Skip to main content

Home/ WPPS C-Suite News/ Group items tagged 2010

Rss Feed Group items tagged

Filter: All | Bookmarks | Topics Simple Middle
sandy ingram

Microsoft Enterprise Content Management (ECM) Team Blog : EDiscovery in SharePoint Serv... - 0 views

blogs.msdn.com/...in-sharepoint-server-2010.aspx

sharepoint ediscovery 2010 content microsoft ecm Compliance Breach policy

shared by sandy ingram on 20 Apr 10 - Cached
  • In this post, I want to highlight three major improvements in SharePoint that support eDiscovery. You can: Manage holds and conduct eDiscovery searches on any site collection Use SharePoint Server Search or FAST Search for SharePoint out of box to search and process content Automatically copy eDiscovery search results to a separate repository for further analysis
  • SharePoint Sever 2010 addresses the Information Management, Identification, Preservation and Collection stages
  • Hold and eDiscovery is a site level feature that can be activated on any site.
  • ...5 more annotations...
  • Activating this feature creates a new category in Site Settings that provides links to Holds and Hold Reports lists
  • With the Hold and eDiscovery feature you can create holds in the hold list and then manually add content to the relevant hold by clicking on Compliance Details from the drop down menu for individual items.
  • What if you have a large amount of items you want to find and add to a hold? For that you can use the features on the Discover and hold content page, which is a settings page in Site Settings. From this page you can specify a search query and then preview the results. The configured search service (SharePoint Search Server or FAST Search for SharePoint) will automatically be used. You can then select the option to keep items on hold in place so they cannot be edited or deleted, or if you have configured a Content Organizer Send to location in Central Administration you can have content copied to another site and placed on hold
  • When searching and processing, the search will by default be scoped to the entire Site Collection and run with elevated permissions so all content can be discovered
  • In summary, SharePoint Server 2010 contains key features that make it an essential aspect of your eDiscovery strategy. With the new SharePoint Server 2010 capabilities you can easily apply proper retention policies for all content and make it easier to discover content if an eDiscovery event occurs. eDiscovery often prescribes tight deadlines for production. SharePoint 2010 helps you find the right content and deliver it faster.
  • sandy ingram on 20 Apr 10
     
    i everyone, I am Quentin Christensen and I work on document and records management functionality for SharePoint. Electronic discovery (commonly referred to as eDiscovery) is an area we are supporting with new set of capabilities in SharePoint Server 2010. In case you are not familiar with eDiscovery, it is the process of finding, preserving, analyzing and producing content in electronic formats as required by litigation or investigations. eDiscovery is an important concern for all of our customers and given that SharePoint has grown to be an integral part of collaboration, document, and records management for many organizations, we recognize the need to support the eDiscovery process for SharePoint content. Microsoft Office SharePoint Server 2007 included a hold feature that could be used for eDiscovery, but it was scoped to the Records Center site template. With SharePoint Server 2010 the eDiscovery capabilities have been greatly expanded to provide more functionality and the power to use these features across your entire SharePoint deployment. In this post, I want to highlight three major improvements in SharePoint that support eDiscovery. You can: Manage holds and conduct eDiscovery searches on any site collection Use SharePoint Server Search or FAST Search for SharePoint out of box to search and process content Automatically copy eDiscovery search results to a separate repository for further analysis
sandy ingram

FTC Delays Enforcement of Red Flags Rule Fifth Time at the request of Congress - 0 views

www.hipaa.com/...-ftc-red-flags-rule-fifth-time

compliance FTC Red Flags Rule

shared by sandy ingram on 17 Sep 10 - No Cached
  • “The Commission urges Congress to act quickly to pass legislation that will resolve any questions as to which entities are covered by the Rule and obviate the need for further enforcement delays.  If Congress passes legislation limiting the scope of the Red Flags Rule with an effective date earlier than December 31, 2010, the Commission will begin enforcement as of that effective date.”
  • The issue regarding the delays in FTC enforcement relates to “scope of entities covered by the Rule,” as indicated in the FTC news release.  Congress is taking action[2]:
  • “House lawmakers in October [2009] passed H.R. 3763[3], which would exclude from the Red Flags guidelines meaning of ‘creditor’ any healthcare, accounting, or legal practice with 20 or fewer employees, as well as any other business which the FTC determines knows all its customers or clients individually; only performs services in or around the residences of its customers; or hasn’t experienced incidents of ID theft, and identity theft is rare for businesses of that type.  An identical bill, S.3416 was introduced in the Senate on May 25 [2010].” A lawsuit was filed in federal court on May 21, 2010, to accomplish a similar objective of narrowing scope of entities covered by the Rule. 
  • sandy ingram on 17 Sep 10
     
    "At the request of several Members of Congress, the Federal Trade Commission is further delaying enforcement of the 'Red Flags' Rule through December 31, 2010, while Congress considers legislation that would affect the scope of entities covered by the Rule.  Today's announcement and the release of an Enforcement Policy Statement do not affect other federal agencies' enforcement of the original November 1, 2008 deadline for institutions subject to their oversight to be in compliance….
sandy ingram

FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule - 0 views

www.ftc.gov/...redflags.shtm

identity theft ftc extends Red Flags Rule Legal compliance information security

shared by sandy ingram on 21 Oct 10 - Cached
  • “Congress needs to fix the unintended consequences of the legislation establishing the Red Flags Rule – and to fix this problem quickly.
  • The Rule was developed under the Fair and Accurate Credit Transactions Act, in which Congress directed the FTC and other agencies to develop regulations requiring “creditors” and “financial institutions” to address the risk of identity theft.
  • The resulting Red Flags Rule requires all such entities that have “covered accounts” to develop and implement written identity theft prevention programs to help identify, detect, and respond to patterns, practices, or specific activities – known as “red flags” – that could indicate identity theft.
  • ...3 more annotations...
  • The Rule became effective on January 1, 2008, with full compliance for all covered entities originally required by November 1, 2008.
  • Today’s announcement and the release of an Enforcement Policy Statement do not affect other federal agencies’ enforcement of the original November 1, 2008 deadline for institutions subject to their oversight to be in compliance.
  • If Congress passes legislation limiting the scope of the Red Flags Rule with an effective date earlier than December 31, 2010, the Commission will begin enforcement as of that effective date.
  • sandy ingram on 21 Oct 10
     
    FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule At the request of several Members of Congress, the Federal Trade Commission is further delaying enforcement of the "Red Flags" Rule through December 31, 2010, while Congress considers legislation that would affect the scope of entities covered by the Rule. Today's announcement and the release of an Enforcement Policy Statement do not affect other federal agencies' enforcement of the original November 1, 2008 deadline for institutions subject to their oversight to be in compliance. "Congress needs to fix the unintended consequences of the legislation establishing the Red Flags Rule - and to fix this problem quickly. We appreciate the efforts of Congressmen Barney Frank and John Adler for getting a clarifying measure passed in the House, and hope action in the Senate will be swift," FTC Chairman Jon Leibowitz said. "As an agency we're charged with enforcing the law, and endless extensions delay enforcement." The Rule was developed under the Fair and Accurate Credit Transactions Act, in which Congress directed the FTC and other agencies to develop regulations requiring "creditors" and "financial institutions" to address the risk of identity theft. The resulting Red Flags Rule requires all such entities that have "covered accounts" to develop and implement written identity theft prevention programs to help identify, detect, and respond to patterns, practices, or specific activities - known as "red flags" - that could indicate identity theft. The Rule became effective on January 1, 2008, with full compliance for all covered entities originally required by November 1, 2008. The Commission has issued several Enforcement Policies delaying enforcement of the Rule. Most recently, the Commission announced in October 2009 that at the request of certain Members of Congress, it was delaying enforcement of the Rule until June 1, 2010, to allow Congress time to finalize leg
sandy ingram

SurveyHigh storage costs, long backup windows, litigation risk and inefficient eDiscove... - 0 views

www.symantec.com/...article.jsp

Best Practice e-discovery Privacy Security

shared by sandy ingram on 13 Sep 10 - No Cached
  • Enterprises are retaining far too much information. Seventy-five percent of backup storage consists of infinite retention or legal hold backup sets. Respondents also stated that 25 percent of the data they back up is not needed for business or should not be kept in a backup.
  • Enterprises are misusing backup, recovery and archiving practices. Seventy percent of enterprises use their backup software to implement legal holds and 25 percent preserve the entire backup set indefinitely. Respondents said 45 percent of backup storage comes from legal holds alone
  • Differences in how IT and legal respondents cited top issues for lack of an information retention plan Forty-one percent of IT administrators don’t see a need for a plan, 30 percent said no one is chartered with that responsibility, and 29 percent cited cost.
  • ...5 more annotations...
  • Storage costs are skyrocketing as over retention has created an environment where it is now 1,500 times more expensive to review data than it is to store it,
  • Backup is not an archive, and it is not recommended to use backup for archiving and legal holds
  • Enterprises should also develop and enforce information retention policies (what can and cannot be deleted, and when) automatically. Automated, policy-driven deletion creates less risk than ad-hoc, manual deletion.
  • Paper policies that are not executed can be a litigation risk.
  • Enterprises should deploy data loss prevention technologies to measurably reduce their risk of data breaches, demonstrate regulatory compliance and safeguard their customers, brand and intellectual property.
  • sandy ingram on 13 Sep 10
     
    MOUNTAIN VIEW, Calif. - August 4, 2010 - Symantec Corp. (Nasdaq: SYMC) today released the findings of its 2010 Information Management Health Check Survey, which highlights that a majority of enterprises are not following their own advice when it comes to information management. Eighty-seven percent of respondents believe in the value of a formal information retention plan, but only 46 percent actually have one. Survey results also found that too many enterprises save information indefinitely instead of implementing policies that allow them to confidently delete unimportant data or records, and therefore suffer from rampant storage growth, unsustainable backup windows, increased litigation risk and expensive and inefficient discovery processes.
sandy ingram

Interop: Cloud security raises concerns for auditors - 0 views

www.networkworld.com/...10-interop-cloud-security.html

security cloud cybersecurity Compliance privacy

shared by sandy ingram on 28 Apr 10 - Cached
  • They will be more strict because there are no clear policies for it,"
  • The rules will come with time, but they don't exist yet, so businesses need to be careful what data they submit to clouds and be sure data subject to compliance standards such as HIPAA, PCI and Sarbanes-Oxley can be provably handled within those standards.
  • "Auditors want to see the guts of the cloud," Richter says, and that is something many cloud providers don't allow. Many keep their physical architectures, policies, security, virtual LAN structure and other essential factors secret. "If they can't see how data flows, how VLANs are segmented, see how your data is partitioned from others', they won't OK it."
  • ...3 more annotations...
  • Regardless of whether a cloud gains the trust of a business and can earn the approval of an auditor, the responsibility for protecting the data stays with the business; outsourcing the application or the platform or the infrastructure doesn't outsource the responsibility, he says
  • And if a cloud provider is generally deemed compliant with some security standard, that doesn't mean an individual business's use of that cloud will pass muster as well. "It's you the end customer who is responsible for compliance, not the service provider," he says
  • For businesses that plan to use some form of cloud, Richter set down eight steps to follow to make the transition safely from a private traditional infrastructure:
  • sandy ingram on 28 Apr 10
     
    LAS VEGAS -- If you think meeting security audits is tough, try passing one if you've got your data in a cloud, Interop attendees were told today.
sandy ingram

Ponemon #BREACH SURVEY: 56% suffer from financial identity theft and cost Hospitals $6 ... - 0 views

www.prnewswire.com/...acy-in-jeopardy-106945528.html

Privacy security compliance HITECH survey ponemon

shared by sandy ingram on 02 Dec 10 - No Cached
  • "Our research shows that the healthcare industry is struggling to protect sensitive medical information, putting patients at risk of medical identity fraud and costing hospitals and other healthcare services companies millions in annual breach-related costs," said Dr. Larry Ponemon, chairman and founder, Ponemon Institute.  "At this point one would hope to see that healthcare organizations have improved information security practices and come into compliance with HITECH, now that it's been more than one year since it was enacted.  Instead we found enormous vulnerabilities.  The protection of patient data should be at the forefront of their efforts."
  • ey findings of the research: Data breaches are costing the healthcare system billions.  The total economic burden created by data breaches on the healthcare industry is nearly $6 billion annually.  The impact of a data breach over a two-year period is approximately $2 million per organization and the lifetime value of a lost patient is $107,580.  The average organization had 2.4 data breach incidents over the past two years.  Major factors causing data breaches are unintentional employee action, lost or stolen computing devices and third-party error.Healthcare organizations are not protecting patient data.  Organizations have little or no confidence in their ability to appropriately secure patient records (58 percent).  Healthcare organizations have inadequate resources (71 percent) and insufficient policies and procedures in place (69 percent) to prevent and quickly detect patient data loss.Protecting patient data is not a priority.  Seventy percent of hospitals stated that protecting patient data is not a top priority.  Patient billing (35 percent) and medical records (26 percent) are the most susceptible to data loss or theft.  A majority of organizations have less than two staff dedicated to data protection management (67 percent).HITECH has exposed the healthcare industry's lax data protection practices rather than improved the safety of patient records.  The majority (71 percent) of respondents do not believe the HITECH Act regulations have significantly changed the management practices of patient records.  The findings indicate that there is a significant number of data breaches that go undetected, and therefore unreported.
  • "We talk with healthcare compliance people dealing with data breach risks every day and they just can't get their arms around the problem of data exposure," said Rick Kam, president and co-founder of ID Experts.  "Unfortunately, in healthcare organizations, patient revenue trumps risk management."
  • sandy ingram on 02 Dec 10
     
    Hospitals Are Not Protecting Patient Data; Healthcare Industry Lagging Behind HITECH Standards TRAVERSE CITY, Mich. and PORTLAND, Ore., Nov. 9, 2010 /PRNewswire/ -- The latest benchmark study by Ponemon Institute, sponsored by ID Experts®, finds that data breaches of patient information cost healthcare organizations nearly $6 billion annually, and that many breaches go undetected.  The research indicates that protecting patient data is a low priority for hospitals and that organizations have little confidence in their ability to secure patient records, putting individuals at great risk for medical identity theft, financial theft and embarrassment of exposure of private information.
sandy ingram

SURVEY BY KROLL ONTRACK: One out of Two businesses do not erase sensitive data. - 0 views

www.krollontrack.com/news-releases

shared by sandy ingram on 29 Nov 10 - No Cached
  • "Three-fourths of businesses are deleting files, reformatting or destroying drives, or 'do not know' how they are erasing sensitive data. Deleting files from a hard drive only marks the files to be rewritten, which may never occur. Furthermore, reformatting the drive only removes the entries in the index or table of contents that point to the data. And, physically destroying a drive is not a guaranteed method of protection, as Kroll Ontrack has been recovering data from severely damaged drives, such as the Columbia space shuttle, for more than 25 years.
  • "Surveying more than 1,500 participants from 12 countries across North America, Europe and Asia Pacific regarding their data wiping practices also revealed that four in 10 businesses gave away their used hard drive to another individual and 22 percent do not know what happened to their old computer.
  • Only 19 percent of businesses deploy data eraser software and fewer, 6 percent, use a degausser to erase media. When asked if and how businesses verify their data has been deleted, very few (16 percent) reported relying on a product or service report to confirm all of their data had been wiped.
  • ...1 more annotation...
  • "Reports that verify or confirm what the tool and/or service did are critical," concluded Reinert. "Not only do they inform you of what has been wiped, but they should identify the serial number as well as the make and model information of the wiped hard drive, the date and time of when the information was wiped, and a listing of how much information was wiped."
  • sandy ingram on 29 Nov 10
     
    "According to a recent global survey on data wiping practices, Kroll Ontrack, the leading provider of information management, data recovery, and legal technology products and services, found less than half of businesses regularly deploy a method of erasing sensitive data from old computers and hard drives. Of the 49 percent of businesses that are systematically deploying a data eraser method, 75 percent do not delete data securely, leaving most organizations highly susceptible to data breaches, which plague businesses at least once a year according to the 2010 Kroll Ontrack Annual ESI Trends Survey and cost an organization an average of $6.75 million per breach according to the 2009 Ponemon Cost of Data Breach Study."
sandy ingram

The Fed 2011 Agenda: Rush to the Cloud ! - 0 views

www.drdobbs.com/...M4GKN3UNAEZQE1GHRSKH4ATMY32JVN

Best Practice cloud compliance

shared by sandy ingram on 03 Jan 11 - No Cached
  • The new 25-point plan establishes a Data Center Consolidation Task Force with a goal of reducing the number of data centers by 800 as of 2015.
  • The plan also touts scalability as a reason for embracing the cloud over traditional solutions. It cited the example of a private-sector company doing video editing that experienced a surge of demand and was able, using the cloud, to scale from 50 to 4,000 virtual machines in three days.
  • There's an expectation that moving applications such as e-mail to the cloud will facilitate data center consolidation and reduce IT budgets. Some federal agencies have already awarded contracts to move e-mail to the cloud. In addition, the government has selected a dozen vendors to supply Infrastructure-as-a-Service (Iaas).
  • ...6 more annotations...
  • Google and Microsoft want the government’s cloud business and they’ve undertaken a PR campaign including announcements of high-profile contract awards. The General Services Administration (GSA) recently awarded Unisys and Google a contract to host e-mail in the cloud. The US Department of Agriculture (USDA) selected Dell to supply Microsoft Online Services for the migration of 120,000 users and 21 e-mail systems to the cloud.
  • Microsoft was the winner of a Department of the Interior contract for moving e-mail to the cloud, a selection that Google protested. Google and its reseller, Onix Networking Corp, have filed suit against the Department of the Interior to overturn that selection.
  • Both Google Apps for Government and BPOS have been certified as being compliant with the Federal Information Security Management Act (FISMA). Being given FISMA Authority to Operate (ATO) is a certification the cloud infrastructure is a secure, trusted environment for government applications and databases they use.
  • The federal contracts for hosting e-mail in the cloud are not the first Big Government embrace of hosted e-mail. Microsoft reportedly has several hundred state and local agencies using its cloud services. New York City recently announced it will adopt Microsoft BPOS for 30,000 city users.
  • The State of California awarded a contract to Microsoft and Computer Sciences Corporation (CSC) for the migration of 130 of e-mail systems to Microsoft BPOS.
  • The State of Minnesota Office of Enterprise Technology (OET) announced an agreement with Microsoft to migrate Exchange e-mail and other communications services to BPOS in a private cloud.
  • sandy ingram on 03 Jan 11
     
    "In December 2010, the government's CIO, Vivek Kundra, released a 25-point plan for an overhaul of Federal IT that emphasizes a cloud-first policy for federal agencies. Currently the federal government is on pace to spend $79 billion on IT this year, with more than 20% going to infrastructure spending. Because the US government has spent $600 billion on IT over the past decade, the plan's intent is to reduce IT spending by the federal government."
sandy ingram

What We're Watching in Cloud Computing - Harvard Business Review - 0 views

hbr.org/...2

cloud cybersecurity Compliance Best Practice

shared by sandy ingram on 14 Jun 10 - Cached
  • Yet those data centers, according to EPA figures cited by NIST, consume 1.5% of all electricity generated in the United States (compared with 0.6% worldwide in 2000). Globally, IT produces 2% of CO2 emissions.
  • Businesses that go with cloud computing could improve sustainability in two ways. First, companies maximize servers by sharing them, so fewer machines are chugging away. Second, on-demand usage means that firms needn’t consume way above their needs during slow times in order to be ready for busy times.
sandy ingram

Complex Global Risks, Boardroom Demands to Challenge Risk Managers in 2010: Marsh | EON... - 0 views

eon.businesswire.com/...permalink

risks security privacy Compliance

shared by sandy ingram on 02 Jun 10 - Cached
  • “With the ever-increasing complexity of global exposures, successful risk management today depends on timely information, regulatory awareness, and thoughtful anticipation of the range of local and global scenarios,”
  • sandy ingram on 02 Jun 10
     
    Global risk managers are challenged by new boardroom demands of insurer security, balance sheet transparency, and heightened accountability.
sandy ingram

California Department of Public Health Breach Fines and Legally Defensible Security : I... - 0 views

www.infolawgroup.com/...nd-legally-defensible-security

california health breach

shared by sandy ingram on 28 Jun 10 - Cached
  • sandy ingram on 28 Jun 10
     
    The California Department of Public Health ("CDPH") recently announced its imposition of $675,000 in fines to six hospitals that had reported security breaches involving medical records (since January 1, 2009, the CDPH has issued fines totaling $1.1 million). The story has been extensively reported on in the media . You can listen to the CDPH's press conference here. The total number of records exposed was only 244, for an average fine of around $2,766 per record. To put that in perspective, if a California hospital suffered a breach involving 100,000 medical records, using the average stated here, their potential fines could be $276 million (assuming no cap for fines and penalties -- the relevant laws do have a cap of $250,000 per incident).
sandy ingram

Microsoft cloud computing & cloud services - So much more than just BPOS - Microsoft Pa... - 0 views

blogs.msdn.com/...-much-more-than-just-bpos.aspx

cloud microsoft BPOS

shared by sandy ingram on 24 Aug 10 - Cached
  • Windows Azure - flexible, familiar environment to create applications and services for the cloud.
  • Windows Intune - simplifies how businesses manage and secure PCs using Windows cloud services and Windows 7
  • Microsoft Office Web Apps - online companions to Word, Excel, PowerPoint, and OneNote, giving you the freedom to access, edit, and share Microsoft Office documents from virtually anywhere.
  • ...10 more annotations...
  • Microsoft SQL Azure - provides a highly scalable, multi-tenant database that you don't have to install, setup, patch or manage.
  • Microsoft Exchange Online - highly secure hosted e-mail with "anywhere access" for your employees.  Starts at just $5 per user per month.
  • Microsoft Forefront Online Protection for Exchange - helps protect businesses' inbound and outbound e-mail from spam, viruses, phishing scams, and e-mail policy violations.
  • Microsoft SharePoint Online - gives your business a highly secure, central location where employees can collaborate and share documents.
  • Microsoft Office Live Meeting - provides real-time, Web-hosted conferencing so you can connect with colleagues and engage clients from almost anywhere – without the cost of travel.
  • Microsoft Office Communications Online - delivers robust messaging functionality for real-time communication via text, voice, and video.
  • Microsoft Dynamics CRM Online - helps you find, keep, and grow business relationships by centralizing customer information and streamlining processes with a system that quickly adapts to new demands.
  • Windows Live ID - identity and authentication system provided by Windows Live that lets you create universal sign in credentials across diverse applications.
  • Microsoft Business Productivity Online Suite (BPOS) - brings together online versions of Microsoft's messaging and collaboration solutions, including: Exchange Online, SharePoint Online, Office Live Meeting, and Office Communications Online.
  • Hopefully in the information above, you can see that when it comes to Microsoft cloud computing and Microsoft cloud services, BPOS is just one aspect and offering available, but it goes far beyond just that.  Whether you are a business or a partner, the opportunity that cloud computing/cloud services and Microsoft brings to you are very exciting and continue to expand each and every day.
  • sandy ingram on 24 Aug 10
     
    The journey leading up to where we are today has been taking place for 15 years now, starting way back with Windows Live and Hotmail. Since then, the services and offerings served up online through cloud from Microsoft have continued and expanded. Today, there are a number of cloud based solutions available, enabling individuals and businesses around the world to do so much. Here's a look at some of these, with links to more information about each and trials of these for you:
sandy ingram

Survey Finds Gap in Attitudes Between the Cloud "Haves" and "Have-Nots" - ReadWriteCloud - 0 views

www.readwriteweb.com/...vey-finds-gap-in-attitudes.php

Security Privacy cybersecurity compliance cloud marketing

shared by sandy ingram on 24 Aug 10 - Cached
  • This post is part of our ReadWriteCloud channel, which is dedicated to covering virtualization and cloud computing. The channel is sponsored by Intel and VMware.
  • London-based communications SaaS provider Mimecast has announced the results of its second annual Cloud Adoption Survey. The survey, conducted by independent research firm Loudhouse, assessed the attitudes of IT decision-makers in the U.S. and UK about cloud computing
  • The majority of organizations now use some cloud-based services. The report found 51% are now using at least one cloud-based application. Adoption rates for U.S. businesses are slightly ahead of the UK with 56% of respondents using at least one cloud-based application, compared to 50% in the UK
  • ...7 more annotations...
  • Two thirds of businesses are considering adopting cloud computing. 66% of businesses say they are considering adopting cloud-based services in the future, with once again, U.S. businesses leaning more towards adoption than their UK peers (70% of U.S. businesses, and 50% of UK ones).
  • Email, security, and storage are the most popular cloud services. 62% of the organizations that use cloud computing are using a cloud-based email application. Email services are most popular with mid-size businesses (250-1000 employees) with 70% of organizations this size using the cloud for email. Smaller businesses (under 250 employees) are most likely to use the cloud for security services, and larger enterprises (over 1000 employees) most likely to opt for cloud storage services.
  • Existing cloud users are satisfied. Security is not considered to be an issue by existing cloud users: 57% say that moving data to the cloud has resulted in better security, with 58% saying it has given them better control of their data. 73% say it has reduced the cost of their IT infrastructure and 74% believe the cloud has alleviated the internal resource pressures.
  • Security fears are still a barrier. 62% of respondents believe that storing data on servers outside of the business is a significant security risk. Interestingly, this number was higher for users of cloud applications than it was for non-users (only 59% of non-users thought it was risky, while 67% of users did.)
  • Some think the benefits of the cloud may be overstated.54% of respondents said the potential benefits of the cloud are overstated by the IT industry, and 58% indicated they believed that replacing legacy IT solutions will almost always cost more than the benefits of new IT.
  • "The research shows that there is a clear divide within the IT industry on the issue of cloud computing," says Mimecast CEO and co-founder Peter Bauer. "While those organisations that have embraced cloud services are clearly reaping the rewards, there are still a number who are put off by the 'cloud myths' around data security and the cost of replacing legacy IT
  • It is now up to cloud vendors to educate businesses and end users to ensure that these concerns do not overshadow the huge potential cost, security and performance benefits that cloud computing can bring."
  • sandy ingram on 24 Aug 10
     
    Existing cloud users are satisfied. Security is not considered to be an issue
sandy ingram

United States, Litigation, Mediation & Arbitration, Didn't See That Coming? Why Many Em... - 0 views

www.mondaq.com/...article.asp

Privacy Security CEO employees Fraud

shared by sandy ingram on 04 Aug 10 - Cached
  • Daniels Midland employee who embezzled millions, to the bookkeeper in Maine who took thousands from the church's coffers. The current rough economy and easy access to sophisticated technology are potent ingredients for creating the perfect storm for organizational fraud.
  • Enabling technologies like sophisticated color printers, remote access to linked computers, and data-capturing viruses have played a significant role in how employees can commit and conceal fraud. Even without accessible technology, the lack of segregation of duties and "less paper" (making for fewer paper trails) in the working environment make it easier for employees to commit fraud.
  • While technology and the economy may facilitate fraud, it is an employee's motivation and opportunity that are the most important elements in understanding fraud risk. Motivation (also known as incentives or pressures), opportunity, and rationalization of the fraudulent behavior are the three critical elements necessary for fraud to occur
  • ...9 more annotations...
  • UNDERSTANDING THE ELEMENTS OF FRAUD
  • Incentives/pressures
  • Opportunity
  • Rationalization
  • Opportunity
  • Using the Fraud Triangle Theory gives us a means to understanding and deterring fraud by identifying and mitigating the elements necessary to enable fraud. Removing weak internal control systems and replacing them with stronger systems, observing employee behavior, and modeling behavior from the top down, can reduce a company's fraud risk tremendously.
  • Opportunity
  • Rationalization is the final component of the 3
  • Opportunity is the one area that an employer can best control
  • sandy ingram on 04 Aug 10
     
    "Didn't See That Coming? Why Many Employers are Vulnerable to Employee Fraud"
sandy ingram

Three Things That Every CEO Should Know About Cyber Security Spending - The Firewall - ... - 0 views

blogs.forbes.com/...-about-cyber-security-spending

cybersecurity Best Practice c-level

shared by sandy ingram on 15 Nov 10 - No Cached
  • ONE: If your enterprise isn’t in energy, defense, or finance, it’s not a high priority target so don’t spend money like it is.
  • TWO: If you do lead a company in one of those 3 sectors, there’s nothing on the market today that will stop an adversary from stealing your most valuable data. The best that you can hope for is to raise the cost to an adversary to mount a successful attack against you, which means he’ll target a less well-protected company instead. This is known as the You-Don’t-Have-To-Outrun-The-Bear School of Security.
  • THREE: Your IT department’s job is not to protect you. It’s to protect the enterprise’s network. That makes you and your C-level colleagues the “10 ring” of the target.
  • ...2 more annotations...
  • Most C-level executives are inundated with far more material then they could ever read, so this post will be short and to the point. If you’re a CEO, CIO, or other C-level executive, here are three things that you need to know to avoid over-spending on cyber security:
  • I’m giving a free webinar at 10am (Pacific time) this morning for UBS and their clients on the evolving state of cyber warfare in general and risks to C-level executives in particular. In addition to surveying the threats, I’ll offer some advice on how executives can defend themselves. Here’s the information you’ll need to join the call: Participant Toll-free: 800-768-5109 Toll: 212-231-2909 Code: 21488152
  • sandy ingram on 15 Nov 10
     
    "Most C-level executives are inundated with far more material then they could ever read, so this post will be short and to the point. If you're a CEO, CIO, or other C-level executive, here are three things that you need to know to avoid over-spending on cyber security:"
sandy ingram

Study: Cloud Cuts Carbon Emissions: Companies running applications in the cloud can red... - 0 views

www.microsoft.com/...11-04cloudcutscarbon.mspx

cloud study carbon emissons

shared by sandy ingram on 09 Nov 10 - No Cached
  • “The IT industry had this nagging question – as more and more services move to the cloud, do they consume more or less energy?” Bernard said. “This study found that you can migrate existing infrastructure to the cloud and see not only growth in productivity but a reduction in energy consumption for those services.”
  • The study was aimed at understanding how the cloud performs differently from an on-premises environment, said Josh Whitney, corporate sustainability strategy lead with WSP. Using a methodology aligned to the Global eSustainability Initiative (GeSI) standards, Accenture and WSP compared the energy use and carbon emissions per user for Exchange Server 2007, SharePoint Server 2007, and Microsoft Dynamics CRM with their cloud-based equivalents: Exchange Online, SharePoint Online and Microsoft Dynamics CRM Online. The results suggest that for widely deployed and commonly used applications such as e-mail, content sharing and customer relationship management, the cloud can enable significant reduction in carbon emissions.
  • “The findings are actually pretty impressive,” Whitney said. “I think this study provides further reinforcement of the benefits of the cloud beyond the bottom line. It provides one of the first quantitative and measurable analyses of the impact that cloud computing can have directly compared to a traditional deployment of IT within a company.”
  • ...2 more annotations...
  • The study pointed to several other factors that drove down emissions and consumption, including the fact that datacenters operate servers at much higher utilization rates and are physically constructed to reduce power loss.
  • Mike Ehrenberg, a technical fellow and chief architect for Microsoft Dynamics, said the study’s findings should reinforce for customers the benefits of moving to the cloud.
  • sandy ingram on 09 Nov 10
     
    "A new study released today found that companies running applications in the cloud can reduce their carbon emissions by 30 percent or more compared with running those same applications in their own infrastructure. The study, "Cloud Computing and Sustainability: The Environmental Benefits of Moving to the Cloud," was commissioned by Microsoft and conducted by Accenture, a global management consulting, technology consulting and technology outsourcing company, and WSP Environment & Energy, an environmental consulting group. "
sandy ingram

Smaller companies challenged to comply with Massachusetts' data privacy rules - Mass Hi... - 0 views

www.masshightech.com/...usetts-data-privacy-rules.html

compliance Privacy Security Massachusetts proofpoint

shared by sandy ingram on 10 Nov 10 - No Cached
  • The regulations, which went into force in March, are intended to protect a consumer’s personal information from identity theft and other privacy breaches and to spell out steps that businesses must take to ensure data is secured. Some large companies — particularly those in the finance and health care industries that are already subject to data security laws like the Health Insurance Portability and Accountability Act (HIPAA) — had privacy measures in place, which helped get them ready for Massachusetts’ regulations. However, for many smaller and midsize companies that have not been subject to data security laws before, complying with the rules is a longer and often more painful process.
  • some businesses that are complying with privacy regulations for the first time and have limited in-house technology expertise “are running around with their hair on fire, trying to figure out what to do first,”
  • “We’ve seen a substantial uptick in activity in clients seeking guidance in how to comply,” said Carlos Perez-Albuerne, a partner at Choate Hall & Stewart LLP. “There’s a whole swath of businesses that never had to deal with anything like this before.”
  • ...4 more annotations...
  • Under the regulations, organizations — no matter where they are based — that store personal information about Massachusetts residents have to write security policies detailing how the data will be protected, encrypt the data when it is stored on laptops or other portable devices or transmitted over public networks, and monitor their systems for breaches.
  • Believed to be among the most stringent data privacy regulations in the U.S., the rules have lawmakers and businesses taking note. The regulations are now driving computer security policy agendas across the country, said Mark Schreiber, a partner at Edwards Angell Palmer & Dodge who chairs the firm’s privacy and data protection group. “The impact is much broader than we ever imagined. Who would have thought it would have catalyzed so much activity?” he said. “This will be with us for decades or longer.”
  • Since March, Cutugno Court Reporting and Sten-Tel Inc., a Springfield-based firm that provides document management and transcription systems, has spent “easily into the six-figure realm” on technology and consulting services to comply with the privacy regulations, said Blake Martin, the company’s CIO.
  • To date, state regulators have not yet taken any public enforcement actions against organizations that have failed to comply with the rules. The state attorney general’s office, which is charged with enforcing the regulations, and the Office of Consumer Affairs and Business Regulation, which developed the regulations, have been focusing on compliance efforts, reaching out to trade groups, bar associations and others to spread the word.
  • sandy ingram on 10 Nov 10
     
    "Eight months after the state's tough, new data privacy regulations went into effect, many businesses are still sorting through the rules and working to bring their firms into compliance. "
sandy ingram

The Cloud's Green Advantage - Forbes.com - 0 views

www.forbes.com/...terprise-technology-cloud.html

Privacy Security cloud microsoft

shared by sandy ingram on 17 Nov 10 - No Cached
  • When small organizations (100 users) move to the cloud, the effective carbon footprint reduction could be up to a 90% savings by using a shared cloud environment instead of their own local servers
  • For large corporations, the savings are typically 30% or more. In a case study with a large consumer-goods company, the team calculated that 32% of energy use and resulting carbon emissions could be saved by moving 50,000 e-mail users in North America and Europe to Microsoft's equivalent cloud offering.
  • What accounts for these significant energy savings? Think of cloud computing as being like mass transit. The data center is essentially getting computing applications to carpool or take the bus instead of sitting in their own individual servers. However, unlike mass transit, there is no sacrifice in convenience or performance with this move. Consider the disappointing fact that a typical server in a company often runs at about 10% of capacity, meaning there are lots of servers out there drawing power without doing much computing
  • ...3 more annotations...
  • The economies of scale of cloud data centers allow much higher utilization of servers, dynamic provisioning to better match server capacity to demand, and multi-tenancy to serve thousands of organizations with one set of shared infrastructure.
  • The efficiency benefits of the cloud won't be realized unless customers are thoughtful about decommissioning or repurposing unused servers, and cloud providers like Microsoft continue to innovate in the name of greater and greater efficiency.
  • For companies with their own large-scale infrastructure, this study identifies the key drivers that will let them optimize for the greatest efficiency as well.
  • sandy ingram on 17 Nov 10
     
    "In his piece, "Cloud Computing Meets Energy Management," William Clifford makes important points about the need to optimize the efficiency of both cloud data centers and on-premise computing. However, a new study released this week challenges his assertion that cloud computing "just transfers the consumption problem to another location." The findings suggest instead that cloud computing can significantly reduce the overall net energy use of business computing needs."
sandy ingram

How a Pas5woRd Can Sink Your Company - NYTimes.com - 0 views

boss.blogs.nytimes.com/...pas5word-can-sink-your-company

Privacy Security password Best Practice

shared by sandy ingram on 28 Nov 10 - No Cached
  • Back in the 1990s fellow science and technology journalist Charles Mann and I wrote a book uncovering the true story of how a lone, young, cognitively impaired hacker with relatively few computer skills managed to perpetrate what was then the most extensive and scariest series of computer break-ins ever — government weapons labs, dam control systems and ATM networks were among the hundreds of networks compromised. At the end of the book, we predicted that no matter how much effort was poured into making the Internet safer, hackers would always be able to have a field day, partly for technical reasons but also because companies and individuals would never get it together to take simple precautions critical to safe computing.
  • Sadly, Mann and I called it right. Viruses, trojans and spyware are bigger problems than ever. Employees unwittingly but routinely hand over their passwords to hackers who break into corporate databases to steal credit card and other information of thousands of customers. Private e-mail is rifled through and made public, and companies have their computers incapacitated by “denial of service” attacks. You need to ask yourself: Could your company survive an encounter with a hacker?
  • Don’t count on even the best security software or services to protect you —
  • ...8 more annotations...
  • they’re always one step behind the latest hacking twist sweeping through networks. Even if you could afford to get a computer-security genius to come in and watch your company’s back 24 hours a day, he or she couldn’t fully protect you if you or any one of your employees were to slip up.
  • Everyone knows by now, I would think, that you shouldn’t use a password that’s easy to guess.  Hackers use automated programs that can find any password if it’s a word in the dictionary or a proper name, even if it’s spelled backwards.
  • But here’s the problem even tricky password users run into: Because we all need passwords for so many Web sites and accounts these days, people end up using the same password for many of them — or else write their passwords down somewhere. Both of these practices are disasters waiting to happen.
  • If you use the same password for many sites, all a hacker has to do is get your password at any one site — and some site out there somewhere is doing a lousy job of protecting your password — and he’s got it for all of your sites and accounts. So if a hacker or malicious employee at the place you buy shoelaces online lifts your password, he can get into your bank account and your company’s computers.
  • Here’s a better solution: Come up with a simple formula for generating passwords in your head that’s based on the name of the site or organization you’re signing up with. For example, you might take the name of the site (tractortires.com), drop everything but the first six characters to the left of the “dot” (tracto), reverse the first three letters (artcto), add the number “5″ after the third character and a capital “Z” at the end (art5ctoZ). By this formula, “plan9movie.net” gets the password “alp5n9mZ,” and “cellphone.org” yields “lec5lphZ.”
  • Make up your own formula, and don’t share it with anyone. It may sound a bit complicated, but after doing it a few times you’ll be able to do it in your sleep, and you’ll have a unique, impossible-to-guess password for every one of your accounts and sites without having to write anything down.
  • Every single one of your employees has to get with the program on this. If they’re writing passwords down, or using the same password everywhere, then they’re not just risking getting hacked at other sites, they’re also inviting hackers into any of your company’s computers or accounts to which they have password access.
  • So you might want to teach everyone in your company how to come up with his or her own in-your-head password-generating formula.
  • sandy ingram on 28 Nov 10
     
    "Back in the 1990s fellow science and technology journalist Charles Mann and I wrote a book uncovering the true story of how a lone, young, cognitively impaired hacker with relatively few computer skills managed to perpetrate what was then the most extensive and scariest series of computer break-ins ever - government weapons labs, dam control systems and ATM networks were among the hundreds of networks compromised. At the end of the book, we predicted that no matter how much effort was poured into making the Internet safer, hackers would always be able to have a field day, partly for technical reasons but also because companies and individuals would never get it together to take simple precautions critical to safe computing."
sandy ingram

5 Steps to Secure a Mobile Workforce #infosec #grc - 0 views

www.businessweek.com/...secure_a_mobile_workforce.html

mobile security Best Practice Privacy compliance cybersecurity

shared by sandy ingram on 30 Nov 10 - No Cached
  • Here are five steps your company can implement quickly and cost-effectively.
  • 1. Deploy comprehensive endpoint security to check endpoint devices for spyware and malware.
  • 2. Ensure that user devices adhere to defined corporate security policies before, during, and after network connection.
  • ...3 more annotations...
  • 3. Encrypt sensitive data and log file access to ensure that data is not compromised if a mobile device is lost or stolen.
  • 4. Automatically filter and delete SMS spam by setting up pre-defined, configurable settings on mobile devices.
  • 5. Restrict network access by noncompliant or potentially infected devices.
  • sandy ingram on 30 Nov 10
     
    "Some 2.8 million Americans now work permanently from home offices and a full 38 million (37 percent of the total U.S. workforce) telecommute at least once a month. For the most part, the mainstreaming of telecommuting and the arrival of the virtual or mobile office has been a positive development, both in terms of employee productivity and cost reduction. However, one of the challenges of the proliferating mobile workforce is for companies to ensure that their most-sensitive customer and corporate information is truly secure."
1 - 20 of 37 Next ›
Showing 20▼ items per page