Breach announcements / Cybersecurity

When is a breach notification not a breach notification (revisited)?

When it’s a customer service announcement.   At least that’s what one in-flight internet on demand service provider claimed. So, the first thing to understand is that there is no reason to believe that customer information was actually compromised.  On the other hand, as Bruce Schneier points out in Liars and Outliers, society runs on trust … Continue reading

Being an InfoSec Professional / Cybersecurity / Privacy

Security and Privacy walk into a bar…

There can be no question that Security and Privacy are strongly related.  It would be easier if they were the same thing.  But they’re not, of course; there are differences.   This blog has never shied away from stating the obvious. This post tries to enumerate the significant differences between privacy and security: I.                    They come … Continue reading

Being an InfoSec Professional / Cybersecurity

In Defense of Compliance

We read it everywhere: “compliance is not enough”.  “Security must be more than compliance.”  Granted.  When the phrase “checking the box” only means working from a compliance checklist and never looking at how your servers are configured, you are vulnerable. When security professionals point this out, they are responding to the well intentioned attitude of … Continue reading

Being an InfoSec Professional / Cybersecurity

The Winter of our discontent

Can information security professionals be satisfied? Ever?  Yes.  But should they be?  Ever wonder if Advanced Persistent Threats came into the world in part because the information security profession became more and more predictable?   Or worse: commoditized, as I will discuss below. Lately, as corporate web sites from multiple industries in virtually every continent are … Continue reading

Breach announcements / Cybersecurity

Raising the stakes by lowering them

The HIPAA Security Rule’s most significant flaw was on display recently.   Hospice of Northern Idaho (HONI) has settled with the Federal Government for $50,000 to close out the case of  a stolen unencrypted laptop that had the electronic protected health information of 441 patients on it.  Media attention focused on the fact that this was the … Continue reading