A Q&A with Chris Novak, Managing Principal at Verizon Business
Verizon’s Data Breach Investigations Report, conducted by the Verizon RISK Team with cooperation from law enforcement agencies around the world, has become an invaluable resource for anyone looking to gauge the current landscape in data breach incidents. “It’s not enough to know what happened. We need to know why and what we could have done to prevent it,” says Chris Novak, managing principal, investigative response for Verizon Business Security Solutions. I talked to Chris about the latest findings in this year’s report.

A Q&A with Rick Betterley of Betterley Risk Consultants, Inc.Like any segment of the insurance industry, cyber risk management services evolve over time. To get a handle on some of the latest trends, I spoke with Rick Betterley, President of Betterley Risk Consultants (an independent risk management consulting firm), and publisher of The Betterley Report at www.betterley.com.  Rick can be reached at [email protected] or 978.422.3366.

A Q&A with Andreas Schlayer of Munich Re Cloud computing remains a hot topic in the area of insurance risk, though many companies and insurers are still assessing its impact on IT security. To find out more, I spoke with Andreas Schlayer, who heads the insurance IT risk team at Munich Re. What are some…

A Q&A with Emily Cummins, Risk Manager and Chair of the Technology Advisory Council (TAC) of the Risk and Insurance Management Society (RIMS)
Though it may have only captured the public’s attention recently, cyber risk has been an emerging risk management concern for decades. To find out more about what keeps risk managers up at night, I spoke to Emily Cummins, CPA, CPCU, ARM, ARe, risk manager and current chair of the Technology Advisory Council (TAC) of the Risk and Insurance Management Society (RIMS), which has chosen cyber risk as an area of focus for 2012.

A Q&A with Sasha Romanksy, Ph.D. Candidate, Carnegie Mellon University
For organizations dealing with a data breach, legal liability is one of the first questions that arises. But are some data breaches more likely to result in lawsuits than others? Sasha Romanosky, a Ph.D. candidate at the Heinz College of Information Systems and Public Policy at Carnegie Mellon University, studies the legal and economic issues around data security and consumer privacy. In a recent study he coauthored, “Empirical Analysis of Data Breach Litigation,” he found that breaches resulting from the unauthorized disclosure or disposal of personal information are 6.9% more likely to result in lawsuit, relative to breaches caused by lost or stolen hardware, whereas breaches caused by cyber-attack are only 2.9% more likely to result in lawsuit. We spoke with him about his findings.

A Q&A with Spencer Snedecor, CEO of Palisade Systems
It’s a misconception that most data breach events and losses can be attributed to hackers—in fact, the large majority are caused by human error. Data Loss Prevention (DLP) solutions can help organizations reduce this type of risk exposure. I spoke to Spencer Snedecor, CEO of Palisade Systems, to find out more about DLP solutions.

A Q&A with Roger Thompson, Chief Emerging Threats Researcher, ICSA Labs
Every day brings new threats to data security, and in 2012, we’ve seen the rise of Flame malware, which attacks computers running Microsoft Windows and has been used for cyber espionage in Iran, Israel, Sudan, Syria, Lebanon, Saudi Arabia and Egypt. To find out more about Flame and its significance for corporate data security, we spoke to Roger Thompson, chief emerging threats researcher of ICSA Labs.

A Q&A with David Lineman, President of Information Shield
An organization’s security is only as good as its underlying policy. Besides guiding personnel on procedures, rules and protocols, policy is also a public signpost that will reassure customers, third party organizations and stakeholders that their data will be protected. To find out more about the common mistakes people make with regard to data safeguard policy, I talked to David Lineman, president of Information Shield (and eRisk Hub resource vendor).

A Q&A with Mark Teolis, General Manager of DOSarrest
Denial of service (DDoS) attacks are a threat to any business with an online presence. With little effort, an attacker across the world can completely overwhelm, degrade and/or crash your business computer servers. The result is that you then lose customer trust and revenue for every minute the system is down. This type of attack is very prevalent and difficult to defeat. DOSarrest (an eRisk Hub listed vendor) assists organizations in deflecting these belligerent attacks. We spoke with general manager Mark Teolis to learn more about DDoS attacks and what we can do about them.

A Q&A with David Wolpoff, Kyrus Technologies
Supervisory control and data acquisition (SCADA) systems are industrial computer systems that monitor and control industrial or infrastructure processes. Recently, two hacking incidents at water utilities in Illinois and Texas have exposed their vulnerabilities. To get a better handle on how companies using SCADA systems can better protect them from malicious attacks, I spoke with David Wolpoff of Kyrus Tech.