Skip to content
How Easily Could the Sony Breach Have Been Prevented?
Check out this short video of Jonathan Sandler of STEALTHbits talking about how their technology would very likely have kept Sony out of the headlines.
How Can An IT Security Breach Cost Me My Job? The Sony Pictures Case
I don’t normally give a moments notice to stuff that goes on in Hollywood, but the story “Future of Sony's Amy Pascal questioned after hacked email revelations” caught my attention because of the cyber security aspect involved. So often I hear executives say something similar to “I don’t worry about our security because we don’t have anything anyone would want to hack into.”
That complacent assessment is wrong as most everyone knows since today nearly all hacking/security breach incidents are the result of indiscriminate malware that scans the Internet searching for vulnerable systems. When that malware finds a vulnerable system most of them run automated code that looks for passwords, bank account information, encrypts data for ransom, etc.
In this particular case a ton of data was stolen and released. The implication for Sony Pictures Co-Chairman is that her personal e-mails were....
Unclear HIPAA rules permit healthcare data offshoring … for now
...Under the Final Rule, the OCR has the power to domestically deal out civil penalties, corrective actions and long-term monitoring, while the DOJ has the power to domestically deliver a criminal prosecution. Through enforcement under HITECH, the State attorneys general [...]
HIPAA consulting and the channel’s ethical responsibility
Kevin is a featured writer for TechTarget. Here is is latest column: _________________________________________________________ A few months ago, I wrote an article about the practice of non-attorneys consulting on HIPAA business associate agreements. After talking with scores of people about the [...]
Beware of New Android Malware that Steals Phone, SMS and Audio
The new malware uses SMTP to send the data it steals to the perpetrators. It appears the origin of this malware has its roots in China. It first appeared in August.It collects phone numbers, sent and received SMS messages and [...]
Internet Security Threat Report 2013
Creating successful targeted attacks requires attackers to learn about us. They will research our email addresses, our job, our professional interests, and even the conferences we attend and the websites we frequent. All of this information is compiled to launch a successful targeted attack. Once on our devices, the attacker’s tools are designed to pull as much data as possible. Undiscovered targeted attacks can collect years of our email, files, and contact information.
Obama Admin Releases Massive New HIPAA Rules
So, as if healthcare practitioners didn’t already have enough to focus on with Obamacare, HITECH and the Flu epidemic, the Obama administration through the Department of Health and Human Services, has released a massive pile of new regulations in a [...]
Who Is Guilty In A Hack? The Perpetrator Or The Victim?
This article is interesting not because the hacker is convicted, but because of the reader comments at the end. The first post defends the hacker and blames AT&T for their system not being secure enough and allowing a breach. The next poster says that is akin to blaming a bank if they are robbed because their doors are not secure enough. Another poster points out that both are to blame.
HIPAA IS Leading Concern FOR CIOs
IPswitch conducted a recent survey of 100,000 end users who were asked about their most challenging compliance issues. According to the survey, compliance with the Health Information Portability and Accountability Act (HIPAA) was the clear winner for the top spot. Of the 100,000, 38.2% chose HIPAA and second place came in at 29.3% held by Sarbanes Oxley Act (SOX). The next closest competitor for IT concern was compliance with the Federal Information Security Management Act (FISMA) at a mere 9.2.
Beware Of How You Answer Audit Or Assessment Questions
If you are regulated under any of the myriad government and industry regulations from ITAR, FIPS, CLETS and PCI, to HIPAA and Red flags, the process of responding to security, integrity, and availability verification is not a simple exercise. It is more than answering questions in the positive. Polices, procedures and declarations of compliance are contracts with your company, partners, clients and government regulatory bodies. What do I mean?