ControlScan Blog

Posts Tagged: Risk Management



  1. Home
  2. ControlScan Blog
  3. Posts Tagged: Risk Management

Cybersecurity-Related Financial Risk as a Board Imperative

October 16, 2020 • Published by
•

Over the last few years, organizational board members have taken an increasing interest in cybersecurity as a financial risk. If you think about it, this makes sense because securing your company’s data stops the bleed of shareholder value. The value of data is changing, so the level of protection you need to apply is changing. Companies are looking at these things to maintain their brand and viability.

  Read More   

What is Your Cybersecurity Risk Appetite?

September 21, 2020 • Published by

Early on in my security career, while studying for my CISSP certification, the author of the book I was reading presented a concept of how to treat risk once it is known. Management has the choice of treating, accepting, deferring, or denying the risks that are found or identified. While most all security frameworks require […]

  Read More   

HIPAA Compliance and the Million Dollar Laptop

August 14, 2020 • Published by
•

I must admit that when I sat down to write this blog post I felt a bit silly writing out the title “The Million Dollar Laptop.” This is not a post about a wildly overpriced and new, barely changed, or updated piece of tech that Apple is releasing, or some exorbitant gaming laptop that you are hoping to purchase to play Fortnite or Minecraft. No, this is about the simple neglect of a lost device. Neglect that cost a healthcare organization $1,040,000.00.

  Read More   

Merchant Acquiring Trends: The New “Scalpel Approach” to Security and Compliance

July 8, 2020 • Published by
• •

There is a fine line being walked in the merchant acquiring and payments space. As both the primary players and the smaller providers know, merchants’ security threat landscape continues to shift and expand at a rapid pace. Guiding merchants down the path of implementing security protocols to protect the merchant, and mitigating breach risk for the processor, can be challenging. We see acquirers meeting this challenge through what I call a “scalpel approach.”

  Read More   

How to Identify Your Company’s Security Risk

May 13, 2020 • Published by

Individuals in the security industry often comment that the foundation of any company’s security program is its policy and procedures. I am not saying they are incorrect; however, I do not believe they see the big picture. Policy and procedures look to address risk, but they do not define it. Therefore, the foundation of any security program is formed by the activities around risk identification.

  Read More   

How Much Security is Enough?

May 20, 2019 • Published by

Every diligent company or organization understands cybersecurity is needed, but often doesn’t know how to budget for the appropriate protection. It’s not always a clear-cut number, but there is a way to develop a return on investment (ROI) or return on expense (ROE) equation that you can share with your budgeting team and C-level executives who are looking to you for answers.

  Read More   

Minimizing the Human Impact on Data Security

August 28, 2017 • Published by
•

These days many organizations do not feel confident about their ability prevent a data breach, mainly because they feel they can’t trust the humans working for them. And for good reason! Cyber criminals continue to exploit the human element, which was blamed for over 400 reported data breaches and 7.6 million+ compromised records in 2016.Regardless of whether the employee is knowingly part of a malicious effort, or is inadvertently involved in allowing an intrusion or other form of unintended disclosure, a breach of valuable data is not what you want to have happen. Therefore, you must minimize the human impact.

  Read More   

Four Common HIT Cybersecurity Gaps You Can Close Now

March 17, 2017 • Published by
•

The U.S. Department of Health and Human Services maintains an online database that HIT cybersecurity pros refer to as the “HHS Wall of Shame.” It’s an exhaustive listing of all healthcare data breaches resulting in the loss of 500 or more PHI records. No one wants to end up there, but the fact is, 318 healthcare organizations were listed on the HHS Wall of Shame in 2016. Altogether, these breaches were responsible for the loss of more than 16 million records.Understanding the security gaps that could put your organization on the Wall of Shame starts with conducting a proper risk assessment on a regular basis. In my experience, however, most organizations don’t ever get started. Read on to learn about the four common HIT cybersecurity gaps that can put you on the Wall of Shame, and how to close them.

  Read More   

Healthcare Data Breaches, Compliance and the HIT “Fear Factor”

January 13, 2017 • Published by
• •

It’s Friday the 13th and there’s a “fear factor” in health IT. If you don’t know where your HIT organization’s security and compliance weaknesses lie you’re likely feeling that fear—today and every day.But don’t try to fight off cyber criminals with monster spray! Read this blog post and learn how to arm your organization appropriately.

  Read More   

The Healthcare Security Risk Assessment

October 25, 2016 • Published by
•

Countless healthcare organizations have been targeted recently by cyber attacks, and many were caught with little to no IT security safeguards in place. The most frustrating thing is that it could have been prevented if proactive security measures had been taken.

  Read More   




Back to Top