May 9th, 2008 by Stacy Shelley
Posted in Links |
May 5th, 2008 by Stacy Shelley
Posted in Links |
April 25th, 2008 by Stacy Shelley
Posted in General |
April 18th, 2008 by Yushau Sodiq
Posted in Links |
April 11th, 2008 by Stacy Shelley
Posted in General, Links |
April 4th, 2008 by Stacy Shelley
Posted in General |
March 28th, 2008 by Stacy Shelley
Posted in General |
March 24th, 2008 by Matt Anthony
A major data breach was announced this week, with Hannaford Brothers grocery chain disclosing a large loss of protected credit card information. Details are sketchy and in some cases conflicting. But, the discussion online has raised some interesting questions about PCI. Rich Mogull, former Gartner Security analyst and blogger at securosis.com, takes a look at what might have happened and asks the question is PCI worthless. Both discussions are worth checking out – the first as an exploration of the actual breach and whether PCI helped and the second as a more in-depth look at whether PCI is improving things or just consuming resources. Avivah Litan and John Pescatore at Gartner have also weighed in with implications for enterprises.
I also talked to Ted Keniston, one of our Professional Services compliance gurus and a PCI Qualified Security Assessor (QSA). He recommended a few recent blog postings and sites to check out when keeping up with the regs:
PCI Blog- Compliance Demystified as the leading reference site.
These three postings at PCI DSS News and Information cover these ten PCI myths:
10. PCI only applies to my e-commerce transactions.
9. Non-profits like charities are exempt from PCI
8. Outsourcing my card processing makes me PCI compliant.
7. I use a PABP application/service provider, so I’m PCI compliant.
6. A card association would never fine a college or university!
5. PCI compliance is an IT project.
4. PCI is inflexible with unreasonable technical, security, and business requirements.
3. PCI requires me to hire a QSA.
2. The card industry requires me to keep cardholder data.
1. I’ve completed my Self-Assessment Questionnaire, so I’m compliant.
Posted in General |
March 21st, 2008 by Stacy Shelley
Posted in General |
March 20th, 2008 by Jeff Rosenberg, Vice President and General Counsel
The Federal Trade Commission settled its lawsuit with ValueClick and in doing so, smacked ValueClick upside the proverbial head by imposing some heavy fines for spamming activities. Of particular interest is the part of the final settlement agreement that makes it clear that ValueClick violated its own privacy policy in a number of ways.
ValueClick’s privacy policy promised encryption of client data and the implementation of reasonable security measures. From reading the settlement agreement, together with the original complaint, it appears that ValueClick was found to have failed on both counts - they did not provide encryption for data and they did not provide what was deemed as “reasonable security,” specifically by failing to fix vulnerabilities that allowed SQL injection attacks.
ValueClick’s failure with security issues seems fairly straightforward. But the encryption issue merits a little bit more discussion. Encryption is a specific security precaution that may or may not have made sense in light of the company’s risk profile. In fact, ValueClick may have protected data in another way that was perfectly adequate from a security perspective. But even if they properly came to the conclusion that encryption was not necessary to protect client data, no one at the company went back to change the privacy policy.
Let’s be honest, website privacy policies are often crafted by webmasters - and frequently they are “borrowing” language from another website to generate the content. However, the FTC has repeatedly stated that the commission views these policy statements as binding contracts or commitments by the recipient of data to its website visitors. The ValueClick case is not the first nor will it be the last such enforcement action that the FTC will bring in this area. (For a listing of the other cases and settlements, go to http://www.ftc.gov/privacy/privacyinitiatives/promises_enf.html)
The ValueClick settlement is a reminder that these privacy policies need to be coordinated with the company’s Information Security program. If you don’t coordinate, you run the risk of promising security assurances to clients or visitors that may or may not be part of the security program you have implemented. This lack of consistency creates the potential for claims that your company is misrepresenting its handling of personal information - even if you have a solid information security program in place.
Posted in General |
Contact Us