In the wake of the RSA, Epsilon and Sony PlayStation data breaches, we spoke to two global information security leaders and asked for their three biggest leadership lessons learned. Here is what they shared.
ID fraud prevention requires partnership, and according to Javelin, the future of fraud-detection should be built around integrating a bank's back-end solutions with the fraud-prevention and detection solutions in which consumers are already investing.
"Our security teams were working very hard to defend against denial of service attacks, and that may have made it more difficult to detect the intrusion quickly, all perhaps by design," Sony Computer Entertainment America Chairman Kazuo Hirai said in a letter to Congress.
The so-called POS "swap" attack is rare, but effective, not only against mag-stripe cards but chip-based cards as well. The same mode of attack was used against Hancock Fabrics, leading to card fraud that affected more than 140 customers.
From mobile devices to social media and cloud computing, IT governance is all about risk management. "You can't de-risk everything, but you can de-risk the majority of circumstances you will see in normal operations," says governance expert Robert Stroud.
After firing four employees, including the heads of IT and information security, Texas Comptroller Susan Combs has taken personal responsibility for a security breach that exposed the personal information of some 3.5 million individuals.
Experts warn of ingenious phishing attacks based on the latest news. "This is one of those rare opportunities that can build you a great list and a couple of zeros in your profit," one hacker is quoted as saying.
Anti-money laundering expert Kevin Sullivan says that U.S. banking institutions should not take Osama bin Laden's death as a sign that they can let their AML and BSA screenings become more lax. "We have not defeated terrorism yet."
Sony says personal information from more than 100 million customer accounts has been breached. The information includes customers name, addresses, e-mail addresses, birth dates, gender, phone numbers, login names and hashed passwords.
The non-standardized collection device is responsible for 13 percent of the biometric records maintained by DOD, representing some 630,000 DoD records that cannot be searched automatically against FBI's database of about 94 million records.