Info Risk Today Podcast

This week's top news and views: Privacy, Security Proposals Advance; Mostashari: Leading the Way at ONC; HIE Pioneers to Securely Share Data.

As <b><a href='https://www.govinfosecurity.com/congress-c-175'>Congress</a></b> and the <b><a href='https://www.govinfosecurity.com/white-house-c-222'>White House</a></b> look for ways to cut the federal <b><a href='https://www.govinfosecurity.com/budgeting-funding-c-202'>budget</a></b>, one area that could prove dicey is IT security, contends <b><a><a href='https://www.govinfosecurity.com/homeland-security-department-c-226'>Department of Homeland Security</a></b>'s Philip Reitinger.

A consortium of five leading healthcare organizations hopes to demonstrate the secure national exchange of health information, says James Walker, M.D. of Geisinger Health System.

ID security expert Tim Rohrbaugh on phishing trends in light of Epsilon breach.

This week's top news and views: Federal shutdown's impact on IT security, zero percent unemployment for IT security analysts, 'tricked' RSA worker opened backdoor to advanced persistent threat attack and DHS's top infosec executive's quest for a safer Internet. And don't miss our week-in-review podcast by Executive Editor Eric Chabrow.

Experts say banks and retailers are doing all they can to control concerns in the aftermath of the Epsilon e-mail breach, and a well-crafted e-mail fooled an RSA employee into opening a phish that led to a sophisticated attack on the company's information systems.

Experts say banks and retailers are doing all they can to control concerns in the aftermath of the Epsilon e-mail breach, and a well-crafted e-mail fooled an RSA employee into opening a phish that led to a sophisticated attack on the company's information systems.

This week's top news and views: Health Net Breach Tops Federal List; Beefing Up Health IT Strategic Plan; Open Source HIE Initiative Described.

Philip Reitinger, the top cybersecurity official in the Department of Homeland Security, is on a mission to help create a new, secure computing ecosystem on the Internet.

David Riley, president of the new Alembic Foundation, explains how the organization is promoting the use of open source software based on the Nationwide Health Information Network standards.

When it comes to e-marketing and the reliance on third parties such as Epsilon, Nicolas Christin of Carnegie Mellon University says banks and merchants should "come clean" about the information they share with outside entities.

Privacy Attorney Lisa Sotto says the Epsilon e-mail breach is a warning about the state of data security employed by some third-party service providers. Strong contracts related to security practices must be the norm, not the exception.

When it comes to authentication and identity management, state governments face challenges and vulnerabilities of their own making, says Brent Crossland of Entrust.

March's top news and views: DOD officials explain how a WikiLeaks breach will not happen again, RSA chief technology officer discusses the challenges in dealing with advanced persistent threat attacks and how Ohio decided on a NIST framework. And don't miss our month-in-review podcast by Executive Editor Eric Chabrow.

EastNets' Paul Buelens says fraud-fighting is an international concern, as old schemes abound and new threats emerge. Fraud risks are some of the most challenging banks have ever faced.

The Department of Homeland Security works with RSA to investigate the sophisticated attack aimed at RSA SecurID two-factor authentication products, and card fraud linked to pay-at-the-pump gas terminals in Arizona tourist spots is on the rise.

The Department of Homeland Security works with RSA to investigate the sophisticated attack aimed at RSA SecurID two-factor authentication products, and card fraud linked to pay-at-the-pump gas terminals in Arizona tourist spots is on the rise.

An audio review of some of the most compelling content posted on HealthcareInfoSecurity.com in March, including the Health Net breach investigations.

A comprehensive bill to dramatically change the way the federal government addresses cybersecurity could pass the Senate as early as this summer, Sen. Thomas Carper, who chairs a Senate panel with IT security oversight, says in an interview with GovInfoSecurity.com.

Too many healthcare organizations have overlooked their obligation to comply with the Payment Card Industry Data Security Standard, says security expert Tom Walsh.

India's data protection standards are strong. But to be truly secure, organizations must protect themselves above those standards, says Dr. Kamlesh Bajaj, CEO of the Data Security Council of India.

Cybersecurity threats are growing exponentially, but preparedness varies by country, says Philip Victor of the International Multilateral Partnership Against Cyber Threats, located in Malaysia.

RSA CTO Bret Hartman on advance persistent threats, before the breach; face of federal IT security leadership, putting IT security workforce in perspective, federal cyber incidents up 39 percent; and our special report on the RSA breach and its impact. And don't miss our audio week-in-review podcast by Executive Editor Eric Chabrow

This week's top news and views: RSA Clients Manage Risks; Health Breach Tally Hits 8.3 Million Affected; Identity Theft Prevention Strategies.

Terrell Herzig, CISO at UAB Medicine, speaks out on steps steps he's taking in the wake of the RSA SecurID attack.

Phishy HTML pages get past spam filters, and users of RSA's SecurID two-factor authentication products come up with new ways to monitor threats and take preventive steps in the aftermath of a hacker attack against RSA.

Phishy HTML pages get past spam filters, and users of RSA's SecurID two-factor authentication products come up with new ways to monitor threats and take preventive steps in the aftermath of a hacker attack against RSA.

Ben Knieff, who oversees fraud prevention strategy for NICE Actimize, says most small businesses don't understand online fraud risks, but they are willing to work with banks to mitigate losses.

Chief information security officers must gain buy-in from every business unit for a risk management framework, says Jim Murphy of Caritas Christi Health Care System.

Terrell Herzig, information security officer at UAB Medicine, discusses the steps he's taking in the wake of the attack against RSA's SecurID two-factor authentication products.

Marcus Ranum isn't just a well-regarded information security expert. He's also a customer of the RSA SecurID product, and he's got some strong feelings about the RSA breach and how the industry has responded to it.

The good news is that Indian banking institutions are leaders in information security training. The bad news is that the banks are among the few industries to embrace training and education, says Anil Dhawan of Aditya Infotech Limited.

PCI Council's Jeremy King says guidance tackles data collected via phone communications.

Healthcare organizations should provide their staffs with training on how to guard against identity theft regardless of whether they must comply with the federal Red Flags Rule, says fraud prevention expert Jeremy Miller.

King says new guidance tackles data collected via call centers and other telephone communications.

The announcement by RSA that it had been a victim of an advanced persistent threat shook the global information security industry. Stephen Northcutt of SANS Institute and David Navetta of the Information Law Group offer insight on what happened, what it means and how to respond.

Hackers target RSA's SecurID products, leading federal IT policymakers question America's preparedness for cyberattacks, new House bill would reform federal IT security governance and why Ohio state government decided to standardize on NIST IT security framework.

It's serious news that RSA's SecurID solution has been the target of an advanced persistent threat. But "It's not a game-changer," says Stephen Northcutt, CEO of SANS Institute. "Anybody who says it is [a game-changer] is an alarmist."

ChicagoFIRST's Brian Tishuk says local lessons can be learned from Japan, especially within the financial, government and healthcare sectors.

Global banking institutions can learn from Japan's disaster planning and response. And a sophisticated cyberattack is launched against RSA, targeting the security unit of EMC's SecurID two-factor authentication products.

"Persistent" is the operative word about the advanced persistent threat that has struck RSA and its SecurID products. "If the bad guys out there want to get to someone ... they can," says David Navetta of the Information Law Group.

This week's top news and views: Health Net Breach Investigated; Insights From HIPAA Summit; OCR's McAndrew on Enforcing HIPAA.

Global banking institutions can learn from Japan's disaster planning and response. And a sophisticated cyberattack is launched against RSA, targeting the security unit of EMC's SecurID two-factor authentication products.

A roundup of this week's top news: Hackers target RSA's SecurID products. Also, Japan's nuclear crisis: What do you need to know? Plus: New Health Net breach may be biggest ever.

Smartphones are ubiquitous in organizations today. But how secure are these devices -- and what are the security and liability vulnerabilities associated with their use?

Application security - it's one of the top inside threats for banking institutions globally, according to Peter Gutmann.

When it comes to security, international leaders must think globally and act globally, says Christos Dimitriadis, head of information security at Greece-based INTRALOT S.A.

When the business demands the latest tools and technologies, saying "no" is not a viable option. "Clearly, these are disruptive things, but they also are extremely valuable," says Simon Godfrey, Director, Security Solutions at CA Technologies UK.

Disaster recovery expert Regina Phelps says Japan's nuclear emergency puts local citizens at risk, but organizations globally can learn from the crisis. "I hope that all of us look at this and ask, 'What can I do to be better prepared?'"

Cobit, ITIL, ISO, NIST, an alphabet soup of standards governments often rely on to assure the safety of their IT systems. Ohio government IT leaders saw standardizing on one framework to be a more efficient way to help safeguard IT.