Malicious social-engineering attacks are on the rise and branching out far beyond simply targeting the financial sector. While some organizations develop employee-awareness training or solicit pen testing, or use some combination of the two, these preventive tactics can only go so far.
Adopting a “know thy data” approach — in terms of what it is, how valuable it is and where it is — and then ...
Read More →
Are you ready for the changes to PCI from version 2 to version 3. The PCI Security Standards Council has just released the final version of the standard and there are quite a few changes you should be aware of so we’ve taken the liberty of posting the changes here. A complete summary of PCI DSS Changes From 2.0 to 3.0 can be found here in PDF format.
The overall updates include specific recommendations for making PCI DSS ...
Read More →
If you thought that hackers were taking a break over the last year or so, this interactive graphic will have you rethinking that opinion.
David McCandless of Information is Beautiful created the graphic with coder Tom Evans. It shows All the data breaches over the last 9 years and the number of records hacked. Each attack is displayed as a bubble, based on that victim-count. They’ve included a slick filtering tool as well which allows you to filter by organization type and ...
Read More →Cyber criminals remain indifferent and insensitive to events showcased on the national stage, such as the bombings at the Boston marathon on April 15, 2013. Since the event, the Dell SecureWorks CTU(TM) research team has been monitoring the Waledac/Kelihos botnet, which has begun distributing spam claiming to provide information about the bombing (see Figure 1). The email messages contain a single malicious link and entice victims to click the link for more information.
Posted by:
“BYOD” Bring Your own Device. A great idea that can easily turn messy. Biztech has introduced the BYOD: The Good, the Bad and the Ugly infographic asking you to answer 6 easy but important questions before you launch into a BYOD situation.
Yesterday the Governor announced that the South Carolina Department of Revenue suffered a data breach affecting millions of South Carolina residents. “This is not a good day for South Carolina,” is how Gov. Nikki Haley began a Friday afternoon press conference with other state officials at SLED offices in Columbia.
“The state of South Carolina has come under attack by an international hacker,” Haley said before explaining that 3.6 million Social Security numbers ...
Read More →
WASHINGTON – Another HIPAA data breach settlement has been reached, this time with the Massachusetts Eye and Ear Infirmary and Massachusetts Eye and Ear Associates Inc. (MEEI), which will pay $1.5 million to the Department of Health and Human Services (HHS) for potential violations of the HIPAA Security Rule.
For more details check out the article in Healthcare IT News
Massachusetts Privacy Protection Law 201 CMR 17.00, which goes into effect March 1, 2010, does not specifically call for the encryption of fax transmissions, nor does it specifically mention how fax transmissions should be handled. With that said, the intention of the law was NOT to exempt fax transmissions of personal information (PI) from consideration when creating a Comprehensive Information Security Program (CISP). There are a couple of sections in the regulations that do refer to the transmission of PI ...
Read More →
Sounds a little like Chicken Little running around saying “the sky is falling, the sky is falling”. However, the clock is ticking off precious minutes as your organization races to meet the compliance deadline for 201 CMR 17.00. If your organization has been holding out for another extension from OCABR, then I’m afraid you’re out of luck. March 1, 2010 is the drop dead date for compliance.
The final version of the regulation was released in late October and nobody has ...
Posted by:
There’s been a tremendous amount written lately about how to prepare for the upcoming March 1 deadline for compliance with Massachusetts 201 CMR 17.00.
Almost everything I’ve read has focused on the electronic aspect of the regulation with little or no attention paid to how an organization will change the way they handle paper containing personal information. Just as a reminder, the intent of 201 CMR 17.00 is to establish minimum standards to be met in ...
