A Q&A with Ronald Raether, Jr.
In an increasingly device-dependent world, the issue of data integrity with regard to mobile applications is becoming ever more critical. In California, the attorney general brought a case against Delta Airlines for not warning customers that it was collecting sensitive data. I asked Ronald Raether, Jr., defense attorney and partner at Faruki Ireland & Cox in Dayton, OH, about the case and its implications for liability and regulatory exposure.

A Q&A with Lynn Sessions of Baker Hostetler
In enforcing the HIPAA/HITECH regulations, the Department of Health and Human Services’ Office of Civil Rights (OCR) has been coming down on healthcare organizations with recent fines of US $1.7 million, and yet the OCR and its investigations remains an area of mystery for many organizations. I asked Lynn Sessions, counsel at Baker Hostetler in Houston, TX, for some perspective on OCR’s process for ensuring data security and privacy compliance in healthcare.

A Q&A with Kevin Lam of LOCKBOX LLC
Businesses in all sectors are increasingly employing mobile apps to improve market services and stay connected with customers. However, apps can share or leak private customer information, often unbeknownst to the organizations that offer them. A recent news story about the California Attorney General slapping app developers with fines for noncompliance of privacy laws underscores the risks to both third party app developers and businesses that deploy apps in violation of consumer privacy rights. To address this risk exposure, I spoke with Kevin Lam of LOCKBOX LLC (he can be reached at [email protected]).

A Q&A with Robert McEwen of McEwen & McMahon
Among the multitude of risks posed by data insecurity is a company’s reputation. In the past, ineffective communications about a data breach often has led to greater financial loss for victimized companies, such as when customers speak publicly about their negative experiences and damage brand equity), or when victims feel their concerns are not being taken seriously and seek recourse through legal action. So how can organizations prepare to communicate effectively in case sensitive information ever is compromised? We spoke with Robert McEwen of McEwen & McMahon to find out.

A Q&A with Winston Krone of Kivu Consulting
Encryption is a best practice that helps safeguard private data “at rest” (in the database). However, most companies don’t deploy encryption. Instead, they might say they use “compensating controls” instead of encryption, which include the tokenization or hashing of data. To find out more about the differences between encryption, hashing and tokenization and the relative advantages and disadvantages to each approach, we spoke with Winston Krone, managing director of Kivu Consulting, which offers investigation, discovery and analysis to businesses facing data breach incidents.

A Q&A with Michael Bruemmer of Experian
Healthcare is one of the single biggest areas for data breach and identity fraud, yet many people still don’t understand the gravity of the risks facing companies and consumers. To get a better handle on the specific risks and how organizations can better protect themselves, I spoke with Michael Bruemmer, VP of Data Breach Resolution at Experian.

A Q&A with Tim Springer, CEO of SSB BART Group Section 508 of the U.S. Rehabilitation Act covers access to electronic and information technology for people with disabilities, and it concerns companies receiving federal funds or contracts. Though accessibility portions of this act were established in 1998, many companies are still uncertain about the guidelines…

A Q&A with Chris Novak, Managing Principal at Verizon Business
Verizon’s Data Breach Investigations Report, conducted by the Verizon RISK Team with cooperation from law enforcement agencies around the world, has become an invaluable resource for anyone looking to gauge the current landscape in data breach incidents. “It’s not enough to know what happened. We need to know why and what we could have done to prevent it,” says Chris Novak, managing principal, investigative response for Verizon Business Security Solutions. I talked to Chris about the latest findings in this year’s report.

A Q&A with Rick Betterley of Betterley Risk Consultants, Inc.Like any segment of the insurance industry, cyber risk management services evolve over time. To get a handle on some of the latest trends, I spoke with Rick Betterley, President of Betterley Risk Consultants (an independent risk management consulting firm), and publisher of The Betterley Report at www.betterley.com.  Rick can be reached at [email protected] or 978.422.3366.

A Q&A with Andreas Schlayer of Munich Re Cloud computing remains a hot topic in the area of insurance risk, though many companies and insurers are still assessing its impact on IT security. To find out more, I spoke with Andreas Schlayer, who heads the insurance IT risk team at Munich Re. What are some…