It's Open Season for Phone Scammers

Mobile and land-line phone calls can land you in a heap of trouble when a clever fraudsters is on the other end. I've recently published two blog posts outline several of these traps. 

The first is for business executives (and the general public, too), and it details three types of current phone scams that everyone must have on their radars.

The second is for the general public, as I go through scams targeting the elderly and the homeless. 

If you're the victim of a phishing attempt (either by phone or another mode of communication), share it with the authorities first. And then shoot me a note, as I would be very interested to know how the fraudsters managed to work their craft.

Countdown to the end of Windows XP

We're closing in on April 8, 2014, the day Microsoft will no longer offer support for the Windows XP operating system. The impact of this change is expected to be far-reaching, affecting everything from your local ATM machine to your own desktop and laptop computer. 

Of particular worry is the fact many medical devices run on the XP system. The discontinued support of XP will mean that medical devices running on, or connected to, XP devices will no longer receive security patches to protect them from viruses, spyware and other malware. I'll be covering this, along with a wide range of other risks, at my medical device information security and privacy workshop in May. I sure hope a lot of medical device manufacturers attend; they really need to beef up their protections!  

While it may take a significant investment to upgrade, the downside of not doing so could be every more costly in the long run. For personal computer users with XP systems, Microsoft is offering a $100 rebate to upgrade their systems, so take advantage! You'll save money in both the short, and definitely, the long term. 

A few new scams and privacy pitfalls

New ways to fool people out of their money, information and identities pop up nearly every day. Here's a quick round up of some of the latest tricks and traps:

New Scam Targets Homeless: Fraudsters pay homeless people to take out cell phone contracts in their names. The fraudsters keep the phones, rack up the bills and then sell the phones, ruining the homeless person's credit.

Getty Images Allows Free Embedding, but at What Cost to Privacy? People can embed images in their sites for free, so long as they use the provided embed code and iframe. Because of the scope of Gettys' reach, this may allow the company to correlate more information about a user's browsing history than any single site could. Just another reminder that nothing's truly free in this world!

Human Error Tops Ponemon Patient Data Security Study Threats: 75 percent of healthcare organizations view employee negligence as the greatest data breach threat. This result underscores the importance of good security and privacy controls (and excellent employee training!) in healthcare environments. This extends to medical device manufacturers, who often work off very old technology software and continue to insist that controls are too cost-prohibitive.

The Data Brokers - Selling Your Personal Information: 60 Minutes' Steve Kroft recently reported on his investigation of the multibillion dollar industry that collects, analyzes and sells the personal information of millions of Americans with virtually no oversight.

The number of privacy breaches continue to increase. I, and many others who have studied breaches over the past couple of decades, believe a large portion of these could have been prevented if there had been regular, effective information, security and privacy training and ongoing awareness communications provided to all employees. 

Too many organizations do scant-to-no awareness activities. Regulators are cracking down on organizations that do not provide sufficient education. Because providing such education is a requirement under multiple regulations, such as the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm Leach Bliley Act (GLBA), just to name a couple, the fines are often increased when regulators discover organizations did not provide such education.  

Have you received information security and privacy training from your employer? Do the organizations that collect your personal information provide adequate education to their employees? Don't be afraid to ask them about this.  

I provide the quarterly Protecting Information Journal to organizations to help ensure everyone knows how to appropriately protect personal information, and as a result, prevent breaches from occurring. If your organizations don't have such education, please point them to this resource.