Skip to main content

Home/ Groups/ WPPS C-Suite News
Rss Feed
Sort By: Most Recent | Popular Filter: All | Bookmarks | Topics Simple Middle
sandy ingram

Study Finds Companies Struggle to Measure Effectiveness of the Compliance Function - 0 views

www.pwc.com/...PwC-Compliance-Week.jhtml

Privacy security compliance survey

shared by sandy ingram on 24 May 11 - No Cached
  • Senior compliance officers at more than 100 leading U.S. companies responded to 28 questions in four key areas critical for the compliance function: leadership, reporting relationships and structure; compliance function scope, focus and risk; metrics to gauge program effectiveness; and budget, staffing and resources. A major finding of the study: One of the biggest obstacles facing Chief Compliance Officers (CCOs) is measuring the effectiveness of their compliance functions - almost 40 percent of the companies surveyed said they make no attempt to measure the effectiveness of their compliance program.
  • “An effective compliance program is the cornerstone of cooperation credit allowed under the U.S. Sentencing Guidelines and stakeholders are demanding much higher transparency in how compliance risk is effectively managed,” said Miles Everson, PwC principal and global and U.S. risk and compliance leader.
  • “Without a clear measure of the compliance department’s effectiveness, much else is in jeopardy. Lacking this,
  • ...8 more annotations...
  • how does the board know that compliance risks are effectively addressed?  Let alone that the compliance function itself is effective? 
  • According to the study, a critical element to the compliance department’s success is the perceived stature of the CCO and his or her influence among other top leadership.
  • “It’s essential that the compliance function have visibility and direct access both to senior executives in the organization and to the board or one of its committees,” added Everson. “This access helps keep risk and compliance issues on the company’s agenda and lets key ethics and compliance issues surface in a timely fashion.”
  • The State of Compliance survey also provided another interesting glimpse into corporate compliance when it asked about reporting structures. Regulators have long preferred that a company’s top compliance officer report directly to the board, and just last year the U.S. Sentencing Guidelines were revised to state more clearly that CCOs should not be, nor report to, the general counsel.
  • PwC and Compliance Week also found that, over the next 18 months, CCOs anticipate significant challenges when it comes to risk - and that when issues arise, they expect the consequences to be severe.
  • When asked about several high-level categories of risk, such as compliance risk, security risk, reputational risk and others, 48 percent believed the likelihood of a compliance failure was high or very high. 
  • What's more, 65 percent of respondents felt the impact of a compliance risk event, should it occur, would be high or very high. 
  • Effective compliance programs need input and guidance from many different voices in the company (IT, internal audit, finance, security). It is in the company’s benefit for the compliance department to borrow resources from those teams to achieve its goals, rather than build its own expertise in each department.
  • sandy ingram on 24 May 11
     
    "The results of The State of Compliance: 2011, an inaugural study conducted by PwC US and Compliance Week, will be released today at the Compliance Week 2011 6th Annual Conference for corporate financial, legal, risk, audit and compliance officers in Washington, D.C. The report - the first of its kind - identifies a wide range of compliance issues confronting organizations today and will stay current as new companies participate, accurately reflecting the changing compliance landscape."
sandy ingram

Infosecurity (USA) - White House cybersecurity proposal shifts FISMA responsibility to DHS - 0 views

www.infosecurity-us.com/...ts-fisma-responsibility-to-dhs

security Privacy compliance FISMA DHS Best Practice

shared by sandy ingram on 07 Jun 11 - No Cached
  • This would in effect shift FISMA implementation responsibility away from the Office of Management and Budget (OMB) and the National Institute for Standards and Technology (NIST) to DHS, “where the knowledge of attacks informs the defense”, Paller said.
  • “DHS has already demonstrated that they are focusing on the critical controls....They are focusing on effectiveness measures, rather than make work”
  • The proposal would also expand the DHS authority over cybersecurity of private networks, particularly critical infrastructure. DHS would have the authority to develop and conduct risk assessments of private sector critical infrastructure systems and share information with the private sector about threats and best practices.
  • ...5 more annotations...
  • “This brings the same rationality to offense informing defense. Instead of telling people that they have to have a good security plan, what DHS’s role will be is to demonstrate what best practices are and make sure people are measuring against those best practices”, Paller said.
  • The White House proposal would also create a national data breach notification requirement standardizing various state laws
  • “The administration's proposal would protect individuals by requiring businesses to notify consumers if personal information is compromised, and clarifies penalties for computer crimes including mandatory minimums for critical infrastructure intrusions.
  • The proposal would improve critical infrastructure protection by bolstering public-private partnerships with improved authority for the federal government to provide voluntary assistance to companies and increase information sharing.
  • It also would protect federal government networks by formalizing management roles, improving recruitment of cybersecurity professionals, and safeguarding the nation's access to cost-effective data storage solutions.”
  • sandy ingram on 07 Jun 11
     
    The White House proposal, which is a comprehensive cybersecurity plan, includes a provision directing the Department of Homeland Security (DHS) "to exercise primary responsibility within the executive branch for information security. This includes implementation of information security policies and directives and compliance" with FISMA, except for national security systems.
sandy ingram

Governance 101: Best practices for creating and managing team sites - SharePoint Online... - 0 views

office.microsoft.com/...ng-team-sites-HA102029533.aspx

Office365 governance best practices compliance

shared by sandy ingram on 24 Jun 11 - No Cached
  • sandy ingram on 24 Jun 11
     
    If you're a team site owner, it's a good idea to create a governance model to address your site's policies, processes, roles, and responsibilities.
sandy ingram

Tokenization & Compliance: Five Ways to Reduce Costs and Increase Data Security on Vimeo - 0 views

vimeo.com/23936052

compliance security encryption Tokenization video

shared by sandy ingram on 30 Aug 11 - No Cached
  • sandy ingram on 30 Aug 11
     
    A new service-based solution set now available from major players in the payments processing industry addresses many merchant concerns. End-to-end encryption (E2EE) combined with data tokenization provides enhanced security by protecting sensitive cardholder data from the point of capture through delivery to the payment processor, and by eliminating cardholder data from the merchant's environment post-authorization. With these two technologies in place, the data handled by a merchant is far less vulnerable in the event of a breach, simply because encrypted or tokenized data is useless to a thief.
sandy ingram

Cloud Concerns "Unfounded and Ridiculous" Former U.S. Chief Information Officer Vivek K... - 0 views

www.nytimes.com/...-budget-look-to-the-cloud.html

Cloud Computing security Privacy compliance Best Practice

shared by sandy ingram on 01 Sep 11 - No Cached
  • sandy ingram on 01 Sep 11
     
    When I joined the Obama administration as the chief information officer, we quickly discovered vast inefficiencies in the $80 billion federal I.T. budget. We also saw an opportunity to increase productivity and save costs by embracing the "cloud computing"
sandy ingram

Small Business Facts and Figures - 0 views

www.scribd.com/...all-Business-Facts-and-Figures

small business facts figures 2010 SBA U.S.

shared by sandy ingram on 19 Sep 11 - No Cached
  • sandy ingram on 19 Sep 11
     
    What is a small business? The Ofce of Advocacy denes a small business as an in- dependent business having fewer than 500 employees. (The denition of "small business" used in government programs and contracting varies by industry; seewww.sba.gov/size.)
sandy ingram

Mobile malware, "whaling" top challenges of 2011, says IBM report - SC Magazine US - 0 views

www.scmagazineus.com/...213219

security mobile malware IBM report

shared by sandy ingram on 30 Sep 11 - No Cached
  • To address these new challenges, the report said, enterprises need to shape their risk exposure, communication, end-user education and technology in a delicate balance.
  • One of the newest vectors of attack – the so-called “bring your own device” approach – has sprung up from the burgeoning market for smartphones and tablets and their adaption into the enterprise network, the report said. Security issues seen on the mobile platform are rising with the market – with double the number of mobile exploit releases that were seen in 2010.
  • Third-party app markets, a Wild West of often unregulated offerings, are the primary bazaar for malicious software created to attack mobile phones.
  • ...4 more annotations...
  • Infected mobile applications can also come from peer-to-peer networks hosted on websites
  • This year's breaches have highlighted the emerging risk of “whaling,” a variant of spear phishing that targets "big fish,” or high-level personnel
  • Of further concern for IT security professionals is the rise of professional teams charged with collecting intellectual property and strategic intelligence, the report found.
  • In addition, so-called hacktivist groups, such as LulzSec and Anonymous, have used well-worn attack techniques, such as SQL injection, to successfully target websites and computer networks for political ends rather than financial gain.
  • sandy ingram on 30 Sep 11
     
    An unprecedented number of successful attacks on corporate networks in the first half of the year illustrates that "basic network security is not just a technical problem, but rather a complex business challenge,"
sandy ingram

Data Breaches - Beyond the Impact of Fines - 0 views

www.infosecisland.com/...eyond-the-Impact-of-Fines.html

security compliance Breaches data impact

shared by sandy ingram on 30 Sep 11 - No Cached
  • A recent article in the Tech Journal (techjournalsouth.com) delves into the effects of data breaches, using survey information to demonstrate how they affect customer loyalty and confidence.
  • "The widespread impact of data breaches like Epsilon and Sony PlayStation, where millions of consumers were impacted around the world, is making customers more cautious about conducting business with certain financial institutions and retailers," said Jackie Gilbert, vice president of marketing and co-founder at SailPoint. "These companies obviously spent millions to recover from these data breaches, but the longer term and harder-to-measure costs will be the erosion of customer loyalty and decline in brand perception."
  • Case in point: 16% of Americans, 24% of Britons and 26% of Australians said they would no longer do business with a bank, credit card company or retailer if a security breach occurred that potentially exposed their personal and financial information to theft."
  • ...1 more annotation...
  • Although regulatory fines are painful, the loss of customers and business should really concern businesses.  Organizations and Infosec Professionals (CIO's, CISO's, etc.) would do well to take note of these results. 
  • sandy ingram on 30 Sep 11
     
    "The widespread impact of data breaches like Epsilon and Sony PlayStation, where millions of consumers were impacted around the world, is making customers more cautious about conducting business with certain financial institutions and retailers," said Jackie Gilbert, vice president of marketing and co-founder at SailPoint.
sandy ingram

What's a Company's Biggest Security Risk? You. - WSJ.com - 0 views

online.wsj.com/...4836104576556421692299218.html

Privacy security hack Insider Threat

shared by sandy ingram on 04 Oct 11 - No Cached
  • Consider what happened in March at EMC Corp.'s RSA security unit, the maker of computer login devices used by thousands of other companies. A hacker sent emails to two small groups of employees that looked innocent enough, including a spreadsheet titled "2011 Recruitment plan." The message was so convincing that one employee retrieved it from the "junk mail" folder and then opened the attachment. Doing so introduced a virus inside RSA's network that eventually gave the hacker access to sensitive company data and enabled later attacks against RSA's customers.
  • Employees have more opportunities than ever to compromise company information. We not only screw up by clicking on emails from hackers that download viruses, letting them bypass corporate firewalls. We also open a Pandora's Box of security problems by circumventing company tech-support rules and doing work with personal gadgets and consumer-grade online services like Web email and cloud storage services.
  • Here's a look at what employees are doing wrong and how companies are trying to fight our bad habits
  • ...3 more annotations...
  • Today, we make ourselves easy targets by posting troves of information about ourselves and our jobs online, say security experts. Blogs and professional networks such as LinkedIn are particularly useful sources for criminals, since many people share details about their roles at work, which can be used to help determine corporate hierarchies, among other things.
  • Hackers include dangerous traps in these targeted emails, such as links leading to malware or a Web page designed to dupe the employee into entering passwords. In the RSA attack, the emails included an attachment that took advantage of a previously unknown chink in Adobe Flash software to inject a virus into the company's systems.
  • As older systems that are focused on firewalls fail, corporate IT "needs a new defense doctrine," says RSA's head of identity protection, Uri Rivner. "You need to have security cover inside your organization, rather than your perimeter. You need to understand what your users are doing, and then spot any type of suspicious activity inside."
  • sandy ingram on 04 Oct 11
     
    Hacking attacks against companies are growing bigger and bolder-witness a string of high-profile breaches this year at Sony Corp., Citigroup Inc. and others. But gone are the days when hackers would simply find holes in corporate networks to steal valuable data. Large companies have grown wise to the threat of hacking, and have spent the past 30 years hardening the perimeters of their networks with upgraded technology.
sandy ingram

Is Internet Explorer 9 Now the Safest Web Browser? - 0 views

www.securitynewsdaily.com/orer-9-safest-web-browser-0730

ie9 safe brower chrome privacy security internet Best Practice

shared by sandy ingram on 06 Oct 11 - No Cached
  • sandy ingram on 06 Oct 11
     
    With criminals migrating to Chrome, Bott says Chrome's filters, and its entire approach to protecting users, isn't as airtight as IE9's - or even as secure as its advocates believe.
sandy ingram

Organisations fail to meet security awareness and compliance training best practices - ... - 0 views

www.scmagazineuk.com/...208893

SC organisations security awareness compliance best practices UK

shared by sandy ingram on 12 Oct 11 - No Cached
  • “If this assessment demonstrates anything, it's that IT and security departments have got to gain greater visibility over all of their security and compliance activities and take steps to better understand and manage them.”
  • sandy ingram on 12 Oct 11
     
    A survey of high-risk organisations has found that more than three quarters fail to perform quarterly security and compliance training. According to a survey by enterprise key and certificate management solutions provider Venafi and IT security research provider Echelon One, 77 per cent of respondents failed to perform quarterly security and compliance training while 64 per cent failed to encrypt all of its data in the cloud. However 90 per cent did use encryption throughout the organisation. The survey of 420 enterprises and government agencies also found that almost 100 per cent of respondents had some degree of unquantified or unmanaged risk. When asked if their organisations encrypted data stored in public clouds such as Google Apps, Salesforce.com and Dropbox, 40 per cent said they did not know.
sandy ingram

symantec state of security 2011 survey - 0 views

www.symantec.com/...ymc_state_of_security_2011.pdf

symantec awareness survey Best Practice

shared by sandy ingram on 12 Oct 11 - No Cached
  • sandy ingram on 12 Oct 11
     
    classifying confidential, sensitive information, knowing where it resides, who has access to it, and how it is coming in or leaving your organization . 
sandy ingram

Managing Cloud Risks - Forbes - 0 views

www.forbes.com/...managing-cloud-risks

security privacy compliance Best Practice cybersecurity cloud GRC

shared by sandy ingram on 27 Oct 11 - No Cached
  • SLAs and the “Right to Audit” Clause When you move your data to the cloud, you must consider the risk to your brand should a breach occur. You need to ensure that any Service Level Agreements (SLAs) you have in place protect it. SLAs should address any and all risks to your data while it lives in the cloud. 
  • sandy ingram on 27 Oct 11
     
    Vendor Risk Management and Cloud Security Standards Another important consideration when mapping out your cloud GRC strategy is to ensure your vendor risk management program accounts for the new risks that come with moving to the cloud.
sandy ingram

Courts Says Employer's Lawsuit Against Ex-Employee Over Retention and Use of Twitter Ac... - 0 views

blog.ericgoldman.org/...california_cour.htm

Best Practice employees social media account

shared by sandy ingram on 10 Nov 11 - No Cached
  • The takeaway is to have a written agreement that governs this issue!
  • PhoneDog said it suffered $340,000 in damages. The account had 17,000 followers, "which according to industry standards, are each valued at $2.50."
sandy ingram

Facebook Timeline Violates FTC Settlement, Says One Privacy Group | WebProNews - 0 views

www.webpronews.com/says-one-privacy-group-2012-01

facebook timeline settlement ftc privacy group

shared by sandy ingram on 06 Jan 12 - No Cached
  • Having just reached a settlement with the Commission in which the company is required “to take several steps to make sure it lives up to its promise in the future, including giving consumers clear and prominent notice and obtaining consumers’ express consent before their information is shared beyond the privacy settings they have established,” Facebook is changing the privacy setting of its users in a way that gives the company far greater ability to disclose their personal information than in the past. With Timeline, Facebook has once again taken control over the user’s data from the user and has now made information that was essentially archived and inaccessible widely available without the consent of the user.
  • The impetus is on the user to edit their privacy settings in order to tweak their Timeline to only show stuff that they want it to show.
  • EPIC goes on to argue that since Timeline contains new categories like “Health and Wellness,” it is ripe to be used by companies mining for medical data
  • ...1 more annotation...
  • They argue that the Timeline makes it “a heck of a lot easier for computer criminals to unearth personal details that can be used to craft attacks.”
  • sandy ingram on 06 Jan 12
     
    The settlement said that Facebook must be more forthright with its members and make sure that any changes that they make concerning privacy must be clearly and prominently spelled out.
sandy ingram

Ponemon Study: 73% Believe Cloud Providers Do Not Protect User's Confidential Informati... - 0 views

www.infolawgroup.com/...users-confidential-information

ponemon study Privacy security cloud cybersecurity

shared by sandy ingram on 14 May 11 - No Cached
  • Growing scrutiny of cloud computing security in the first half of this year is not surprising in light of the numerous data breaches, privacy issues and headline grabbing cloud outages that have occurred recently
  • The 26-page survey report returned a stunning conclusion – though one not surprising to those familiar with legal contracting for cloud computing; namely that a majority of cloud providers do not believe data security is their responsibility - but the customer’s. 
  • In addition, the survey revealed that a “majority of cloud computing providers surveyed do not believe their organization views the security of their cloud services as a competitive advantage.
  • ...7 more annotations...
  • Further, they do not consider cloud computing security as one of their most important responsibilities and do not believe their products or services substantially protect and secure the confidential or sensitive information of their customers.”
  • The study further reports that the majority of cloud providers surveyed “admit they do not have dedicated security personnel to oversee the security of cloud applications, infrastructure or platforms.”
  • One bit of somewhat good news the survey revealed is that “about one-third of the cloud providers in our study are considering such solutions [providing additional security] as a new source of revenue sometime in the next two years.”
  • Another of the report’s conclusion is that “the focus on cost and speed and not on security or data protection [in cloud offerings] creates a security hole.” This potential “security hole” is a prime reason we advise clients, in certain circumstances, to be prepared to walk away from cloud providers under consideration if adequate and legally defensible security measures cannot be adequately negotiated and contractually provided for.
  • The report also states that “cloud providers are least confident about the following security requirements: Identify and authenticate users before granting access Secure vendor relationships before sharing information assets Prevent or curtail external attacks Encrypt sensitive or confidential information assets whenever feasible Determine the root cause of cyber attacks
  • These are serious security concerns any way you slice it
  • The fundamental takeaway from the Ponemon study is that cloud security is very much a work in progress, and that any cloud initiative or plan for corporate cloud usage needs serious due diligence by representatives from business, IT and legal working in conjunction
  • sandy ingram on 14 May 11
     
    Growing scrutiny of cloud computing security in the first half of this year is not surprising in light of the numerous data breaches, privacy issues and headline grabbing cloud outages that have occurred recently.
sandy ingram

Information governance policy issue: Who owns a governance program? - 0 views

searchcontentmanagement.techtarget.com/...-Who-owns-a-governance-program

Privacy security governance Best Practice

shared by sandy ingram on 23 Apr 11 - No Cached
  • sandy ingram on 23 Apr 11
     
    "In risk-averse or highly litigious companies, the legal department should own the information governance program, but they should hire an information management person at a high level,"
sandy ingram

Cracking Down on ID Theft: A Case for Cloud Computing - 0 views

www.healthcareinfosecurity.com/articles.php

Privacy security compliance Best Practice PCI-DSS HIPPA Red Flags Rule

shared by sandy ingram on 01 Apr 11 - No Cached
  • The PCI Security Standards Council created the criteria, but the five leading credit card companies each maintain their own compliance and enforcement programs
  • and each has its own way to validate compliance.
  • In many cases, banks or merchant service providers are now sending letters to organizations that have smaller payment card transaction levels and asking them to prove they are compliant by completing a self-assessment questionnaire,
  • ...4 more annotations...
  • If an organization can meet all of the requirements of PCI, it's going to be in great shape when it comes to HIPAA security compliance,"
  • The PCI standard applies only to those systems and applications used for storage, processing or transmission of cardholder data,
  • any organization that accepts credit and/or debit cards must comply with the Payment Card Industry Data Security Standard, but many hospitals and clinics have overlooked this obligation, says security expert Tom Walsh
  • Red Flags Compliance
  • sandy ingram on 01 Apr 11
     
    In many cases, banks or merchant service providers are now sending letters to organizations that have smaller payment card transaction levels and asking them to prove they are compliant by completing a self-assessment questionnaire, he explains.
sandy ingram

Security awareness: Helping employees really 'get' company policy - CSO Online - Securi... - 0 views

www.csoonline.com/...yees-really-get-company-policy

security awareness Privacy Best Practice employees training

shared by sandy ingram on 30 Nov 10 - Cached
  • Employee awareness of their companies' security policies is high—if you ask the employees. In a survey of 2,000 office workers, software security company Clearswift found almost three quarters, 74 percent, felt 'confident' that they understand their employers' Internet security policies. That is, policy designed to safeguard data and IT security, as well as maintain productivity.
  • But the confidence is misplaced, Clearswift suggests in their summary of the findings, because a third of those surveyed have not received any training on IT security since joining their firm. And more than two thirds of those who have not had recent training joined their organization more than five years ago—a 'technological lifetime,' notes Clearswift.
  • "When security is kept in the shadows and not discussed openly, and only referred to when things go wrong, it is all too easy for office 'folk-law' to become perceived as official policy very quickly. If employees are not aware of when they have broken policies—in some cases because the policy is not even enforced—it can lead to a false sense of security or a belief that what they are doing is actually in line with the corporate policy."
  • ...1 more annotation...
  • The research raises a question that is frequently discussed, but very rarely measured, among organizations: What kind of awareness training is effective? Is it regular and incremental? Is it most effective when done through courses, formal sessions or informal discussions? And how does an organization gauge its effectiveness?
  • sandy ingram on 30 Nov 10
     
    "Research finds while most employees believe they understand their company's security policies, a large number have never received any formal policy education or training. How can an organization really ensure people understand risk?"
sandy ingram

5 Steps to Secure a Mobile Workforce #infosec #grc - 0 views

www.businessweek.com/...secure_a_mobile_workforce.html

mobile security Best Practice Privacy compliance cybersecurity

shared by sandy ingram on 30 Nov 10 - No Cached
  • Here are five steps your company can implement quickly and cost-effectively.
  • 1. Deploy comprehensive endpoint security to check endpoint devices for spyware and malware.
  • 2. Ensure that user devices adhere to defined corporate security policies before, during, and after network connection.
  • ...3 more annotations...
  • 3. Encrypt sensitive data and log file access to ensure that data is not compromised if a mobile device is lost or stolen.
  • 4. Automatically filter and delete SMS spam by setting up pre-defined, configurable settings on mobile devices.
  • 5. Restrict network access by noncompliant or potentially infected devices.
  • sandy ingram on 30 Nov 10
     
    "Some 2.8 million Americans now work permanently from home offices and a full 38 million (37 percent of the total U.S. workforce) telecommute at least once a month. For the most part, the mainstreaming of telecommuting and the arrival of the virtual or mobile office has been a positive development, both in terms of employee productivity and cost reduction. However, one of the challenges of the proliferating mobile workforce is for companies to ensure that their most-sensitive customer and corporate information is truly secure."
« First ‹ Previous 41 - 60 Next › Last »
Showing 20▼ items per page