Sep 21 2015

International law firms see ISO 27001 certification as competitive differentiator

Category: ISO 27k,Security and privacy LawDISC @ 9:22 am

International law firms see ISO 27001 certification as competitive differentiator

by

laptop-820274_1280
ISO 27001 has long been regarded as the information security standard to protect a company’s sensitive information, but more recently law firms have been viewing it as a key competitive differentiator in their field.

Key selling point

Shook, Hardy & Bacon achieved ISO 27001 certification last year and described the standard as a key selling point for their firm. “We wanted to make sure we had the processes in place so [clients] had confidence that we were doing the best we could,” says the firm’s chair, John Murphy.

Strengthened position in the legal market

Murphy continues that certifying to ISO 27001 has strengthened SHB’s position in the legal market and that prospective clients ask the firms they’re evaluating about their data security policies and procedures; some even specifically ask firms whether they have an ISO 27001 certification.

Certification to ISO 27001 has been achieved by at least 12 large law firms, half of which are based in the United Kingdom, and another 16 US firms were identified as “working toward or investigating certification” (International Legal Technology Association’s LegalSEC conference, June 2014).

The importance of data security in the legal sector

Having worked with some of the top law firms in the country – including Eversheds, Freshfields, and Slaughter and May – we know how important data security is to those in the legal sector.

Find out how you can emulate top law firms and achieve internationally recognized data security status with ISO 27001 by downloading our free green paper, which reveals:

  • How top law firms successfully use ISO 27001 to grow their client base.
  • How ISO 27001 will benefit your firm as a whole.
  • Why stringent data security in the legal sector is a key business enabler.

Download now >>


Tags: iso 27001 certification, Law enforcement agency, Law firms, security law


Mar 30 2014

The Protection of Personal Information Act (POPI) in South Africa – Benefits and Challenges

POPI

by Ilenia Vidili

In South Africa the Protection of Personal information Act (POPI) aims to regulate how companies secure the integrity and confidentiality of their data assets by taking technical and organisational measures to prevent the loss of, and damage and unauthorised access to, personal information. POPI was signed into law on 26th November 2013 but the commencement date is yet to be announced; companies have been given a year to achieve compliance with the Act. Penalties for failing to comply with the Act include prosecution, with possible prison terms of up to 12 months, and fines of up to R10 million. I believe that POPI will make life easier for IT organisations in South Africa.

Why is it so important for organizations to keep personal information safe?

Data breaches, and the resultant loss of information assets, can lead to huge financial losses for companies as well as the reputational damage and a loss of customer trust.  The lack of robust Information Security Management Systems (ISMS) can leave organisations of any size and sector open to data breaches. POPI’s objective is to regulate the way personal information is collected and stored by organizations, which will in turn increase customer confidence in the organizations. The Act will apply to all organizations, regardless of size or sector, whether public or private, including the Government. As a reminder of the importance of data security, the City of Johannesburg suffered a massive data breach in August 2013 which allowed anyone to read citizens’ personal billing information on the Council’s website, including full names, account numbers, addresses, and contact details. Anything could have happened to that information, including targeted phishing attacks, and the production of fake ID books and proof of residence, which could have been used for terrorist purposes.

POPI’s challenges

The major challenge of POPI is that companies will have to change the way they collect and store customer information as soon as possible: organizations have been given only a year to be compliant before the Act is enforced. Given the extent of changing business processes and employees’ attitudes it will be a serious challenge to reach compliance in only a year.

PwC’s “journey of implementation” report found that the majority of organizations in South Africa believe it will take several years to achieve compliance with POPI.

55

Source: PwC “The journey to implementation”

One way for South African organizations to make compliance with POPI easier would be to implement the international information security standard ISO27001, which sets out the requirements against which an organization’s information security management system can be independently audited and certified. Implementing the standard will help South African businesses fulfil the compliance requirements of any related legislation (including the Protection of Personal Information Act). Moreover, by implementing ISO27001, businesses ensure that they have effective controls in place to manage risk and protect personal information.

How to prepare for POPI

IT Governance SA has developed a wide range of ISO27001 books, training and tools to help organisations with weak information security management system, and recommends that companies look at the useful information about ISO27001 available on the company’s website.

Tags: Information Security Management System, isms, POPI, Protection of Personal information Act, South Africa


Jun 15 2013

Unreasonable searches and drone killings

Category: Information Privacy,Security and privacy LawDISC @ 1:52 pm
Search

Search (Photo credit: ~FreeBirD®~)

Peter Scheer @ SFChronicle.com on June 12, 2013 – Open Forum on NSA’s snooping

First came news accounts of the government’s use of armed drones in the targeted killing of terrorists abroad. Then came the revelations about government surveillance programs, breathtaking in their scale, tapping into data on phone calls, e-mails, Internet searches and more.

These activities are, in fact, linked.

The use of drones to target America’s enemies represents the fruition of technological evolution in weapon accuracy. Though America’s previous military conflicts have been characterized by military strategies that often maximized enemy casualties (think of the “body counts” during the Vietnam War), the technology of drones makes possible the highly discriminate targeting of selected individuals, with minimal civilian casualties.

U.S. intelligence gathering has evolved in the opposite direction. Before data mining, and especially before the end of the Cold War, intelligence gathering was focused narrowly on selected institutions or individuals. America knew who its enemies were; the objective of espionage operations, from wiretaps to infiltration by American spies, was to find out what they were doing: with whom they were communicating, their capacities and plans.

In recent years, by contrast, the focus has shifted to intercepting and analyzing mountains of data in order to discern patterns of activity that could lead to the identification of individual enemies. Intelligence gathering has evolved from the penetration of known groups or individuals to the sifting and mining of Big Data – potentially including information on all U.S. citizens, or all foreign customers of Google, Facebook, et al. – in order to identify individuals or groups that are plotting attacks against Americans.

The logic of warfare and intelligence has flipped. Warfare has shifted from the scaling of military operations to the selective targeting of individual enemies. Intelligence gathering has shifted from the targeting of known threats to wholesale data mining for the purpose of finding terrorists.

The resulting paradigms, in turn, go a long way to account for our collective discomfort with the government’s activities in these areas. Americans are understandably distressed over the targeted killing of suspected terrorists because the very individualized nature of the drone attacks converts acts of war into de facto executions – and that, in turn, gives rise to demands for high standards of proof and due process.

Similarly, intelligence activities that gather data widely, without fact-based suspicions about specific individuals to whom the data pertain, are seen as intrusive and subject to abuse. The needle-in-a-haystack approach to intelligence gathering is fundamentally at odds with Americans’ understanding of the Constitution’s promise to safeguard them against “unreasonable” government searches. There is nothing reasonable about giving government secret access to phone calls and e-mails of tens of millions of Americans.

Our fear of these changes is reinforced by the absence of transparency surrounding drone strikes – specifically, the protocols for selecting targets – and intelligence operations that cast a broad net in which U.S. citizens are caught. This is why Americans remain supportive of, and thankful for, an independent and free press.

Peter Scheer, a lawyer and writer, is executive director of the First Amendment Coalition. FAC has filed suit against the U.S. Justice Department for access to classified legal memos analyzing the use of drones to target suspected terrorists. The views expressed here are Scheer’s alone and do not necessarily reflect the opinions of the FAC board of directors.

Unreasonable Searches and Seizures: Rights and Liberties
under the Law (America’s Freedoms)

Tags: Big Data, Data mining, First Amendment Coalition


Oct 04 2011

New California Data Breach Notification Law

Category: Security and privacy LawDISC @ 8:52 pm

Information Security Law: The Emerging Standard for Corporate Compliance

At the beginning of September, there was an addition to the Data Breach Notification laws of California. S.B. 24 was signed into law and will take effect the first day of 2012. This law will require specific actions be taken in the event of a data breach. Those actions include a standardized notification process and a notification sent to the Attorney General of California (if the breach affects 500 or more California residents.)

Why is this relevant to you or yours customers? If you encrypt your customer’s personal information, you do not have to make the appropriate notifications, because you have safe guarded your customers’ data. This keeps you out of the press, out of lawsuits and helps you handle your customers’ data responsibly.

You can read more about this legislation here:


Jul 15 2011

Court Ruling on “Due Diligence” Online Banking Security

Category: Security and privacy LawDISC @ 2:25 pm

The ruling in the Patco Construction vs. People’s United Bank case set precedence, because the judge basically ruled that the bank’s below par security was sufficient for small business — and Patco (small business) was held liable for paying for the fraud that was a result of an average bank security. To know more details of the case, Brian Krebs has written a great post on this case.

http://krebsonsecurity.com/2011/06/court-passwords-secret-questions-reasonable-ebanking-security/

Brian Krebs also wrote about another high profile case (emi v comerica) which was decided in the favor of small business (EMI)
http://krebsonsecurity.com/2011/06/court-favors-small-business-in-ebanking-fraud-case/

Baed on these two cases it is hard to know how the next online banking fraud case will be decided and on which precedence. I guess the courts are still trying to figure out how to decide these complex cases and where to set the due diligence bar for the banks.


Jul 11 2011

Privacy and Law

Category: Information Privacy,Security and privacy LawDISC @ 1:55 pm

Your personal info is manageable and controlable most of the time as far as privacy is concern , until you have to use it for commercial use (to apply cxredit card, to apply for bank account or to apply for a job). then it depends on these commercial entities how they are goning to use, share, manage or secure your personal information. Most of the laws regarding privacy tells you how your privacy being violated but they leave to us how to make these commercial entities to protect our personal information or stop them from selling it to the highest bidder.

Below are the some of the privacy protection laws for consumers which you need to be aware of:

Privacy act of 1974: this legoslation prohibits the federal government from creating secret database on individuals and limits how agencies can share information. This give you the right to request your information and to sue the government for failing to follow the Act. This might be important to know for the people who are on the no fly list database. For more details check out http://www.epic.com/privacy/1974act/

Fair Credit Reporting Act: FCRA lets you access your cedit bureau records and corrects inaccuracies and it alos allows you to obtain free credit resport every year.

Telephone Consumer Protection Act: This law does not provides a whole lot of protection against telemarketing calls but TCPA made it illegal to send unsolicited fax advertisement.

Family Educational Rights and Privacy Act: FERPA limits sharing of the students and lets you opt out.

Gramm leach Bliley Act: GLBA allows you to tell your bank to stop sharing your information with third parties.

Health Insurance Portability and Privacy Act: HIPAA gives you access to your medical records and limits the disclosure of medical information by health care entity or provider

More on Privacy and Law


« Previous Page