A key factor in minimizing the risk of a breach when working with business associates is to provide these partners with the minimum amount of information they need to perform their services, says security expert Brian Lapidus.
Characterizing LulzSec as cyberterrorists, department officials confirmed that LulzSec appeared to have gained access to the e-mail accounts of at least seven department employees, with the pilfered information posted online by the group.
The new virtualization guidance issued by the PCI Security Standards Council urges organizations to take a risk-based approach when dealing with virtualization methods, especially within cardholder data environments.
Leigh Williams says preventing online data breaches requires cooperation within the online ecosystem from domestic and international organizations. Spearheading and maintaining that cooperation requires federal oversight, he contends.
"We appear to be asking DHS to take on new cybersecurity roles and missions while it is establishing its basic core competencies," Melissa Hathaway says. "Is this reasonable? Do we want DHS to become a first party regulator?"
Federal officials should offer detailed guidance on how to conduct a "risk of harm" assessment to comply with the HITECH Act Breach Notification Rule, says Harry Rhodes, director of practice leadership at the American Health Information Management Association.
"It's not enough to know the architecture of the breach system," says Michael Aisenberg of MITRE Corp. "Leaders have to understand the different jurisdiction of where they do business, where their customers are and which breach law applies."