Saving Money With SFTP - Wick Hill

Everyone is looking to cut costs in the recession, but there is one solution which many companies don't realise has the potential to save money for minimal investment and minimal disruption, which also can provide fast ROI. A lot of organisations still have legacy systems and are happy to live with them, given the huge upheaval and potential expense which replacement would mean. But those legacy systems have some costly aspects to them, which can easily be improved and which offer the potential for savings. FTP file transfer from legacy systems normally goes on in the background without anyone paying too much attention to it. It's the part of legacy systems which is below the surface and which gets taken for granted. Many companies rely on FTP for file transfer, however there are a number of issues which make FTP ripe for improvement and offer companies the potential to cut costs and gain ROI. The solution to the problems of FTP is to use SFTP (secure file transfer protocol) instead.

Posted on: 9 April 2009 | 4:38 am

UK Information Commissioner targets firm selling vetting data

The Information Commissioner's Office (ICO) has taken stringent enforcement action against a business that it believes has been selling data about construction industry workers to prospective employees. The action against the Consulting Association is further evidence of the proactive enforcement activity being adopted by the ICO. It's an interesting case study of the range of powers that the ICO has to: obtaining a warrant to obtain entry issuing enforcement notice to effectively cease using the data the threat of criminal sanctions because they had also failed to register with the ICO. The impact may well be to close this business down, which is proof that the ICO is far from being a toothless tiger amongst regulators.

Posted on: 11 March 2009 | 10:54 am

12 Key Steps to Internet Security - Wick Hill

Your approach to internet security should begin with a risk assessment. If you don't know what threats are likely to be posed to your IT systems and networks, and their potential effects on your business should they occur, then you are not really in a position to put in place a series of measures to counter these threats.An effective anti-virus solution is absolutely fundamental to the security of any computer network.Equally, a firewall is one of the most basic security mechanisms and should form an integral part of your internet security defences.

Posted on: 11 November 2008 | 7:06 am

Dechert - Telephone Monitoring: Dos and Don'ts

It is widely (and incorrectly!) believed that it is unlawful in the UK in all circumstances to monitor and record telephone calls without drawing this to the attention of the parties to the call. There are in fact broad exceptions which are relevant to many businesses which do allow such activities without obtaining consent. There are several reasons why businesses may wish to monitor or record telephone use for the purpose of its business. Often the rationale is quality control or even compliance by an employee with certain regulations, but the monitoring may also be useful for ensuring that employees are not calling friends in Australia at the businesses expense or otherwise using the system contrary to your policies. The law must however balance these goals against the need to protect employees as well as external persons from "snooping" and misuse of such data. There are two principle legal areas of relevance; namely, the law on "interception" of communications stemming from the Regulation of Investigatory Powers Act 2000 ("RIPA") and the Data Protection Act 1998 ("DPA").

Posted on: 24 October 2008 | 4:24 am

Firewall or Unified Threat Management System, UTM? Wick Hill

Unified threat management systems (UTMs) have been growing in popularity for the last few years. Traditionally, they have been widely adopted by SMEs, but larger companies and enterprises are now also deploying UTMs, appreciating the benefits they can offer. UTMs are designed to provide a range of security solutions in a single appliance, reducing costs and simplifying the whole process of security systems management, reporting and installation. The minimum requirement for a UTM, according to IDC, is a firewall, VPN, antivirus and intrusion detection/prevention. Super UTMs (sometimes called extended UTMs or XTMs) have, however, evolved from this to incorporate additional capabilities which can include URL filtering, spam blocking and spyware protection, as well as centralised management, monitoring, and logging capabilities.

Posted on: 15 October 2008 | 7:58 am

Information Commissioner's Office demands encryption of mobile devices - Eversheds

emonstrating the increasing appetite of the Information Commissioner's Office (ICO) to take enforcement action, Virgin Media Limited is the latest organisation to be held to account for a breach of the Data Protection Act 1998 (DPA). The breach seems to have occurred earlier this year following the loss of a compact disc that was passed to Virgin Media by Carphone Warehouse. The disc contained personal details of various individuals' interest in opening a Virgin Media Account in a Carphone Warehouse store. In this instance, the ICO has not gone straight to issuing an enforcement notice (by contrast to the treatment of the Liberal Democrat Party last week), but has instead obtained a formal undertaking requiring Virgin Media to undertake certain steps to improve its security measures. The breadth of the obligation to use encryption will surprise many organisations. Virgin Media is required, with immediate effect, to encrypt all portable or mobile devices that store and transmit personal information. Further, the company is to ensure that any service provider processing personal information on its behalf must also use encryption software and this requirement has to be clearly stated in all contracts. We suspect that in practice not many organisations expressly state this in their contracts. Most - if they deal with security at all - will contain the generic security language contained in the seventh principle of the DPA.

Posted on: 9 October 2008 | 5:01 am

Data loss - liability, reputation and mitigation of risk - Eversheds e80

With an increasing number of security breaches hitting the headlines, there is, unsurprisingly, a growing awareness amongst regulators and the public alike of data security issues. The risks to businesses of being involved in a data loss incident are high. Criminal sanctions under the Data Protection Act are well established, but other regulators like the Financial Services Authority (FSA) are also willing to flex their enforcement muscles. In the last three years, the FSA has levied substantial fines against several of its members for security breaches. Bad publicity is another potentially lethal sanction. A recent study by Ponemon showed that 31 per cent of respondents terminated their relationship with an organisation on receiving notification of a breach of data security.

Posted on: 1 October 2008 | 10:07 am

What does the British Computer Society think of Phorm?

Phorm, Webwise, OIX and the BCS Security Forum Phorm over function? Perhaps that's the challenge in relation to marketing desires clashing with privacy hopes. But given the starting point of the Phorm furore, in the Spring of 2008, we are now in the Autumn of 2008 and its been nothing but data breach after user faux pas exposing countless millions of individuals' personally identifiable information that has focussed the spotlight firmly upon the need to apply "privacy by design" principles from the outset - something that the ICO will be taking a very serious view of in the coming months. The BCS Security Forum is equally involved in keeping a watching brief.

Posted on: 23 September 2008 | 3:14 pm

Are you storing customer data properly? The challenges of PCI DSS compliance

Data security breaches are hitting the headlines with alarming frequency. While the most recent breaches have involved the public sector and financial services industries, retailers are not immune from the rise of data losses. Cotton Traders, the UK leisurewear and casual clothes brand, for example, recently conceded that thousands of customer details had been stolen from the company's website. Last year saw perhaps one of the most publicised cases involving retail giant, TJ Maxx, which found that hackers had accessed internal systems used to process and store customer transaction data, including credit card, debit card, cheque and return transactions. The incident cost TJ Maxx $256 million1 and the company is now offering to pay Visa card issuers a further $40.9 million2 to compensate for costs connected to the data breach. With data security cases rising in number and severity, the various industries affected are pulling together in an attempt to reduce the risk of fraud. The Payment Card Industry Data Security Standard (PCI DSS ) is one such example which aims to crack down on fraud associated with credit and debit cards. However, the implementation of PCI DSS is not without its challenges and these must be overcome if the standard is to be used as an effective weapon in the fight against card fraud. PCI DSS aims to prevent any information that could be used to make a counterfeit card or a fraudulent online transaction from falling into the wrong hands. The standard applies to every acquiring bank, merchant and third party that accepts or processes payment cards. It is now mandatory for businesses with over 100,000 transactions a year to either be PCI DSS compliant or be able to demonstrate plans to become so. However, there is one element of the standard which is proving to be a particular stumbling block – requirement 3: protecting the stored cardholder data. In fact, 79 per cent of PCI DSS audit failures are due to companies not implementing requirement 3 properly.

Posted on: 11 September 2008 | 7:22 am

Data Vendor Sends SPAM about The Dangers of Prospecting Databases

ComplianceAndPrivacy.Com received an email that appears to be from Harris Infosource, a D&B Company. Not a lot wrong with that, you may say. The email is a cold unsolicited email, or SPAM, What makes this amusing is that the SPAM has this subject line: "Why Using Cheap Prospect Lists Can Cost You Big!" Harris Inforsource, it seems, are the purveyors of fine prospect lists. Harris addressed their SPAM to Milton Bennett at our domain. If Milton existed, if Milton had ever existed, if we had ever created, used, publicised an address for Milton, who is not now and never has been a member of our staff, then this would have been something we could pass off as "just one of those things". But we have never heard of Milton Bennett. He is a figment of Harris Infosource's database. We wonder if they are selling him as a part of their very fine data. But this is SPAM with a cloned email address.

Posted on: 5 September 2008 | 3:47 am

Bank Customer Personal Data Sold on eBay for £35

An investigation is under way into how a computer containing bank customers' personal data was sold on an internet auction site. The PC, which was reportedly sold for £35 on eBay, had sensitive information on the hard drive. The Royal Bank of Scotland (RBS) and its subsidiary, Natwest, have confirmed their customers' details were involved. RBS says an archiving firm told it the PC had apparently been "inappropriately sold on via a third party". It said historical information relating to credit card applications for their bank and others had been on the machine. The information is said to include account details and in some cases customers' signatures, mobile phone numbers and mothers' maiden names.

Posted on: 26 August 2008 | 6:21 am

Best Western Denies Report of Massive Data Breach

A Scottish newspaper Friday ran a story that claimed to uncover a massive theft of data from Best Western's customer database, including personal information on all 8 million customers at the chain's 1,300 hotels in the past year. After initially thanking the newspaper and doing its own investigation, however, the hotel chain now says The Sunday Herald's report of a massive breach at Best Western is "grossly unsubstantiated." In its report, The Sunday Herald stated that "a previously unknown Indian hacker successfully breached the IT defenses of the Best Western Hotel Group's online booking system and sold details of how to access it through an underground network operated by the Russian mafia." The newspaper called the attack "the greatest cyber-heist in world history," alleging that it "scooped up the personal details of every single customer that has booked into one of Best Western's 1,312 continental hotels since 2007." The newspaper stated that Best Western officials thanked it for discovering the breach and immediately closed the security hole by Friday afternoon. "Best Western took immediate action to disable the compromised login account in question," a hotel spokesman told the paper on Friday. "We continue to investigate the root cause of the issue, including, but not limited to, the third-party Website that has allegedly facilitated this illegal exchange of information." Last night, however, Best Western stated that its own investigation indicates that only about 13 customers are at risk, not 8 million.

Posted on: 26 August 2008 | 2:25 am

Best Western Data Loss - Indian hacker alleged brain behind biggest cyber-heist

An unknown Indian hacker is being 'charged' with the greatest cyber-heist in history for allegedly helping a criminal gang steal identities of an estimated eight million people in a hacking raid that could ultimately net more than 2.8 billion pounds in illegal funds. An investigation by Scotland's Sunday Herald newspaper has discovered that late on Thursday night a previously unknown Indian hacker successfully breached the IT defences of UK's Best Western Hotel group's online booking system and sold details of how to access it through an underground network operated by the Russian mafia. There are no details yet on how the hacker was identified to be an Indian and if a probe is on to identify the person. It is also not known if the hotel chain has alerted the police about the heist.

Posted on: 25 August 2008 | 11:52 am

Vietnam introduces heavy fines for spammers

Organisations and individuals who send spam mail and text messages or trade in e-mail addresses may be fined up to VND80 million (US$5,000), according to the newly-issued Decree on Anti-spam mail. The decree bans organi-sations and individuals from using electronic means to deliver spam messages, exchange or trade e-mail addresses or deliver software products that collect e-mail addresses, according to the Ministry of Information and Communications.

Posted on: 25 August 2008 | 3:37 am

Republic of the Phillipines can’t do without policy on data privacy, security

Under no circumstances can the Philippines compete, let alone thrive, in the lucrative outsourcing market and the global marketplace without a fool-proof policy on data protection and security. This was the clear message sent out by participants in a recent conference dubbed "Mapping the Future of Information Security Forum" organized by the Information Systems Security Society of the Philippines (ISSSP) at a hotel in Makati City. Anthony Tuason, a director at consultancy firm PriceWaterhouseCoopers, said during his presentation that IT companies, most especially those in the BPO sector, cannot possibly institute "IT governance" — the process of using technology as to management tool to run an organization — in the workplace if security is being disregarded. "Innovation, value, and performance can be derived from IT governance (and) data privacy and security is one area that helps organizations achieve their IT governance objectives," Tuason said.

Posted on: 25 August 2008 | 3:35 am

National Gateway Security Survey 2008 Shows Interesting Changes in Threat Landscape

The National Gateway Security Survey 2008, carried out for value added distributor and security specialist Wick Hill and sponsored by WatchGuard Technologies, leaders in unified threat management systems, has highlighted the increasing move toward remote and mobile use, as well as the concerns users have about this shift. In a survey of 341 of the top UK companies, by employee number and turnover, 48% had over 150 remote users and a further 11% had 50 to 100 remote users. 61% said that the number of remote users on their network was increasing. 45% reported that the number of VPNs was increasing and 43% that the number of SSL users was increasing.

Posted on: 21 August 2008 | 8:54 am

Unified Threat Management (UTM) - Watchguard Technologies

Unified threat management (UTM) spawned a new era of IT security. The promise of these integrated security appliances proved to be an exceptional and efficient way of securing commercial networks. However, businesses today face an inflection point, dictated by changing market trends and new technologies that demand more of today’s UTM. Hence the need is for eXtensible threat management (XTM) solutions, the next generation of UTM appliances. XTM is predicated upon the substantive expansion of three elements: more security, greater networking capabilities, and more management flexibility. This paper provides an overview of these issues and the WatchGuard Technologies perspective on “extensibility” and XTM.

Posted on: 13 August 2008 | 10:06 am

Transatlantic Events - Data Privacy Conference

As a grand special offer to readers of ComplianceAndPrivacy.Com, Transatlantic Events has slashed the ticket price to £200 per day. Reach the special Compliance and Privacy booking page directly from here: Special ComplianceAndPrivacy.Com Delegate Booking Page. This event is a Must See for those planning cross Atlantic or International operations which involve passing data from location to location

Posted on: 22 July 2008 | 7:09 am

Special Privacy Event Offer

EXCLUSIVE READERS OFFER: Dear Readers of Compliance and Privacy, It's our pleasure to announce and invite you as a VIP Delegate to: The 5th Annual Privacy & Data Protection UK 2008 3rd & 4th of September 2008 at The Law Society, 113 Chancery Lane, London, United Kingdom The event is broken up into two separate days & two separate events: "Data Protection: Global Compliance Management" 3rd of September 2008 "Data Protection: CRM, Privacy 2.0 & Social Networking " 4th of September 2008 This is a major Privacy & Data Protection event with more than 20 internationally renowned speakers. If there is one Privacy & Data Protection event to attend this year, this is it! The full conference agenda for The 5th Annual Privacy & Data Protection UK 2008 is available at: WWW.TRANSATLANTIC - EVENTS.COM Please note: All VIP Delegates who attend are entitled to a special VIP discount: VIP Delegates are able to attend this event for only £250.00 (either day) or £450.00 for both days. This invite is open to you and/or any colleague(s) you would like to recommend to this event. The VIP Delegate Registration portal is: WWW.TRANSATLANTIC-EVENTS.COM/ PDP2008UKVIP.html VIP Delegate places are limited, and sold on a "first come, first served" basis. So be sure to reserve your place(s) ASAP before they are all allocated. WHO SHOULD ATTEND? You will have the opportunity to meet players in the industry and discuss the latest issues with: Chief Executives, Chief Operating Officers, Managing Directors, Heads of Human Resources, Information Security and Risk Management Specialists/Consultants, Strategy Directors, Commercial Directors, Communications Directors, Sales and Marketing Directors, Heads of e- Commerce, Information Assurance Specialists/Consultants, Heads of Business Development, Heads of Compliance, Regulatory and Legal Affairs, Consultants and Advisors, Heads of IT & Database Management, Privacy Officers and ... anyone concerned with Privacy & Data Protection. The 2008 Expert Speaker Faculty Chairman (Day One): Alastair Gorrie, Partner, Orrick, Herrington & Sutcliffe, UK Co-Chairman (Day One): James Leaton Gray, Head of Information Policy & Compliance, BBC UK Chairman (Day Two) : Francis Aldhouse, Consultant, Bird & Bird, UK Co-Chairman (Day Two): Nigel Roberts, Director and CTO, Island Networks, UK Internationally Renowned Speaker Faculty: Bridget Treacy, Partner, Hunton & Williams LLP, UK Monika Kuschewsky, Senior Associate, Van Bael & Bellis, Brussels Rosemary Jay, Partner, Pinsent Masons LLP, UK Mark E. Schreiber, Partner, Edwards Angell Palmer & Dodge LLP, USA Robert Bond, Partner, Speechly Bircham LLP, UK Renzo Marchini, Dechert LLP, UK Vinod Bange, Associate, Eversheds LLP, UK Anne Coles, Senior Partner, AMC Law, UK Philip Nolan, Partner, Mason Hayes + Curran, Ireland Lynda K. Marshall, Partner, Hogan & Hartson LLP, USA Karen A. Morris, Chief Innovation Officer, AIG, USA Tim Beadle, Director, Marketing Improvement, UK Peter G. Wray, Chairman & Founder loyaltymatters.com and cm4p.com Gareth Wong, Founder of CXO Europe, GamBond, and Gambit, UK Dr. Mark Watts, Partner, Bristows, UK Nicola McKilligan, The European Privacy Partnership, UK Andy Thomas, Director, Garlik, UK Edna Kusitor, Global Data Privacy Compliance Coordinator, Accenture, UK Graham Sadd, Chairman & CEO, PAOGA Limited, UK Winston Maxwell, Partner, Hogan & Hartson MNP, France Tim Trent, Consultant, Marketing Improvement, Managing Editor ComplianceAndPriovacy.Com UK Delegate places are limited, so reserve your delegate place TODAY!!! For more information, visit: WWW.TRANSATLANTIC - EVENTS.COM Event Organisers: Transatlantic Events Production Office Epsom, Surrey, United Kingdom email: info@transatlantic-events.com phone: +44 (0) 208 658 6568

Posted on: 15 July 2008 | 8:54 am

Trust is not about SSL. It's about domains

At ComplianceAndPrivacy we've been running a study on domains to trust. We don't mean "trustmydomain.com", we mean the domain suffic; the little thing that you choose when buying "myfabulousdomain". Do you choose .com, or do you think, incorrectly "That is for the USA"? Do you choose .biz? Is .org for you? What about .info? So we asked, on a pretty normal website, this question: "Some domains seem to feel more trustworthy than others. This survey is about the .com .biz .info .org and other domain suffixes and which put you most at ease. OK, there are iffy nations, but we are lumping all national style ones under one entry. Tick all that say to you 'Trust this domain'" We expected nothing significant. After all it was a website for Joe Q Public, and this is what we got:

Posted on: 24 June 2008 | 4:30 am

How Centralised Unified Threat Management (UTM) Can Help Companies Control Security At Remote Offices, Simplify Administration And Cut Costs

In today's modern, distributed computing network, where companies and organisations need to secure IT not just for the head office, but for remote locations as well, the ability to control security for multiple sites from one single location is becoming increasingly important. With some security systems, the tasks of configuration, updating, rebooting, etc. for remote sites might all have to be done separately and repeated for each location. Administrators could be faced with managing remote security appliances individually, possibly having to send someone out to a remote site to carry out certain tasks, such as configuration or establishing VPN tunnels. This can be difficult, time consuming, costly and complex and, in some cases, it is practically or financially impossible It can be further complicated if there are multiple appliances, delivering multiple levels of security, such as firewall, VPN, spam blocking, gateway anti-virus, web content management and intrusion detection/prevention.

Posted on: 21 May 2008 | 6:48 am

Mobile and Remote Working - Is it secure?

Unstoppable move towards remote and mobile workingMobile working is not adequately secured.Organisations are concerned about security for mobile and remote workers and how to enforce company security policies outside the gateway.Companies want to protect against data leakage and data loss from such problems as stolen laptops.There is no one solution to securing remote working.The range of solutions includes strong authentication, end point security, remote unified threat management (UTM) systems, low-cost encryption and VPNs.

Posted on: 18 March 2008 | 9:58 am

Olubi Adejobi and Robert Bentley, bothh Solicitors, fined for Data Protection Offences

GrierOlubi and Bentleys - Individual solicitiors convicted for data protection offences The Information Commissioner’s Office (ICO) has today successfully prosecuted two London solicitors for offences under the Data Protection Act. Olubi Adejobi of Grier Olubi Solicitors and Robert Bentley of Bentley’s Solicitors, both based in London, were each fined £300 and ordered to pay costs of £500 plus a victims’ surcharge of £15 at Stratford Magistrates’ Court. Each solicitor must pay a total of £815 in fines and costs. Today’s prosecution follows the failure of both Mr Adejobi and Mr Bentley to notify as data controllers despite repeated reminders from the ICO of their obligations under the Data Protection Act. Under the Act, organisations that process individuals’ personal information may be required to notify with the Information Commissioner at a nominal cost of £35 per year. Despite being told to notify, both Mr Adejobi and Mr Bentley have failed to respond to any of the ICO’s correspondence and have still not notified.

Posted on: 22 February 2008 | 7:45 am

ADC Organisation Prosecuted by UK Information Commissioner for Data Protection law breaches

ADC Organisation prosecuted for data protection offences ICO prosecutes debt company for breaching marketing rules A Manchester debt recovery company has been successfully prosecuted by the Information Commissioner’s Office (ICO) for bombarding individuals and businesses with unwanted faxes. The action follows thousands of complaints from individuals and businesses to the ICO and the Fax Preference Service (FPS). ADC Organisation Ltd (ADC) pleaded guilty to six charges under the Privacy and Electronic Communications Regulations and has been fined £600 (£100 per charge). The organisation was also ordered to pay £1,926.25 in costs. ADC must pay a total of £2,526.25 in fines and costs.

Posted on: 22 February 2008 | 7:32 am

UK Information Commissionr takes enforcement action against Marks & Spencer

M&S ordered to encrypt all hard drives by April 2008 The Information Commissioner's Office (ICO) has found Marks & Spencer (M&S) in breach of the Data Protection Act. This follows the theft of an unencrypted laptop which contained the personal information of 26,000 M&S employees. An ICO investigation revealed that the laptop, which contained details of the pension arrangements of M&S employees, was stolen from the home of an M&S contractor. In light of the nature of the information contained on the laptop, it is the ICO's view that M&S should have had appropriate encryption measures in place to keep the data secure. Mick Gorrill, Assistant Commissioner at the ICO, said: "It is essential that before a company allows personal information to leave its premises on a laptop there are adequate security procedures in place to protect personal information, for example, password protection and encryption. The ICO has issued clear guidance to help employers understand their obligations under the Data Protection Act.

Posted on: 25 January 2008 | 6:40 am