Group items tagged

It was only a matter of time! Auditor accuracy being examined in lawsuit may signal change in PCI and other compliance processes.

When CardSystems Solutions was hacked in 2004 in one of the largest credit card data breaches at the time, it reached for its security auditor's report. In theory, CardSystems should have been safe. The industry's primary security standard, known then as CISP, was touted as a sure way to protect data. And CardSystems' auditor, Savvis Inc, had just given them a clean bill of health three months before. Yet, despite those assurances, 263,000 card numbers were stolen from CardSystems, and nearly 40 million were compromised. More than four years later, Savvis is being pulled into court in a novel suit that legal experts say could force increased scrutiny on largely self-regulated credit card security practices. They say the case represents an evolution in data breach litigation and raises increasingly important questions about not only the liability of companies that handle card data but also the liability of third parties that audit and certify the trustworthiness of those companies. "We're at a critical juncture where we need to decide . . . whether [network security] auditing is voluntary or will have the force of law behind it," says Andrea Matwyshyn, a law and business ethics professor at the University of Pennsylvania's Wharton School who specializes in information security issues. "For companies to be able to rely on audits . . . there needs to be mechanisms developed to hold auditors accountable for the accuracy of their audits." The case, which appears to be among the first of its kind against a security auditing firm, highlights flaws in the standards that were established by the financial industry to protect consumer bank data. It also exposes the ineffectiveness of an auditing system that was supposed to guarantee that card processors and other businesses complied with the standards. Credit card companies have touted the standards and the auditing process as evidence that financial transactions conducted under their purview are secur

In a world of increasingly savvy and inter-connected customers, an organization's approach to information privacy may offer precisely the competitive advantage needed to succeed. Privacy is essential to creating an environment that fosters trusting, long-term relationships with existing customers, while attracting opportunity and facilitating the development of new ones. Spend the morning with me and nine privacy leaders from major corporations: Intel; IBM; Sun Microsystems, Inc.; Microsoft; Facebook; HP; Privacy Analytics Inc.; Ontario Lottery and Gaming Corporation; Peratech Limited; and GS1 Canada as they present their latest innovations in Privacy-Enhancing Technologies (PETs). You will appreciate how "Privacy by Design" - embedding PETs into the architecture of new systems - protects privacy, without compromising performance or security - a positive-sum not zero-sum outcome.

making best indexing in goggle and bing. RADJASEOTEA is a master of backlinks. You want indexing in goggle and bing. LOOK THIS www.fiverr.com/radjaseotea/making-best-super-backlink-143445

The debate on Internet privacy has begun in Congress. I had a chance to sit down recently with Representative Rick Boucher, the long-serving Virginia Democrat, who has just replaced Ed Markey, the Democrat from Massachusetts, as the chairman of the House Subcommittee looking after telecommunications, technology and the Internet. Mr. Boucher is widely regarded as one of the most technologically savvy members of Congress. As he ticked off his top priorities for his panel, most involved the pressing demands of telecommunications regulation. There is a law governing how local TV stations are carried on satellite broadcasters that needs to be renewed. There is the Universal Service Fund, which takes money from most telephone customers to pay for rural service to be improved. And there is the conversion to digital television and the investments in rural broadband to be supervised. But high on his list is a topic that is very much under his discretion: passing a bill to regulate the privacy of Internet users. "Internet users should be able to know what information is collected about them and have the opportunity to opt out," he said. While he hasn't written the bill yet, Mr. Boucher said that he, working with Representative Cliff Stearns, the Florida Republican who is the ranking minority member on the subcommittee, wants to require Web sites to disclose how they collect and use data, and give users the option to opt out of any data collection. That's not a big change from what happens now, at least on most big sites.

Netbook web surfers beware. That low-cost netbook you're using could be a high-speed gateway into your life, bank accounts, passwords and other personal data. Netbooks have made headlines since their 2007 launch, making PCs accessible to millions of non-traditional users. But their cheap cost could also carry a steep price tag due to lax security that makes them easier prey for viruses and hackers. Since their introduction less than two years ago by Taiwan's Asustek, nearly all major PC makers, including Hewlett-Packard, Dell, Acer and Lenovo, have jumped on the netbook bandwagon. But their no frills nature, combined with low computing power and relative lack of sophistication among their users could combine to create the perfect storm for hackers and virus creators looking for easy targets, analysts say. "The Internet is full of dangers, regardless of what computer you are using," said Sam Yen, greater China marketing manager at anti-virus software maker Symantec. "But keeping in mind that the netbook is primarily used to surf the Internet, those dangers are possibly multiplied many-fold, especially if there is no anti-virus software installed in the machine." Price tags as low as $300 mean that netbooks often lack such standard gear as firewalls and other anti-virus software typically found in other computers, leaving them highly vulnerable to attacks. "Frankly, netbook security is not there yet," said Pranab Sarmah, an analyst at the Daiwa Institute of Research. "The positioning of the netbook means PC brands are going to do whatever it takes to make the price point attractive to consumers, which means keeping costs low." Many netbook users are relative Internet newcomers, and may not be aware of precautions they can take to protect themselves. Low computing power also means savvy netbook users may shut down critical security programs to boost speed. "It's a Catch-22 situation," said Gartner analyst Lillian Tay. "If you're running too many security prog

70 percent of UK risk managers have declared that making sure the employees in their organization are risk savvy is their biggest challenge in light of new pitfalls according to research conducted by Aon. "The risks companies are facing, such as increased company insolvencies, less access to credit and increased levels of fraud, need to be dealt with by employees throughout the organization rather than just at senior management levels," said the bulletin. According to the survey of UK businesses the key risk management challenges they face in 2009 are: -- Embedding ERM in the culture of the organization 70 percent -- Keeping 'risk registers' real and relevant 47 percent -- Making the link between ERM and strategic planning processes 34 percent -- Gaining senior executive sponsorship 19 percent -- Making business continuity plans relevant to line managers 13 percent -- Credit rating agency scrutiny of ERM 6 percent Alex Hindson, head of enterprise risk management at Aon Global Risk Consulting commented: "When the markets are literally crashing down around us and we don't know what is just around the corner it is extremely tempting to focus just on the problems of today, rather than look at the issues and factors that are going to help us survive tomorrow, but this short term view can often be counter-productive.

Welcome to GovInfoSecurity.com We have a new President, a new Administration, a new session of Congress ... and a new national mission throughout government to secure personal data and protect our borders from cyber threats. Information security has never been more important to the federal government - or to all of us, as we conduct personal and professional business in this electronic world. To track the progress of this new security-savvy Administration - and to give you the information and opportunity to present your opinions - we're pleased to introduce GovInfoSecurity.com, a new site dedicated to providing interactive news, views and training on all facets of federal government security.

Ignorance may be bliss, but it can also be expensive. Insufficiently knowledgeable computer users are downloading and paying for fake security software in increasing numbers, creating massive revenue for cybercriminals. "More and more people are acclimating to the Internet and they feel they can make these important security decisions," said Sean-Paul Correll, security evangelist and threat researcher for Panda Security. "They don't feel the need to call their tech-savvy grandson."

Buying and renting tools used by cybercriminals to conduct attacks and steal credentials is becoming much easier for the average person. "For Rent" signs hang on botnets, automated hacking toolkits are sold at bargain prices, and the data reaped by the criminal activity is sold and traded in online forums on a daily basis. Researchers at networking giant Cisco Systems Inc. are warning of the increasingly sophisticated cybercriminal underground economy and how it could be attractive to those having trouble finding work or facing layoffs in a troubled global economy. Meanwhile, cybercriminals are borrowing some of the best strategies from legitimate companies and forming partnerships with one another to help make their illegal activities more lucrative, according to Cisco.

How will Barack Obama's administration affect IT spending in the trenches, where technology decision makers are dealing with strapped budgets and a shaky economy? President Barack Obama's official campaign Web site is a model of how 21st century technology tools can boost a candidate's popularity, building significant buzz via blogs, IM applications and e-merchandising. And Obama's campaign wasn't confined to his own site either, because he chose to expand his presence on social networking sites like Facebook, MySpace, Eons and BlackPlanet. His images and words also constantly popped up at outlets such as Flickr, Digg and YouTube. All these efforts made Obama an accessible, immediate and appealing figure to both younger voters and older ones who regularly connect to the Internet. Ultimately, they energized his campaign and helped secure a decisive victory for the nation's first African-American president. Certainly, Obama enters the White House with a reputation as one of the most-if not the most-tech-savvy chief executives ever. For starters, he's created the position of a federal chief technology officer to oversee the future of information technology for government agencies.

The team that ran the most technologically advanced presidential campaign in modern history is finding it difficult to adapt that model to government. WhiteHouse.gov, envisioned as the primary vehicle for President Obama to communicate with the online masses, has been overwhelmed by challenges that staffers did not foresee and technological problems they have yet to solve. Obama, for example, would like to send out mass e-mail updates on presidential initiatives, but the White House does not have the technology in place to do so. The same goes for text messaging, another campaign staple. Beyond the technological upgrades needed to enable text broadcasts, there are security and privacy rules to sort out involving the collection of cellphone numbers, according to Obama aides, who acknowledge being caught off guard by the strictures of government bureaucracy. "This is uncharted territory," said Macon Phillips, White House director of new media, which was a midlevel position in previous administrations but has been boosted by Obama to a "special assistant to the president."