Info Risk Today Podcast

Banks need to prepare for many more massive cyberattacks along the lines of the sophisticated campaign that hit JPMorgan Chase and other financial services organizations, says Javelin Strategy & Research's Al Pascual, who offers risk management insights.

An upcoming Verizon report on health data breaches illustrates that the data is at risk at organizations outside of the healthcare sector, and not just at hospitals, clinics, insurers and their business associates, says security expert Suzanne Widup of Verizon Enterprise Solutions.

The Cybersecurity Information Sharing Act of 2015, which the Senate recently passed, contains detailed provisions designed to help the healthcare sector fight cyberattacks, explains Samantha Burch of HIMSS, who offers an analysis.

Developing a successful information security career requires excellent technical acumen as well as the ability to understand the impact that security policies have on people, says Gurdeep Kaur, a chief security architect at AIG.

Tinba, which has been linked to attacks in the U.S., Canada and Europe, is now targeting bank accounts in Russia, according to a new report from Dell SecureWorks. Researcher Brett Stone-Gross tells why Tinba is unusual and can be tough to detect.

Now that it has issued a 10-year roadmap for secure, interoperable health information exchange, the Office of the National Coordinator for Health IT has a number of privacy-related projects planned for 2016, says Lucia Savage, ONC's chief privacy officer. She spells those out in this in-depth interview.

A quiet life in retirement? Not for Art Coviello, former executive chairman of RSA. He's just joined the boards of two new security ventures, Bugcrowd and Cylance, and he's got big ideas for how to influence the 2016 cybersecurity agenda.

Many CEOs and boards of directors are failing their companies by not truly understanding their cybersecurity risks, says Steve Durbin of the Information Security Forum. He stresses that senior leaders must ensure their organizations provide adequate funding to manage risks.

Overcoming misperceptions about the HIPAA Privacy Rule will prove vital to achieving nationwide, secure health data exchange, says attorney Jodi Daniel, who until recently helped develop federal policy.

Mergers and acquisitions create challenges for CISOs, including allocating resources to meet the information security needs of newly united companies, says Joey Johnson, CISO of Premise Health.

Everyone's talking about business email compromise, but what they aren't talking enough about is what's at the root of these attacks - spear phishing. Joseph Opacki of PhishLabs discusses how security leaders must respond to the threat.

The recent data breach at U.K.-based telecom company TalkTalk illustrates that breach risk mitigation is a critical issue worldwide. PCI's Jeremy King, who will be a featured speaker at ISMG's Fraud Summit London on Oct. 27, explains why European data security is getting more scrutiny.

Devin Jopp, CEO of the Workgroup for Electronic Data Interchange, describes a new effort to develop recommendations for how to protect genomic data as it's exchanged, as is called for under President Obama's Precision Medicine Initiative.

A recent agreement among 12 electronic health record vendors to support an effort to create a voluntary set of metrics assessing the interoperability of their products could potentially be a step toward easing secure health information exchange, says Kent Gale of the research firm KLAS.

A number of short-term and long-term hurdles, including technology and policy issues, stand in the way of achieving secure, interoperable, nationwide health information exchange, says David Kibbe, M.D., of DirectTrust, which maintains a secure email framework.

Building a strong platform to secure enterprise email systems is like piecing together a puzzle by joining existing technologies from various sources. NIST is readying a guide to do just that.

By identifying abnormal data access behavior, machine learning systems could improve breach prevention and fraud detection in the healthcare arena and other sectors, contends artificial intelligence expert Robert Leithiser.

The future of payments security hinges on a combination of factors, including widespread use of the EMV chip, tokenization and encryption, as well as near real-time payments, says Liz Garner, vice president of the Merchant Advisory Group, a featured speaker at ISMG's Fraud Summit New York on Oct. 20.

Healthcare organizations should take three important steps to help improve the cybersecurity of medical devices used in their environments, says security expert Kevin Fu. Hear his advice in this interview.

Has authentication become too complex for banking institutions? That's a legitimate concern, says Peter Tapling of Early Warning. He offers strategies to simplify and unify authentication strategies.

NACS attorney Doug Kantor says small businesses are getting a raw deal from the card brands when it comes to expectations for EMV migration. The expense is too high, and the fraud-reduction benefits too low to make EMV worthwhile, he argues.

Security leaders do well securing stored data and data in transit. But what about the integrity of data after it reaches the intended recipient? This is a huge gap to be bridged, says Chris Kniffin of Seclore.

With organizations increasingly moving to the cloud, more security professionals are needed to help secure those environments as well as manage incident response. Cloud forensics expert Neha Thethi outlines must-have skills, qualifications and certifications.

In this audio blog report, hear why former NSA Director Mike McConnell changed his view on the value of the government getting device manufacturers to create a backdoor to allow law enforcement to bypass encryption.

Proposed federal legislation calls for testing the use of smart cards, similar to the chip cards being rolled out by the U.S. credit card brands, for Medicare patient identification to help reduce fraud. Kelli Emerick, leader of the Secure ID Coalition, explains the proposal.

BitSight Technologies is out with its annual Industry Benchmark Report, and cybersecurity ratings are low for the energy and utilities industry. BitSight's Mike Woodward shares insights for all sectors.

Recent breaches indicate that stronger controls are needed to protect key corporate assets - especially identities. CA's Steve Firestone discusses how to protect identities, while at the same time improving the user experience.

In the wake of the Oct. 1 EMV fraud liability shift date, U.S. merchants can expect to pay for counterfeit fraud losses previously absorbed by European issuers, says Jeremy King of the PCI Council. Longer-term, he expects European banks will experience more fraud as U.S. POS and card security leapfrogs other markets.

As a result of Experian's data breach, 15 million T-Mobile subscribers are at risk from phishing attacks and fraud. But it's not clear what more T-Mobile can do to protect breach victims, says security specialist Mark James.

The Precision Medicine Initiative announced earlier this year by the Obama administration is the ultimate healthcare "big data" project and faces many security and privacy challenges, says attorney Kirk Nahra.

Cybercrimnals are now using the Dyre and Dridex banking Trojans to gather massive amounts of data about individuals and companies that could enable them to track patterns of behavior, which might later help them evade intrusion detection, says Fox-IT's Eward Driehuis.

The commoditization of attack infrastructure and services in the cyber-criminal underground, and the low cost and ease of launching targeted attacks, are growing concerns that require new defense strategies, says Trend Micro's Raimund Genes.

In addition to having a dedicated individual or team responsible for privacy matters, organizations must ensure their information security and IT staffs are knowledgeable about data privacy issues, says Trevor Hughes, CEO of the International Association of Privacy Professionals.

PCI Council General Manager Stephen Orfei says the migration to EMV in the United States will facilitate faster adoption of contactless mobile payments. That's why mobile will be a hot topic at the PCI Council's annual North America Community Meeting this week.

The traditional Security Operations Center is out, and the new Security Intelligence Center is in. Greg Boison of Lockheed Martin tells how security leaders are winning business support for this evolution.

To improve patient safety, healthcare organizations should more closely scrutinize the cybersecurity of medical devices during the procurement process, says security expert Beau Woods.

Gregory Wilshusen discusses the path he followed to his job as the government's lead information security auditor and the skills needed to be an InfoSec auditor.

The attacks have evolved, breaches have multiplied, and serious security gaps have been exposed. But what most concerns FireEye President Kevin Mandia? The rise of nation-states as leading threat actors.

Many organizations spin their wheels when it comes to cybersecurity, says IBM's Andy Land. They invest in tools that do everything except what security leaders are fundamentally tasked with doing: Protect the data.

Organizations create more data than ever, and they face more requirements to collect and present it for investigations and legal cases. How do they avoid spoiling this data? Zapproved's Sarah Thompson offers tips.

The use of Bitcoin poses big cybersecurity and money-laundering concerns for banks. But the transaction infrastructure used by cryptocurrencies offers many features that banks should put to use, says former FBI Special Agent Vince D'Agostino.

In light of the uptick in hacker attacks on the healthcare sector, Everett Clinic in Washington is making a number of additional moves to bolster its cybersecurity, says CIO Becky Hood. Find out about the top priorities.

The creation of the California Cybersecurity Integration Center demonstrates that the state is taking a proactive approach to securing its digital assets, says Mark Weatherford, a former California state CISO and onetime DHS deputy undersecretary for cybersecurity.

The insider threat is one that organizations often want to overlook. But it's hard to ignore when they are losing critical assets. Lockheed Martin's Douglas Thomas tells how to sell an insider threat program.

The U.S. migration to EMV chip payment cards, which is progressing slowly, will be overshadowed by EMV-compliant mobile payments, says Gray Taylor of Conexxus, a convenience store and petroleum industry technology association.

While covered entities and business associates are becoming more aware of the need to encrypt patient data at rest, they often overlook securing data as it's shared and received, says security expert Joe Meyer of Coalfire.

The 6-year-old U.S. Cyber Challenge, designed to build interest in cybersecurity careers, is going strong, as participation in its online competition and cyber boot camps continues to grow, says Karen Evans, the organization's national director.

President Obama characterizes hacks of American businesses by Chinese hackers as an "act of aggression" against the United States and promises his administration will take action against the Chinese if they don't stop.

As federal HIPAA enforcers increasingly scrutinize business associate compliance, BAs need to be paying close attention to the details of settlements that federal regulators are signing with covered entities for HIPAA non-compliance cases and data breaches, says privacy attorney Adam Greene.

Increasingly, as enterprise leaders plan security investments, they think not just about threats and technology, but also how to tie their decisions to business performance. Gartner's Sid Deshpande explains the shift.