Scott Wright’s Security Views

With the decreasing cost of electronics and media these days, we tend to go for new items rather than maintain the old. But just because we have a new device for short or long term storage doesn’t mean we can carelessly toss the old one aside.

Have a look around your office for used diskettes, recordable CD’s and memory cards. How many of them have labels indicating what’s on them? I’ll bet that maybe some of the CDs have chicken scratched labels. Also, does anyone in your organization use MP3 or digital cameras to tranfer files between your network and laptops or other networks?

Continue Reading »

My apologies to readers of my newsletter, The Practical Security News (click HERE to subscribe). In the inaugural issue, I made mention of the disclosure laws that are growing in popularity (though still not apparently imminent in Canada). Based on what I could interpret from TJX’s financial statements on their Web site (HERE), I conservatively estimated a $4 Million loss they had taken to date (as a result of their information system breach affecting Winners and TJ Maxx retail customers). I was wrong.

The Wall Street Journal is reporting HERE, and I just confirmed at the site I linked to above, that they announced (on August 14) a charge of $118 Million for “estimated potential liability” from the breach. (No, that’s not a big purchase of red ties on credit by Donald Trump, it’s a write-off on their financial statements, which directly affects share price.)

This post marks the formal introduction of my newsletter, The Practical Security News ™.

While the format and content may evolve, the inaugural issue has articles addressing timely issues for Executives, Managers and Office Staff, Home Computer Users and Security Professionals.  Continue Reading »

Internal policies aren’t the only source of rules that must be followed when protecting information. Every time you initiate a relationship with another entity, there are potential risks on both sides that should be formally addressed.

Formalizing responsibility for security is especially important in outsourcing relationships with partners, clients or suppliers.

Continue Reading »

As anyone who has spoken to a security professional probably knows, “Layered Security” is a must, since no single safeguard can be expected to cover all potential types of threats. There are a lot of ways to build layers into an environment.  But a sensible thing to do is pick layers that use different approaches and have overlapping coverage.

For example, to prevent insider threats from being successful, you might use a deterrent safeguard such as “login banners” that warn of the employee’s responsibilities to adhere to an acceptable use policy, where violations may result in dismissal.

Continue Reading »

It seems that so many media reports of breaches have the obligatory statement “…There is no evidence that the lost Personally Identifiable Information (PII) was misused in any way.”

In this case (HERE), and originally reported HERE, the PII of Medicaid clients was certainly bought and sold. There is no mention of whether the data was “actually” used for fraudulent transactions or impersonations. The individual who was charged was apparently a new employee who had passed security screening. The employee resigned before the breach was communicated to the IT outsourcing company where she worked. The PII of 500 individuals was sold for $5,000. Continue Reading »

Security awareness training may seem like a good place to start a security program, and it can be. But to get the full benefit you should make sure it can be tailored to your needs.

No training program in any discipline is likely to provide much more than a break for employees and exposure to terminology if it isn’t put in the context of an individual’s roles and responsibilities. Continue Reading »