It’s big news that RSA’s infrastructure around their SecureID solution has been compromised. While information around this attack and its impact on customers is lacking (RSA is citing an ongoing investigation as a reason to limit public disclosure) a couple of lessons about general security management can be learned. The first lesson is around vendor management.  As a security assessment company, we get to hear a lot of people at organizations around the world describe their state of security. One … →

Here we discuss the need for, and an approach for developing, a structured Business Associate oversight program for data security risk management. HIPAA and the HITECH Act have highlighted the importance of Business Associate (BA) security. Covered Entities (CEs) need to effectively manage Business Associates security risk, and BAs need to understand their compliance requirements and liability under HIPAA and HITECH regarding protecting protected health information (PHI). The entire supply chain of PHI from CEs to BAs to BA subcontractors … →

It’s always educational to review a data security breach to see what can be learned. In the case of the Charleston Area Medical Center (CAMC) last month a number of lessons can be learned. First lets review what we know (and don’t know) about the data breach which happened at CAMC subsidiary CAMC Health Education Research Institute (CHERI). What Happened It was a pretty straight forward breach. Last month someone doing an online search for an address found that the … →