A Q&A with Emily Cummins, Risk Manager and Chair of the Technology Advisory Council (TAC) of the Risk and Insurance Management Society (RIMS)
Though it may have only captured the public’s attention recently, cyber risk has been an emerging risk management concern for decades. To find out more about what keeps risk managers up at night, I spoke to Emily Cummins, CPA, CPCU, ARM, ARe, risk manager and current chair of the Technology Advisory Council (TAC) of the Risk and Insurance Management Society (RIMS), which has chosen cyber risk as an area of focus for 2012.

A Q&A with Sasha Romanksy, Ph.D. Candidate, Carnegie Mellon University
For organizations dealing with a data breach, legal liability is one of the first questions that arises. But are some data breaches more likely to result in lawsuits than others? Sasha Romanosky, a Ph.D. candidate at the Heinz College of Information Systems and Public Policy at Carnegie Mellon University, studies the legal and economic issues around data security and consumer privacy. In a recent study he coauthored, “Empirical Analysis of Data Breach Litigation,” he found that breaches resulting from the unauthorized disclosure or disposal of personal information are 6.9% more likely to result in lawsuit, relative to breaches caused by lost or stolen hardware, whereas breaches caused by cyber-attack are only 2.9% more likely to result in lawsuit. We spoke with him about his findings.

A Q&A with Spencer Snedecor, CEO of Palisade Systems
It’s a misconception that most data breach events and losses can be attributed to hackers—in fact, the large majority are caused by human error. Data Loss Prevention (DLP) solutions can help organizations reduce this type of risk exposure. I spoke to Spencer Snedecor, CEO of Palisade Systems, to find out more about DLP solutions.

A Q&A with Roger Thompson, Chief Emerging Threats Researcher, ICSA Labs
Every day brings new threats to data security, and in 2012, we’ve seen the rise of Flame malware, which attacks computers running Microsoft Windows and has been used for cyber espionage in Iran, Israel, Sudan, Syria, Lebanon, Saudi Arabia and Egypt. To find out more about Flame and its significance for corporate data security, we spoke to Roger Thompson, chief emerging threats researcher of ICSA Labs.

A Q&A with David Lineman, President of Information Shield
An organization’s security is only as good as its underlying policy. Besides guiding personnel on procedures, rules and protocols, policy is also a public signpost that will reassure customers, third party organizations and stakeholders that their data will be protected. To find out more about the common mistakes people make with regard to data safeguard policy, I talked to David Lineman, president of Information Shield (and eRisk Hub resource vendor).

A Q&A with Mark Teolis, General Manager of DOSarrest
Denial of service (DDoS) attacks are a threat to any business with an online presence. With little effort, an attacker across the world can completely overwhelm, degrade and/or crash your business computer servers. The result is that you then lose customer trust and revenue for every minute the system is down. This type of attack is very prevalent and difficult to defeat. DOSarrest (an eRisk Hub listed vendor) assists organizations in deflecting these belligerent attacks. We spoke with general manager Mark Teolis to learn more about DDoS attacks and what we can do about them.

A Q&A with David Wolpoff, Kyrus Technologies
Supervisory control and data acquisition (SCADA) systems are industrial computer systems that monitor and control industrial or infrastructure processes. Recently, two hacking incidents at water utilities in Illinois and Texas have exposed their vulnerabilities. To get a better handle on how companies using SCADA systems can better protect them from malicious attacks, I spoke with David Wolpoff of Kyrus Tech.

A Q&A with Amit Trivedi, Healthcare Program Manager for ICSA Labs
When the American Recovery and Reinvestment Act of 2009 was signed by President Obama on February 17, 2009, it included the Health Information Technology for Economic and Clinical Health (HITECH) Act, which calls for programs under Medicare and Medicaid to provide incentive payments for the “meaningful use” of certified electronic health records (EHR) technology. I spoke with Amit Trivedi, healthcare program manager for ICSA Labs, an independent division of Verizon that’s involved in the certification and testing process for health records, about the concept of “meaningful use” and HITECH’s ramifications for data security.

A Q&A with John Mullen, Nelson Levine de Luca & Hamilton, LLP
The hours and days following the initial discovery of a breach are full of confusion and chaos. However, companies can save themselves from a lot of trouble later on down the line if they stay focused. We spoke to lawyer John F. Mullen Sr. of Nelson Levine de Luca & Hamilton, LLP in Blue Bell, PA, about dos and don’ts for companies in this situation—mostly don’ts.

A Q&A with Branden Williams, CTO of Marketing at RSA
SQL (Structured Query Language) is a standardized language for interrogating relational database systems, which are found in most companies for business applications (especially web-facing apps). SQL injection is one of the most common technical exploits used to perpetrate the theft of sensitive information. To understand a little bit more about how it works and how companies can prevent it, I spoke with Branden Williams, CTO of Marketing at RSA, the security division of EMC in Dallas, TX.