Imagine this scenario: you’ve received some test results from some procedure. Those results are to be moved between institutions because you have doctors in different departments of a healthcare system. 

Normally, we’d think that these institutions would electronically transmit these results through some secure channel… but then you see that your doctor has your results, in hand, in a USB key that they plug into their computer. 

This, of course, is a considerable risk. HIPAA regulations require that institutions protect PHI in specific ways with straightforward controls, and many threats can undermine physical media. 

So, what’s the issue with using USB thumb drives? 

Read More

With modern IT infrastructure becoming increasingly complex, intertwined systems managed through service providers and managing experts, the inevitable security problem rears its head. How can one organization, using several service providers, ensure their data security as it travels through those systems?

Over the past decade, enterprise and government specialists have refined the practice of risk management and security-focused on digital supply chain management. To support such efforts, the National Institute of Standards and Technology (NIST) released the newest revision, NIST 800-161, in May 2022. 

Read More

Over the past few weeks, we’ve talked quite a bit about risk:

• What it is.
• How it applies to compliance.
• How you can start to think about it as an aspect of your overall business strategy. 

In many of the cases we’ve discussed, we’ve referred to risk in terms of mitigation–how to close the gap between your security capabilities and potential threats in the wild. 

But what’s critical to understand about risk is that it is just as much about how much risk you want to take on as you want to remove. And, when discussing potential risks concerning business goals, you must consider your risk appetite statement. 

Read More