SIDEBAR
»
S
I
D
E
B
A
R
«
What is GLBA compliance?
Feb 1st, 2016 by aperio

(Part 7 in our series on IT Compliance Concerns.)
In the earlier posts in our compliance series, we covered SOX, HIPAA, and PCI DSS compliance. Here, we will examine what GLBA compliance is and how it might affect you and your company.

GLBA stands for Gramm-Leach-Bliley Act. This act is also referred to as the Financial Services Modernization Act. The GLBA primarily repealed parts of the Glass-Steagall Act by removing prohibitions against banking, insurance, and securities companies that prevented them from acting as combinations of investment banks, commercial banks, and insurance companies. The GLBA also regulates how financial institutions handle the private information of individuals.

The three sections of the GLBA that cover privacy issues are the financial privacy rule, the safeguards rule, and the pretexting provisions. The financial privacy rule deals with the collection and disclosure of private financial information. The safeguards rule requires financial institutions to implement security provisions to protect private financial information. The pretexting provisions prohibit accessing such information under false pretenses. The GLBA additionally requires financial institutions to provide their customers with privacy notices explaining the information sharing practices of the institution (although this requirement may be modified with recent legislation at the end of 2015).

Which companies are affected by GLBA compliance?
Financial institutions are the companies primarily affected. For example, a retail company would not need to be concerned about complying with GLBA rules, even though they might still have other obligations to protect their customers’ information. According to the University of Cincinnati’s Office of Information Security:

“GLBA covers businesses such as banks, appraisal companies, mortgage brokers, securities firms, insurance companies, credit card issuers, income tax preparers, debt collectors, real estate settlement firms, and other companies that may have self-financing plans… GLBA indicates that any business ‘significantly engaged’ in financial activities is subject to GLBA.”

In addition to this, companies affected by GLBA rules may also require their service providers to also follow them.

What are the penalties for failing to comply with GLBA?
There are severe civil and criminal penalties for noncompliance. These can include both fines and imprisonment. And it is not just the companies that can be penalized. Officers and directors can also face these penalties.

A financial institution violating GLBA rules may face:

●    Civil penalties of not more than $100,000 per violation.
●    Officers and directors of such a financial institution will be subject to, and personally liable for, a civil penalty of not more than $100,000 per violation.
●    Such an institution and its officers and directors will also be subject to fines in accordance with Title 18 of the United States Code or imprisonment for not more than five years, or both.

What does a business need to do to comply with GLBA?
Remember that compliance cannot be handled by your IT department alone. GLBA requires executive management to participate in responsibility for compliance.

Your company will need to keep your information security policies up-to-date, devote resources to continually identify potential risks, follow GLBA provisions for the release of both public and private information, be aware of whether it is necessary to provide annual privacy notifications, monitor the actions of third-party service providers, encrypt data, keep careful track of when it is time to destroy data, and possibly hire a lawyer or consultant to help with complexities.

Coming soon: Part 8 in our series on IT Compliance Concerns, “What Does My IT Team Need to Know About GLBA Compliance?”

To learn more about GLBA and related issues:

●    Gramm-Leach-Bliley Act definition.

Other posts in this series:
●    Part 1: Making Sure Your Business is SOX Compliant
●    Part 2: What Does Your IT Team Need to Know About SOX Compliance?
●    Part 3: What Does HIPAA Mean?
●    Part 4: What Does Your IT Team Need to Know About HIPAA Compliance?
●    Part 5: Is Your Company PCI Compliant?
●    Part 6: What Does Your IT Team Need to Know About PCI DSS Compliance?

If you want to know more about What is glba stands for, Feel free to contact us. We will assist you.

Leveraging IT Services for Re-Shaping the Healthcare Landscape and Transforming Their Operations
Jan 11th, 2016 by aperio

One of the largest sectors that relies greatly on information technology is the Healthcare industry. From hospital management, clinical development, regulatory compliance to research and development, technology plays a significant role. Owing to its widespread coverage, services and growing expenditure, this industry is growing at a tremendous pace. However, there are several challenges that continue to plague this sector.

Amongst several odds, two major challenges confronted by this industry include increasing service costs and the compulsion of providing medical care facilities to all sections of society irrespective of their purchasing power. In such a scenario, Information Technology’s role in providing high quality health services is rapidly growing.

With increasing penetration of technology in the healthcare industry, care providers, as well as, patients are enjoying the benefits of on-demand access to medical information as and when required. As the reforms and economy continue to present challenges, advancements in information technology (IT) will help ensure compliance with new legal requirements, besides providing improved patient care at low-cost.

The advantages of Technological Innovation:

    1. Data storage management systems are playing a significant role in maintaining patient records in an appropriate, secure, and easily accessible way.
    1. Advancements in picture archiving and communications systems, electronic medical records, and computerized physician order entry solutions are being implemented at a rapid pace.
    1. Medical practitioners are making rapid use of mobile computing. This has helped care providers to share electronic patient records and other information without delay. This has reduced medical errors significantly and have improved services for patients.
  1. For physicians certain solutions such as electronic scanning and maintaining records are being used more than ever before to augment administration efficiency, expedite insurance claim processing, and consolidate management of electronic record.

The growing complexity of modern medicine has paved way for several diagnoses, drugs, medical and surgical procedures that are available today. All this and more have taken patient care and service to the next level. This has resulted in increasing adoption of IT services, which indeed has significantly contributed to overall patient care and service.

Additionally, healthcare providers need to develop a robust IT road-map by adopting systems’ that can provide accurate and meaningful insights from humongous piles of data from different sources. However, to meet the growing demand for technology in this industry, robust IT infrastructure needs to be incorporated. With high-end IT infrastructure support and solutions in place, operational efficiency could be enhanced, processes could be transformed and productivity could be augmented.

Article Source: http://EzineArticles.com/9279990
To all a happy new year
Dec 22nd, 2015 by aperio

Happy Holidays from Aperio IT to you.  Thanks for making this a great year and we look forward to our next.

Has your router been hacked?
Dec 21st, 2015 by aperio

The Internet is a gigantic collection of linked networks that span the globe. The networks are connected using routers.

A router is a specialized computer that directs traffic on the Internet. As the Internet consists of hundreds of thousands of smaller networks linked together, the use of routers is absolutely necessary for it to function.

When you want to visit a particular website, you type the address of the site into your web browser. The address goes to the nearest router and the router decides where the required site is on the Internet.

The router also determines the most efficient path through all the networks to reach a particular destination… based on the traffic in different parts of the Internet and the available connections.

Cisco Systems Inc is an American multinational technology company that designs, manufactures, and sells networking equipment including most of the routers used on the internet. In fact, 85 percent of Internet traffic travels through Cisco’s systems.

Hacked routers

Security firm FireEye announced recently that its researchers have discovered malware (dubbed SYNful) on 14 Cisco routers in the Ukraine, the Philippines, Mexico and India.

SYNful replaces the operating system used in Cisco’s network equipment and thus opens a back door that provides a permanent foothold inside a targeted network.

This enables the hackers to harvest vast amounts of data while going undetected by existing cyber security defenses, according to Mandiant, FireEye’s computer forensic arm.

Cisco have confirmed that it has alerted its customers to these hacking attacks and said that it was working with Mandiant to develop ways for customers to detect the attacks.

Indeed Cisco has published intrusion detection signatures that customers can use to look for attacks in progress which, if found, can then be blocked.

If successful attacks are detected, customers will have to re-image the software used to control their routers.

It is highly probable that many other instances of these hacks have not been discovered, according to FireEye. Indeed it is likely that the infected routers are being used to infect other parts of the Internet.

Because the implanted software duplicates the normal functions of routers it could also affect routers from makers other than Cisco.

How bad is the threat?

Routers operate outside the perimeter of firewalls, anti-virus and other security tools used by organizations to safeguard data traffic.

This means that the estimated US$80 billion spent every year on cyber security tools is money down the drain where this form of attack is concerned.

According to Cisco, SYNful does not take advantage of any vulnerability in its own software. Instead it steals valid network administration credentials from the organizations targeted by the hackers so that it can install itself or it can be installed when the hackers gain physical access to Cisco routers.

No matter how it is installed, if a hacker seizes control of a router then he has control over the data of all the companies and government organizations that flow through that router.

According to FireEye, the affected routers have been used to hit multiple industries and government agencies. The company also says that the router logs indicate that the hacks began well over a year ago.

So what does all this imply for the ordinary consumer, who does his or her shopping and banking online?

The answer depends on who the hackers are working for.

The USA’s global spy agency, the NSA (National Security Agency), has a habit of intercepting networking equipment and installing backdoors before the equipment reaches customers.

This came to light in May 2014. In 2015, Cisco began offering to deliver this kind of equipment directly to customers in order to avoid interception by the NSA or other miscreants.

The latest findings from FireEye suggest that the miscreants, whoever they are, are managing to implant malware on routers no matter how they are being delivered.

While it is likely that the NSA or some other state actor is the culprit, this is not at all certain, even though FireEye says that interception could only be done a handful of sovereign states. In this writer’s view, the miscreants could well be a criminal gang intent on commercial gain.

Perhaps it would be as well to check with you bank to see whether they have any reservations regarding online banking in the light of these revelations.

Five Common Reasons for Data Loss
Dec 18th, 2015 by aperio

When the drive is damaged physically.

One of the most common reasons for data loss is physical damage. A simple manufacturing defect, or external influences such as shock, dust or power surges may cause internal damage. Anti-static discharge or ESD is also another common cause of failure. Physical damage will inevitably require the help of a data recovery expert. Unless you have a clean room and donor parts, any attempts to recover the data yourself will almost certainly render the data unrecoverable. A data recovery expert will assess the damage to your media before they can determine what parts of it may need to be replaced in order to have the drive working again. Often the expert will use a duplicate hard disk drive of the same make and model to replace damaged parts. Reputable experts will provide a file listing of files and quote for the recovery beforehand.

When the operating system fails.

Luckily if your operating system fails, it means that nothing is wrong with the hard drive itself. The data areas are usually safe, therefore your chances of a full recovery are high. All the expert needs to do is to copy the data from your hard drive to a new one. This can be easier said than done, so take advice. If you are not familiar with hard drives and data structures, don’t risk your valuable information.

When it dies of old age.

As hard drives grow old they experience unpredictable failures. All hard drives will fail at some point, but you will never know when. The mechanical parts of a hard drive will wear down over time and the media surface degrade. Eventually this will cause the drive to crash. Hard drives are becoming increasingly more reliable, but always read the manufacturers ‘mean time before failure’ or MTBF. This is normally calculated in hours and when this has expired, it might be time to upgrade.

If it catches a virus.

Computer viruses can be extremely malicious and damaging to your computer, whilst ransom-ware can be expensive if you fall victim. It is not only recommended but necessary to have a decent anti-virus program installed on your computer. Many users forget that malware doesn’t always present itself as a virus. So anti-malware software such as Malware bytes should also be considered essential. Some viruses will quickly spread around your computer and onto any networks your computer is connected to. So even if you have a mapped backup, catch any malware quickly before it spreads. Make sure you are extremely careful when downloading files and applications online, ensuring they are from safe sources, and don’t open any files emailed to you from an unknown source.

When you accidentally delete or overwrite data.

Manually overwriting data or accidentally deleting it is a common story. Many people will often think their data is already saved somewhere else and will delete the files. While data being overwritten is usually an accident, it is often intentionally done. In criminal and forensic circumstances data may be intentionally erased in an attempt to cover up the tracks of illegal activities, meaning forensic experts may be hired to perform data recovery for the hidden data. Unfortunately, it can be difficult and sometimes impossible to recover data that has been overwritten.

The best way to avoid data loss, is by simply backing up your valuable files on external hard drives or making use of cloud services. If you choose to back up your data, make sure to store it in a safe and secure location away from your computer. This will ensure any damage such as flood, fire or theft will not affect your backed up files. Also make sure that you are saving whole copies of the original files and remember to back up regularly.

SIDEBAR
»
S
I
D
E
B
A
R
«
»  Substance:WordPress   »  Style:Ahren Ahimsa