Progress in securing health records, but still a long way to go

An excellent article this week in InformationWeek by Mitch Wagner provides an nice overview of the privacy and security issues related to widespread deployment of electronic medical records, noting both the recent progress made in these…

Policies without enforcement simply aren’t enough to guard against internal threats

Two recent studies of financial sector employees, sponsored by security vendors Cyber-Ark and Actimize, and reported last week by Tim Wilson of InformationWeek, indicate that employees are ready and willing to steal information from their employers,…

More options, no resolution on bridging public and private sector security standards

As regularly noted in this space, one of the big points of disagreement in attempts to achieve greater levels of information integration, particularly health information exchanges, is how to reconcile disparate security and privacy standards in…

Revised SP800-37 not ideal, but an improvement

NIST has released for public comment a revision to its Special Publication 800-37, “Guide for Applying the Risk Management Framework to Federal Information Systems.” This document was formerly the “Guide for the Security Certification and Accreditation…

New research identifies additional risks for applications in the cloud

With great attention continuing to be focused on the potential for cloud computing services to re-shape the way public and private sector organizations manage their IT infrastructure and computing environments, a paper published this month by…

Proposed federal P2P ban might extend to personal computers

The latest development in the wake of the unauthorized release of information about a House ethics investigation is newly proposed legislation in the form of what would be called the Secure Federal File Sharing Act (H.R….

CDT offers a good explanation of user-centric identity issues

The Center for Democracy and Technology (CDT) has a good summary up on their site detailing a variety of policy issues related to user-centric identity management. There is a lot of attention in the market focused…