The recent Sony and Epsilon breaches sent a strong reminder that companies lack transparency and aren't prepared to respond to a breach once it occurs, says Kirk Herath, Chief Privacy Officer at Nationwide Insurance Companies.
Many organizations are unprepared to adequately respond to a breach, security expert Bob Chaput says. "Breach notification planning is just a fundamental, basic part of risk management in the new millennium," he adds.
Federal authorities have issued a detailed notice of proposed rulemaking that sets out guidelines for how patients must be provided with an accounting of who has viewed their protected health information.
Two stories stand out when I look back on the month of May: the POS PIN pad swap scheme that hit Michaels crafts stores in more than 20 states and the insider job at Bank of America that led to $10 million being stolen from some 300 customer accounts.
"The administration has concerns about this provision and wants to work with Congress to ensure that any such legislation adds clarity and value to our efforts in cyberspace," a statement on policy administration says.
A July trial date has been set for a pay-at-the-pump skimming scheme that allegedly led to the theft of more than $150,000 from six Hawaii financial institutions, highlighting the growing fraud vulnerability of self-service card payments.
Sen. Susan Collins faults part of the administration plan she says could give those who would do harm a roadmap to attack the nation's critical IT infrastructure. DHS's Phil Reitinger says he doubts that would happen.