FTC Planning to Conduct a Wide-Range Study on Identity Theft Victims

As highlighted in this recent article (called “FTC recruiting identity theft victims”), FTC is planning to conduct a wide-range study on identity theft victims:

“In an effort to buttress its enforcement and better understand the scourge that is identity theft, the Federal Trade Commission said today its plans to conduct a wide-ranging study of victims of the crime.

The FTC is looking for people harmed by the crime and said the survey will examine the remedies available to victims under the Fair and Accurate Credit Transactions Act of 2003 (FACT Act). Among other things, the FACT Act gave consumers the right to place fraud alerts on their credit files if they are, or suspect they may become, victims of identity theft; block information on their credit reports that resulted from identity theft; and obtain copies of their credit reports free of charge.”

More details are in the article mentioned above, including the URL of the FTC survey site (NOTE: at the moment of writing I tried to connect to this site but it does not work …).

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

Identity Thefts, The US FACT Act and Red Flag rules …

How may of you were aware of the fact that US Financial institutions face a mandatory deadline of November 1, 2008 to comply with 3 new US Fair and Accurate Credit Transactions Act (FACT Act) regulations referred to as the Red Flag rules?

As explained (in a nutshell) in this wikipedia page, these are 3 new regulations:

• “One that requires financial institutions or creditors to develop and implement an Identity Theft Prevention Program in connection with both new and existing accounts. The Program must include reasonable policies and procedures for detecting, preventing, and mitigating identity theft;
• Another that requires users of consumer reports to respond to Notices of Address Discrepancies that they receive;
• A third that places special requirements on issuers of debit or credit cards to assess the validity of a change of address if they receive notification of a change of address for a consumer’s debit or credit card account and, within a short period of time afterward they receive a request for an additional or replacement card for the same account.”

I wonder how much these new measures will be effective in mitigating the risks of identity thefts …

--- NOTE: my original HP blog can be found here ---

Webinar (17 January 2008, 3:00 PM, GMT) – “Internal Threats to Your Data. From erring employees to malicious infiltrators - how do you protect ...?"

I received an email from Elsevier/InfoSecurity advertising a public webinar, called “Internal Threats to Your Data. From erring employees to malicious infiltrators - how do you protect against the unknown?”.

I think this might be of interest to this community (due to its identity and privacy implications):

“Database attacks have long been associated with the problem of external hackers, who, whilst searching for vulnerabilities in an organisation's IT resource and often using SQL injection techniques, seek to steal data for their own - or third party - malicious usage. Recently, however, the number of security breaches occurring in the public and private sector, has raised the topic to the top of the list as far as board level management is concerned. The risks involved are many, ranging from employees stealing confidential data for personal gain, right through to a lack of corporate governance and policies allowing staff access to information they should not normally have access to in their day-to-day duties. …

This webinar will:

• Give clear insight in to the complex and changing nature of insider threats, with a look at original research
• Show how accidental misuse can lead to disastrous consequences
• Offer proven strategies to secure your data, including practical advice on how to determine what is normal behaviour and what is an abuse of privilege
• Explain what to look for in an employee's abuse of privilege”

The webinar is free and it is going to take place on Thursday, January 17th at 3:00 PM (GMT). Attendees are requested to register online. Of course, read the Webcast Registration Policy …

Apparently, CISSPs and SSCPs will receive 1 CPE credit for attending this webinar.

--- NOTE: my original HP blog can be found here ---