facebook “change-your-password” spam scam[s] are circulating

Facebook “change-your-password” spam scam[s] are
circulating

No anti-virus software or procedures = compliance i$$ue

Identity Theft: How to Respond to the New National Crisis

AMA - Red Flags Rule - SAMPLE POLICY

electronic verification systems.com

Fighting Fraud with the Red Flags Rule

External attacks start with unintentional mistakes, survey finds

Security & Privacy Lawyer & Attorney : Foley Hoag Law Firm : About : Security, Privacy and The Law

SANS Institute - 20 Critical Security Controls - Version 2.1

Version 2.1: August 10, 2009

Insider Threats vs. Outsider Threats

Periodic and Continual Testing of Controls

Bill Gives DHS Lead on Fed IT Security Policy

Cloud Computing Poses E-Discovery, Legal Risks - www.enterprisestorageforum.com

Information Assurance Client and Partner Support - NSA/CSS

Selected Tags

Related Tags

Top Contributors

Groups interested in privacy

Ad4dcss/Digital Citizenship

IB ITGS

WPPS NEWS

Internet Privacy Guide

Information Literacy