By Gale Yocom

In today’s’ high tech world, maintaining the privacy and protection of customers and employees’ information grows more and more difficult particularly for many financial institutions. These days’ scammers are getting bolder and more brazen in their abilities to get personal information from banking customers as they aggressively target the smaller locally owned community financial institutions. In fact, a recent customer reported a complex, malicious, and targeted attack took place on their institution’s customers and employees. A well-recognized phishing activity trends website reported that financial institutions saw a continuing rise in phishing activities with 92.5% of attacks targeted on financial institutions. On average, a phishing site stays online for 3.8 days. The relevance to the number of days online is that the longer it remains online, the more possibilities for the scammer to gather personal information. It is imperative that we Read the rest of this entry »

There’s an interesting section in the Wikipedia entry for Acceptable Use Policies called “Is an AUP the best approach?” here.

Here’s an excerpt:

In a well respected essay on the topic of AUP documents, Dave Kinnaman, raises the issue as to whether writing and enforcing AUP documents is the right way to approach the governance as to how Internet connections are to be used at school, at work or in people’s own free time.

In this essay he raises the question with the perspective that the Internet is no different from anywhere we use 3rd party property. Do we write a “users guide” to go to a school, or do we write a user’s guide to shopping in the shopping mall? No, and why we do not is because we are educating young adults to behave in certain ways when at the shopping mall, or at school, or in the library.

Businesses should have a good AUP document that, according to visionGateway, a business implementing secure networks for businesses, should cover the business legally in any situation that the business might need to take to protect its interests. Also privacy and individual rights need to be addressed.

So the question is, do we teach our students at school and encourage our employees at work to maintain self-control, or do we explicitly outline acceptable use policies? Possibly both AUPs and self-control can be encouraged and when used together it could bring the best outcome for both organisations and individuals.

I think it’s an interesting question, but in the end your auditors are going to ask for your AUP. If you don’t have one they’ll probably tell you to get one.

What do you think?

I really like the easy-to-read-and-understand customer data security policy from ING Direct here.

I wish more companies wrote such simple and clear policies.

Here’s an exerpt:

We take every reasonable precaution to protect your information. When you submit information to us through our web site, your information is protected both on-line and off-line. All data transferred to/from the ING DIRECT internal network, from/to an external entity, is encrypted to industry standards (128 bit encryption). Please keep in mind that messages you send to us by Internet e-mail may not be secure. Do not send us any confidential or personal information by Internet e-mail. We maintain appropriate physical, electronic and procedural safeguards to ensure the security, integrity and privacy of your personal information within our company. Only those employees who require your personal information to perform a specific job are granted access to your personally identifiable financial information. Furthermore, all employees are kept up-to-date on our security and privacy practices. If you have any questions about the security of your information at ING DIRECT, you may contact us at 1-800-ING-DIRECT (1-800-464-3473), or at the following address: ING DIRECT, 1 South Orange Street, Wilmington, Delaware 19801.

I found a great presentation called “Best Practices in Corporate Privacy & Information Security” by Donald Cohn at the infolaw.org site here.

Donald covers lots of security policies starting on slide 22.

These are the policies he lists under Information Classification & Protection:

• Information Classification & Protection
  • Information Classification
  • Information Retention
  • Anti-Virus Software
  • Application/Software Development
  • Information Disposal
  • Apply “Right to Know” Principle
  • Back-ups
  • Encryption
  • Fax Transmissions
  • Use of Copiers & Area Printers
  • Company Developed Software Ownership
  • Vulnerability Migration
  • Equipment Inventory

Check it out!

If you’re planning on deploying Windows Vista, make sure you follow the Windows Vista Security Guide available from Microsoft Technet here.

This is a description of the hardening guide:

This guide focuses on how to help create and maintain a secure environment for desktop and laptop computers that run Windows Vista. The guide explains the different stages of how to secure two different environments, and what each security setting addresses for the desktop and laptop computers deployed in either one. The guide provides prescriptive information and security recommendations.

Here are the chapters:

Chapter 1: Implementing the Security Baseline
Chapter 2: Defend Against Malware
Chapter 3: Protect Sensitive Data
Chapter 4: Application Compatibility
Chapter 5: Specialized Security – Limited Functionality
Appendix A: Security Group Policy Settings

Don’t install Vista without it!

The Laptop Security Blog over at www.absolute.com has an interesting post about how the Auditor General of Canada says government agencies aren’t upholding the Government Security Policy (GSP).

In particular, the Auditor General said that the security policy doesn’t include a disaster recovery plan.

Even if you work in a company you can expect that auditors are going to look for a disaster recovery policy and disaster recovery plan in your corporate security policy.

Here’s a fun security training video that could be useful to explain the value of security policies and security concepts like defense in depth:

I like how it incorporates Second Life as a training tool. 

The educause.edu site has a chapter from the book Computer and Network Security in Higher Education here.

It does a good job of describing how university security policies should be written.

Here’s an excerpt:

If the goal of institutional policies is to direct individual behavior and guide institutional decisions, then the effectiveness of formal policy statements will depend on their readability and usefulness. Many colleges and universities suffer from the lack of a common and consistent approach or format for writing organizational policies. Policy development is often confused and sometimes derailed because of the misunderstanding and misuse of terms with important meanings to a professional policy administrator, legal counsel, and others.

You can download an archive copy of the chapter here.

This is a great site to find a ton of actual security policies and procedures used by universities.

Here’s a sample of some of the university policies available:

• Data Handling and Storage Policy (Adams State College)
• Secure Handling of Social Security Numbers (Northwestern University)
• Data Access, Security, Classification and Handling (Purdue University)
• The Payment Card Industry (PCI) Data Security Standard (Duke University)
• Information Access & Protection Standard (Rochester Institute of Tecnology)
• Data Classification Security Policy (George Washington University)

Lots of helpful security policy templates for you to use. Check it out!

The IT Security group at the California Department of Techonology Services (DTS) have a security incident response presentation here that describes their incident response plan.

This presentation includes a couple of scenarios where they demonstrate how to implement the Security Incident Lifecycle:

• Security Incident Identification
• Security Incident Triage
• Security Incident Response & Resolution
• Security Incident Communication (concurrent)
• Post Security Incident Documentation

Great info!