As highlighted in this article, you might be interest in knowing that the European Commission has set an Advisory Panel, including executives from Google and Intel, to help revising the European Union laws on Data Protection:
"The aim of the group is to identify issues and challenges raised by new technologies. We are not reviewing the main data protection laws at present, but this could be a first step," said European Commission spokesman Michele Cercone. He added that the executives were chosen in a private capacity, rather than as representatives of their companies."
--- NOTE: my original HP blog can be found here ---
Showing posts with label data protection. Show all posts
Showing posts with label data protection. Show all posts
Thursday, December 11, 2008
Thursday, February 28, 2008
Lost mobile devices account for most UK data leaks …
This is what is reported by a recent NetworkWorld article, based on the findings of a Ponemon Survey:
“The average cost of a data breach is £47 ($94) per compromised record, according to a path breaking survey from the Ponemon Institute.
For security blunders in the financial services sector, that cost rises to £55 per compromised record.
Lost or stolen laptops and mobile devices account for most data breaches in the U.K., according to the research … Thirty six per cent of data breaches resulted from lost and stolen laptops or other mobile devices.”
This says a lot about current practices, in terms of storing data and protecting it. The remaining part of the article provides additional details on the impact this has on businesses and end users.
--- NOTE: my original HP blog can be found here ---
“The average cost of a data breach is £47 ($94) per compromised record, according to a path breaking survey from the Ponemon Institute.
For security blunders in the financial services sector, that cost rises to £55 per compromised record.
Lost or stolen laptops and mobile devices account for most data breaches in the U.K., according to the research … Thirty six per cent of data breaches resulted from lost and stolen laptops or other mobile devices.”
This says a lot about current practices, in terms of storing data and protecting it. The remaining part of the article provides additional details on the impact this has on businesses and end users.
--- NOTE: my original HP blog can be found here ---
Wednesday, January 16, 2008
Webinar (17 January 2008, 3:00 PM, GMT) – “Internal Threats to Your Data. From erring employees to malicious infiltrators - how do you protect ...?"
I received an email from Elsevier/InfoSecurity advertising a public webinar, called “Internal Threats to Your Data. From erring employees to malicious infiltrators - how do you protect against the unknown?”.
I think this might be of interest to this community (due to its identity and privacy implications):
“Database attacks have long been associated with the problem of external hackers, who, whilst searching for vulnerabilities in an organisation's IT resource and often using SQL injection techniques, seek to steal data for their own - or third party - malicious usage. Recently, however, the number of security breaches occurring in the public and private sector, has raised the topic to the top of the list as far as board level management is concerned. The risks involved are many, ranging from employees stealing confidential data for personal gain, right through to a lack of corporate governance and policies allowing staff access to information they should not normally have access to in their day-to-day duties. …
This webinar will:
I think this might be of interest to this community (due to its identity and privacy implications):
“Database attacks have long been associated with the problem of external hackers, who, whilst searching for vulnerabilities in an organisation's IT resource and often using SQL injection techniques, seek to steal data for their own - or third party - malicious usage. Recently, however, the number of security breaches occurring in the public and private sector, has raised the topic to the top of the list as far as board level management is concerned. The risks involved are many, ranging from employees stealing confidential data for personal gain, right through to a lack of corporate governance and policies allowing staff access to information they should not normally have access to in their day-to-day duties. …
This webinar will:
- Give clear insight in to the complex and changing nature of insider threats, with a look at original research
- Show how accidental misuse can lead to disastrous consequences
- Offer proven strategies to secure your data, including practical advice on how to determine what is normal behaviour and what is an abuse of privilege
- Explain what to look for in an employee's abuse of privilege”
The webinar is free and it is going to take place on Thursday, January 17th at 3:00 PM (GMT). Attendees are requested to register online. Of course, read the Webcast Registration Policy …
Apparently, CISSPs and SSCPs will receive 1 CPE credit for attending this webinar.
Monday, January 7, 2008
Report – Enterprise@Risk: 2007 Privacy and Data Protection Survey
A recent report, called “2007 Privacy and Data Protection Survey” (available online), has been released by Deloitte:
“The survey results indicate an increasing understanding within the organization of what is required to address the risks of managing and protecting private data. However, it also demonstrates that the challenge remains for the enterprise privacy function to move from the current reactive mode to a more proactive and strategic approach.”
This survey describes key findings in these areas:
--- NOTE: my original HP blog can be found here ---
“The survey results indicate an increasing understanding within the organization of what is required to address the risks of managing and protecting private data. However, it also demonstrates that the challenge remains for the enterprise privacy function to move from the current reactive mode to a more proactive and strategic approach.”
This survey describes key findings in these areas:
- Privacy Incidents and Breaches requiring notification
- Incident Response – time allocation
- Incident Response – notification
- Privacy Programs – implementation
- Privacy Function – reporting structure
- Privacy Function – resource allocation
- Enterprise Training
- Technology Solutions
- Encryption Technologies
- Professional Profiles
--- NOTE: my original HP blog can be found here ---
Monday, October 8, 2007
Call for Papers: 23rd International Information Security Conference – SEC 2008
The Call for Papers for SEC 2008 (Milan, Italy – September, 8-10, 2008), is now available online:
“The conference seeks submissions from academia, industry, and government presenting novel research on all theoretical and practical aspects of computer security, as well as case studies and implementation experiences. Papers should have practical relevance to the construction, evaluation, application, or operation of secure systems. Theoretical papers must make convincing argument for the practical significance of the results.”
In particular, topics of relevance include topics in the “Identity Management” area:
--- NOTE: my original HP blog can be found here ---
“The conference seeks submissions from academia, industry, and government presenting novel research on all theoretical and practical aspects of computer security, as well as case studies and implementation experiences. Papers should have practical relevance to the construction, evaluation, application, or operation of secure systems. Theoretical papers must make convincing argument for the practical significance of the results.”
In particular, topics of relevance include topics in the “Identity Management” area:
- Access control
- Electronic frauds
- Anonymity
- Accounting and Audit
- Smartcards
- Data and application security
- Risk analysis and risk management
- Data protection
- Privacy-enhancing technology
- Trust management
- Trust models
--- NOTE: my original HP blog can be found here ---
Wednesday, September 26, 2007
On Security Experts pitching “Culture of Data” …
I’ve found this article by Matt Hines, called “Security experts pitch culture of data” quite interesting:
“The companies that are having the most success in advancing their data security efforts today are those that are finding a way to protect sensitive information without getting in the way of business users, industry experts maintain.
In crafting their data-handling policies and selecting from the multitude of security technologies at their fingertips, those businesses that can foster both ready access to information, along with strong defenses for end-users and IT systems, are making progress the fastest, claim leading vendors and service providers.
After years of "throwing technologies" at the data security problem while juggling complex business demands along with external threats and regulatory compliance audits, some businesses are finally discovering that they can simplify the entire process by taking a more comprehensive approach to tailoring their programs to the manner in which their users access, handle, and share information. …”
It would also be interesting getting some concrete examples, e.g. how this could be achieved for identity data, where related policies dictate goals and expectations from (sometimes contradictory) business, security and privacy perspectives.
--- NOTE: my original HP blog can be found here ---
“The companies that are having the most success in advancing their data security efforts today are those that are finding a way to protect sensitive information without getting in the way of business users, industry experts maintain.
In crafting their data-handling policies and selecting from the multitude of security technologies at their fingertips, those businesses that can foster both ready access to information, along with strong defenses for end-users and IT systems, are making progress the fastest, claim leading vendors and service providers.
After years of "throwing technologies" at the data security problem while juggling complex business demands along with external threats and regulatory compliance audits, some businesses are finally discovering that they can simplify the entire process by taking a more comprehensive approach to tailoring their programs to the manner in which their users access, handle, and share information. …”
It would also be interesting getting some concrete examples, e.g. how this could be achieved for identity data, where related policies dictate goals and expectations from (sometimes contradictory) business, security and privacy perspectives.
--- NOTE: my original HP blog can be found here ---
Subscribe to:
Posts (Atom)