Info Risk Today Podcast

Kirk Herath, Chief Privacy Officer at Nationwide Insurance Companies, has been in privacy management for more than a decade, and he has two main concerns about today's enterprise: Mobile technology and cloud computing.

The recent data breaches at Epsilon and Sony should send a chilling message to privacy officers everywhere. "You can't prepare enough," says Kirk Herath, chief privacy officer of Nationwide Insurance Companies.

A new Chicago health information exchange will use a cloud computing architecture with security provisions, says Terri Jacobsen, who's directing the project.

One of the unexpected impacts of the global economic crisis is that many organizations have lost their business resiliency, says Lyndon Bird, director of The Business Continuity Institute, headquartered in the U.K.

Chris Painter knows that the United States must determine what are the standard behavioral practices on the Internet before achieving substantial international agreements on cybersecurity.

Alexander Eremia, chief privacy officer at MedStar Health, says role-based staff training on privacy and security issues is essential.

The threat landscape has evolved dramatically over the past several years, and now it's time for healthcare security leaders to step up and meet the new challenges involved with securing critical data.

Regulatory compliance expert Harry Rhodes says it's essential to have a formal process in place for objectively assessing whether a security incident needs to be reported as a breach.

Timathie Leslie and Kristine Martin Anderson of Booz Allen Hamilton share insights on how to ensure the success of health information exchanges.

Rep. James Langevin sees some shortcomings in the president's cybersecurity initiatives unveiled Thursday.

ThreatMetrix's Taussig says strong authentication should be part of every financial institution's layered security approach. And according to expected changes to the Federal Financial Institutions Examination Council's 2005 online authentication guidance, that means proven measures to enhance device identification.

UAB's Terrell Herzig emphasizes training to handle multiple roles.

U.S. government agencies are eager to gain the service and cost efficiencies of cloud computing, but the Government Information Security Today survey finds they have serious reservations about information security in the cloud.

A key factor in ensuring that information technology is available in the wake of a disaster is cross-training IT staff to handle multiple roles, says Terrell Herzig, information security officer at UAB Medicine.

ThreatMetrix's Taussig says device identification must be part of layered security measures. Banking regulators want financial institutions to deploy multiple layers of online security. But what does that expectation mean when it comes to investments in fraud detection?

Cloud computing helps ease the exchange of diagnostic images while maintaining adequate security, says Amy Radonich of University of California San Diego Health System.

Ethicist Roy Snell warns of a common misperception about social media.

All employers need to overcome the common misperception that "you can say anything you want on social media and not have any consequences," says compliance specialist Roy Snell.

Domain name systems are among the least known - but most important - security vulnerabilities for organizations in all sectors. But government agencies in particular need to be concerned about DNS security to protect their e-government initiatives.

The <b><a href='http://www.unisyssecurityindex.com' target='_blank'>Unisys Security Index</a></b> shows growing public anxiety about Internet security. Unisys CISO Patricia Titus wonders how restless the public would be if the poll was conducted after revelations of breaches at <b><a href='/articles.php?art_id=3512'>RSA</a></b>, <b><a href='/epsilon-breach-growing-impact-a-3564'>Epsilon</a></b> and <b><a href='/sony-ddos-masked-data-exfiltration-a-3606'>Sony</a></b>.

Big brother isn't the relation the government sees itself portraying in developing the National Strategy for Trusted Identities in Cyberspace. Uncle Sam has a more avuncular role in mind, giving advice and serving as a role model.

Kevin Sullivan spent months at Ground Zero after the 9/11 attacks on the World Trade Center. Now, post-Bin Laden, Sullivan says the 9/11 experience changed him both personally and professionally, and impacted how banking institutions view money laundering and BSA violations.

"On a global basis, countries are recognizing that they need a uniform commercial code, if you will, for data - a unified approach for managing IT infrastructure services," says Marlin Pohlman of the Cloud Security Alliance.

Intel CISO Malcolm Harkins says the Sony PlayStation breach reminds CISOs in all sectors that such incidents can't be avoided, but their risks can be managed.

A CIO involved in an ambitious personalized medicine project that uses genetic information describes how privacy issues are addressed.

A review of the month's top stories by Managing Editor Tracy Kitten: A well-crafted e-mail tricked an RSA employee into opening a phishy e-mail that launched a sophisticated attack on the company's information systems, and the list of big-name corporations and brands affected by the Epsilon e-mail breach tops 100.

A review of the month's top stories by Managing Editor Tracy Kitten: A well-crafted e-mail tricked an RSA employee into opening a phishy e-mail that launched a sophisticated attack on the company's information systems, and the list of big-name corporations and brands affected by the Epsilon e-mail breach tops 100.

Here are some of the top news and views from GovInfoSecurity.com in April 2011.

"Breach notification planning is just a fundamental, basic part of risk management in the new millennium," says security expert Bob Chaput.

Editor's Choice: Mostashari Addresses Privacy, Security; 10.8 Million Affected by Major Breaches; Time for a Social Media Policy is Now

Farzad Mostashari says the government needs to ensure and maintain the public's trust in health information systems and the exchange of their health information.

"We need to ensure and maintain the public's trust in health information systems and the exchange of their health information," says Farzad Mostashari, the new national coordinator for health information technology.

Interview with Council of Registered Ethical Security Testers head Ian Glover.

Four years ago, the Council of Registered Ethical Security Testers began as an organization to bring standardization to the penetration testing industry. Today, CREST's scope is expanding across industries and global regions, says president Ian Glover.

Security expert Andrew Weidenhamer offers insights on physical security measures that can help prevent breaches.

IT security and privacy lawyer David Navetta says revelations that mobile devices such as the iPhone, iPad and Android maintain hidden files tracking users locations could pose a threat to organizations, regardless of whether the devices are owned by individual employees, the company or government agency for which they work.

This week's top news and views: New legislation aims to get more support for cybersecurity initiatives, flaws found in air traffic control system and Verizon's 2011 data breach report. Don't miss our audio week-in-review podcast by Executive Editor Eric Chabrow

This week's top news and views: Maine Bill Would Require HIE Opt-in; What's Next for the Tiger Team?; Digital IDs Ease Clinical Trial.

FICO's Mike Urban says more questions than answers surround the Durbin amendment's future impact on fraud prevention. But bankers and the Fed may get a two-year reprieve to evaluate the legislation, if a new bill now before the Senate passes.

Gigi Hyland of the NCUA says the latest draft of online authentication guidance is awaiting final signoff from just one FFIEC member agency. And Verizon's new data breach report finds that compromised records resulting from data breaches dropped dramatically in 2010, but the number of breaches continues to grow.

Gigi Hyland of the NCUA says the latest draft of online authentication guidance is awaiting final signoff from just one FFIEC member agency. And Verizon's new data breach report finds that compromised records resulting from data breaches dropped dramatically in 2010, but the number of breaches continues to grow.

From mobile devices to social media and cloud computing, IT governance is all about risk management. "You can't de-risk everything, but you can de-risk the majority of circumstances you will see in normal operations," says governance expert Robert Stroud.

Deven McGraw, co-chair of the Privacy and Security Tiger Team, discusses its most recent recommendations and her views on encryption and asks for suggestions on additional topics to address.

The latest Verizon Data Breach Investigations Report is out, and the good news is: The number of compromised records is down. The troubling news is: The number of breaches is up. Bryan Sartin, one of the report authors, explains why.

This week's top news and views: Cutting funding for IT security could prove dicey, comments from DHS Undersecretary Philip Reitinger and Sen. Thomas Carper; year-long Texas breach exposed personal information of 3.5 million; bill unveiled to safeguard personal data online; and Google and Microsoft battle over cloud certification. And don't miss our audio week-in-review podcast by Executive Editor Eric Chabrow

Payment card fraud. ACH and wire transfers. ATM skimming. And especially insider crimes. These are among today's top information security threats to institutions, says banking regulator Gigi Hyland in an exclusive interview.

The Heartland hacker says the U.S. government was aware of his illegal activities, and an ID security expert talks about phishing threats in the wake of the Epsilon breach.

The Heartland hacker says the U.S. government was aware of his illegal activities, and an ID security expert talks about phishing threats in the wake of the Epsilon breach.

Altra Federal Credit Union developed a calculated strategy before moving to the cloud -- advice all financial institutions should follow, says Brian Boettcher, VP of IT, who shares his lessons learned.

The bad news is that banks and businesses have not made great progress in the fight against account takeover fraud. The good news is: They have the strategies and tools to win this fight in 2011.