Travel and Off-Site Meeting PolicyTravel Off-Site Meeting Policy

Protect your data from lost and theft

Travel and Off-Site Meeting Policy - Protection of data and software is often is complicated by the fact that it can be accessed from remote locations. As individuals travel and attend off-site meetings with other  employees, contractors, suppliers and customers data and software can be compromised.  This policy is seven (7) page in length and covers:

  • Laptop and PDA Security
  • Wireless and Virtual Private Networks (VPN)
  • Data and Application Security
  • Public Shared Resources
  • Minimizing attention
  • Off-Site Meetings
  • Remote Computing Best Practices

This policy has been updated to reflect the requirements of PCI-DSS, Sarbanes-Oxley, HIPAA, and ISO.  The policy comes as both a WORD file and a PDF file utilizing a standard CSS style sheet.

Order Policy

Laptops can and do get lost or stolen. In studies conducted by several security firms, it has been found that over 50% of all lost or stolen laptops disappear at airport security checkpoints an departure gates. Unfortunately almost 70% of these laptops are never recovered.

Lost Laptops

Order Policy

Mobile Device Security Options

Mobile security options

Because mobile devices reside outside the company firewall and beyond the reach of corporate security policies, they are often where unauthorized activity can occur. Users can inadvertently pass viruses, spyware, and other malware to the company network through the VPN. It still matters that a network has a formidable configuration of layered security, but when a notebook or smartphone is lost or stolen, the data stored on the notebook’s is exposed. Enterprises have to have ways to protect that data regardless of its location or place of breach. Options available to the enterprise include:

  • VPN - Many enterprises use Internet Protocol Security (IPSec) VPNs, but the fact that IPSec works at the network layer can add exposure of the entire network to malware found on remote machines. Secure Sockets Layer (SSL) VPN technology works at the transport layer of the Transport Control Protocol/Internet Protocol (TCP/IP) stack and is session-oriented, offering more precision in granting access -  even down to a specific application, file or window of time. Some vendors are offering all-in-one appliances that package not only VPN working on both layers, but also firewall, intrusion prevention and network antivirus.
  • Network Access Control (NAC) - NAC gives the network the ability to grant access to a device based on preset criteria, and then monitor it throughout its connection cycle. If the device behaves in a way that is out of line with policies, it is quarantined, given an opportunity to remediate and then disconnected if it remains noncompliant.
  • Encryption - A data-level form of protection, encryption is centrally managed and updated. It works by jumbling data according to a complex algorithm that machines are able to unlock once they have been authenticated. Everything from a single file to the entire hard disk can be encrypted.
  • Intrusion detection and prevention - Intrusion detection and prevention systems focus on identifying incidents, logging information about them, taking action to stop intrusions and reporting incidents to administrators for further review. These systems work well to stop unusual IPs and to block worms, botnets and other malware. They add an additional layer of security between the firewall and antivirus software.
  • Remote Lock Down and Data Destrition - Credentials and devices that are tagged as inactive can have "self desruct" or "remote lock down" code downloaded and activated in such a way that all of the "sensitive data" on the remote device is "erased" and the device put in such a state that it is not usable with intervention by the enterprise.. Extreme care should be used if this option is used and the help desk should have procedures in place so that devices remotely locked down in such a manner can be re-activated.
  • Data leakage protection - You can secure data, regardless of where it is in relation to the network, with data leakage prevention (DLP) technology. DLP solutions tag data based on a set of criteria such as location of data, application type, file type, keywords and common data strings. These tags alert IT when the data is being used in a certain manner. DLP can prevent the data from being copied, e-mailed, sent via IM, printed, saved to a different device, changed to a different file type or otherwise altered.

Order Policy


Individual Policies

All of the policies that are provided here are contained within one or more of the templates that are on this site. These policies have been added as individual documents in WORD format (WORD 2003 and WORD 2007) for those clients who just need this particular policy. All policies are Sarbanes-Oxley, HIPAA, PCI-DSS, and ISO compliant.

 


 

Mobile communication policyInternet,
e-Mail, Social Networks,
Mobile Device,
Electronic Communications, and
Record Retention  Policy

This policy is is compliant with all recent legislation (SOX, HIPAA, Patriot Act, and Sensitive information), and covers: PDA Devices

  • Appropriate Use of Equipment
  • Mobile Devices
  • Internet Access
  • Social Networks
  • Electronic Mail
  • Retention of Email on Personal Systems
  • E-mail and Business Records Retention
  • Copyrighted Materials
  • Banned Activities
  • Ownership of Information
  • Security
  • Sarbanes-Oxley
  • Abuse

Included with the policy are forms that can be used to facilitate the implementation of the policy. Included are these ready to use forms:

  • Internet & Electronic Communication Employee Acknowledgement
  • E-Mail - Employee Acknowledgement
  • Internet Use Approval Form
  • Internet Access Request Form
  • Security Access Application Form

Order PolicySample policyVersion History

The WORD template uses the latest CSS style sheet and can easily be modified to conform to the style used in your enterprise policy manual.
 

CSS Style Sheet

 

Order PolicySample policyVersion History

 


 

Outsourcing PolicyOutsourcing Policy

Outsourcing Policy - This policy is eighteen page in length and defines everything that is need for function to be outsourced.  The policy comes as a Microsoft Word document that can be modified as needed.  The template has been updated to include a HIPAA audit program definition in length and covers:

  • Outsourcing Management Standard
    • Service Level Agreement
    • Responsibility
  • Outsourcing Policy
    • Policy Statement
    • Goal
  • Approval Standard
    • Base Case
    • Responsibilities

 

Order Outsourcing PolicySample Outsourcing Policy

 

Note: Look at the Practical Guide for Outsourcing over 110 page document for a more extensive process for outsourcing


 

Sensitive Information Policy

Includes HIPAA Audit Program Guide and a PCI Audit Program

Sensitive Information PolicyThis policy is easily modified and defines how to treat Credit Card, Social Security, Employee, and Customer Data.  The template is 34 pages in length and complies with Sarbanes Oxley Section 404, ISO 27000 (17799), and HIPAA.  The PCI Audit Program that is included is an additional 50 plus pages in length.

This policy applies to the entire enterprise, its vendors, its suppliers (including outsourcers) and co-location providers and facilities regardless of the methods used to store and retrieve sensitive information (e.g. online processing, outsourced to a third party, Internet, Intranet or swipe terminals). 

The HIPAA Audit Program Guide provides you with a checklist of the must be implemented items which HIPAA mandates. 

You can download the Table of Contents and some sample pages by clicking on the link below.

Order PolicySample policy

 


Backup and Backup Retention Policy

Backup Policy & Backup RetentionIT organizations of all sizes contend with a growing data footprint with more data to manage, protect and preserve for longer periods of time. Online primary storage, has focus a on fast lowlatency, reliable access to data while near-line secondary storage has a focus on low cost and high capacity. Long-term data retention requires a combination of ultra-low cost, good performance during storage and retrieval, and reduced footprint in terms of power, cooling, floor-space and economics (PCFE) - also known as a small green footprint - for inactive data.

Factors that CIOs and IT professionals need to consider for data retention include:

  • Business and regulatory requirements – regulatory compliance and data preservation
  • Economic and budgetary concerns – doing more with less
  • Data loss prevention and information protection – protect, preserve and serve
  • Environmental and business sustainment – green and economically efficient
  • Maximize IT resource effectiveness and return on investment (ROI)
  • Reduce total cost ownership (TCO) of IT resources and service delivery

The Backup and Backup Retention policy is an 11 page sample policy that is a complete policy which can be implemented immediately. 

The document is provided in both Word 2003 and Word 2007 format and is easily modified.  This policy is included in the Disaster Recovery / Business Continuity Template.

Order PolicySample Policy

Below is a table from the policy:

Type of Data

Minimal Backup Policy

Backup Retention Policy

System software

Latest Version plus patches
 At Least Weekly

Annual (verified) Backup
Monthly Generations
Weekly Generations

Application software

Latest Version plus patches
At Least Weekly

Annual (verified) Backup
Monthly Generations
Weekly Generations

System data

Daily

Annual (verified) Backup
Monthly Generations
Weekly Generations
Daily Generations

Application Data

Daily with real time transaction files

Annual (verified) Backup
Monthly Generations
Weekly Generations
Daily Generations

Software licenses, encryption keys, & Protocol Data

Weekly

Annual (verified) Backup
Monthly Generations
Weekly Generations

Order PolicySample Policy

 


 

 

 

 

 

 

IT Policies and Procedures News




What is the Chief Technology Officer's (CTO) Role

CTO Job DescriptionThe Chief Technology Officer (CTO) is responsible for overall direction of all technology functions associated within the enterprise.  This includes Information Technology applications, communications (voice, data, and wireless), and computing services within the enterprise that impact the both the enterprise, its products and its customers.  As the top technical architect of the enterprise he or she provides a vision of how technology can be applied.  These areas include product design, customer interactions with the enterprise, IT operating systems, communications (voice, data, and wireless), transaction processing and database administration, compliance with all mandated requirements, the information center, personal computers, electronic and optical storage, and multimedia applications.

You can get more by getting the Internet and Information Technology Position Descriptions Handiguide - 2010 version.

- more info



Virtualization improves disaster planning and change control

Word Template
IT has been reported that organizations implementing virtualization often experience less server downtime than organizations not deploying virtualization, and many have taken steps to provide better disaster recovery than they could have in an unvirtualized environment.  Several surveys show  that virtualized environments experience between 35%  to 40% fewer server outage hours per year than unvirtualized environments.

The reasons often given are:

  • Simplification - Virtualization allows more OS workloads and more applications per server. This results in fewer servers and more standardization, which results in easier provisioning of new or redeployed applications.
  • Independence - Since the OS/application workload does not tie to a specific physical server, IT Management can migrate their workload from server to server thus becoming free a particular server. This facilitates the ability to dynamically migrate  applications from an overused or failing server to a healthy server, avoiding outage.
  • Flexibility - Virtualization simplifies the process of initiating an OS/application. This enables IT management to have options for locating the OS/application on a particular physical server.  In that way IT Managers can easily suspend, relocate, and restart applications that are degrading on a server.

IT Infrastructure, Strategy, & Charter TemplateIT Service Management SOA Change Control

  • Better Change Management - Virtualization makes it easier for system administrators to set up a replicate test OS image, which makes it easier to fully regression test new configurations (new application releases, new software versions, etc.). Fuller regression testing of new configurations results in fewer defects encountered in production.
- more info



I.T. hiring picks up

Salaries and hiring are both on the rise, Janco reports.

The I.T. jobs outlook is strongest among large companies, where many chief information officers have received the go-ahead to fulfill I.T. positions that were left unfulfilled last year, Janco Associates Inc., a management consulting firm specializing in information systems technology, says in its Mid-Year 2010 IT Salary Survey report.

In contrast, technology executives at smaller companies are being more cautious about hiring out of concern that the economic recovery will not be strong enough to support increased I.T. spending, the survey found.

Nonetheless, most chief information officers who participated in the survey said in post-survey interviews that they’re planning for 2011 with the assumption that the economy will improve early next year. If that holds true, I.T. hiring and compensation should rise for more companies, Janco says

- more info



Consequences of too much social networking

Facebook, MySpace, and other social networking sites make it easy to share information with friends. If you are not utilizing safety features and precautions, however, you are also sharing that information with strangers. Posting too much information on your profile can have consequences that reach all the way from your bank account to your future employment prospects.

According to Consumer Reports, in the last year 9 percent of social network users experienced some form of abuse, such as malware infections, scams, identity theft, or harassment. Many of these incidents are preventable, if you educate yourself about what to do and what not to do on social networking sites.

Similarly, an increasing number of prospective employers are turning to social networking sites to research applicants. Does your profile represent you the same way you would represent yourself in an interview?

- more info



Challenges CIOs face

IT Job Descriptions

CIOs are now challenged more than any time in the past with the economic earthquake around the globe CIOs have to be smarter, creative and innovative. The only way for CIOs to survive the world economic reset in a knowledge age is to capitalize on our human capital, put their staff’s creativity to work, stoke our innovative furnace. There are many ways to fuel the creative fires - from management techniques, to team building, and effectively leveraging existing and emerging technological investments.  However, the key is infrastructure.  CIOs that have a one that address metrics, change management, version control, system development methodology, service management, and human resources have a better chance to make it through these tough times.

- more info



Preventing Data Breaches

Security Manual - Sarbanes-OxleyIt is critical that organizations are proactive in their approach to mitigating insider threats. Week-after week there are disturbing, déjà vu-like stories of significant data breaches, arrests connected to insider attacks, or investigation reports emphasizing the necessity to control privileged accounts that hold highly sensitive data. With no safeguards in place, insider attacks are often very difficult to detect and block, largely because of excessive privileges granted to users, users sharing common log-ins and accounts, and privileged users such as testers, developers and even DBAs having access to sensitive data.

OrderDownload

This Security Manual for the Internet and Information Technology is over 220 pages in length. All versions of the Security Manual template include both the Business & IT Impact Questionnaire and the Threat & Vulnerability Assessment Tool (both were redesigned to address Sarbanes Oxley compliance).   In addition, the Security Manual Template PREMIUM Edition  contains 16 detail job descriptions that apply specifically to security and Sarbanes Oxley, ISO 27000, PCI DSS, and HIPAA.

- more info



Reasons why CIOs and CTOs get Fired

Top ten list of things that fired CIOs do

1.       Do not have a disaster recovery and business continuity plan integrated with a backup/archiving program.

2.       Ignore warning signs

3.       Do not document changes

4.       Do not use logging processes

5.       Do not install updates

6.       Save money by not purchasing upgrades

7.       Do not manage passwords well

8.       Never say no to anyone

9.       Never say yes to anyone

10.   Do not train a replacement

- more info



Project Managers are paid well

Companies seem willing to provide solid compensation for project maagers. According to a CIO.com  article reporting results of the Project Management Institute's (PMI) 2009 Project Management Salary Survey, the median base salary for a project management professional in the United States is $100,000. Three-quarters of survey respondents take home more than $84,000 a year.

IT
 Salary Survey

Even during the recession, between fall 2008 and fall 2009, 53 percent of American project managers got a raise. Thirty-four percent had salaries frozen, and 14 percent experienced a pay cut.  And project management pros have an optimistic outlook for 2010. Sixty-seven percent of respondents believe their salaries will grow this year, while just 4 percent think their salaries will drop.

You have several options to obtain this study.  You can get a summary for free if you participate by providing more than ten (10) data points or you have several option on how to purchase the data.

Order IT 
Salary SurveyDownload IT Salary SurveyParticipate in IT Salary Survey

Summary Results and Changes in Demand for IT Jobs 2010

Historical IT Salaries

The Janco Associates, Inc.  salary survey draws on data collected throughout the year by extensive internet-based and completed survey forms sent to businesses throughout the United States and Canada.  Over 300 companies participate in the survey

- more info



CIO and IT departments are blamed for user shortfalls

Now the CIO not only must be politically correct, but he must also be clairvoyant and understand what can go wrong, be misused, or be abused. The IT Infrastructure must be robust to address this.

When systems are abused the easiest scapegoat is the IT Department.  In the recent school webcam case at the Pennsylvania school district the IT department was blamed because they not only failed to inform school officials and administrators of the tracking capabilities of the software, but argued that telling students about the software's ability to remotely trigger notebook Webcams would "defeat its purpose" as a way to recover lost or stolen computers.

- more info



Over one third of HR executives ignore unemployment status of employment candidates

Salary Survey ITBoston - Results from new research released by Veritude, astaffing services provider, indicate a positive sign for the New England economy. All surveyed executives in New England, and across the country, are accepting of the economy as a reason for an extended unemployment when reviewing candidates. Specifically, when it came to examining the acceptable length of time for a candidate to be unemployed, 36 percent of responding executives said they did not believe it mattered how long a candidate was unemployed given the recessionary conditions, with 36 percent indicating that six months or less was their ideal length of unemployment.

The survey also revealed that when making hiring decisions, 44 percent of executives have no preference for a candidate's employment status. In addition, one-third of New England hiring managers and human resources professionals are considering rehiring information technology (IT) employees whom they had laid off.

IT Hiring IT Job Descriptions IT Salary Survey“According to our survey results, it appears that 2010 will be a better year for IT job seekers in New England,” said a senior vice president of Veritude. “With half of employers looking to hire back a portion of their laid off IT workers either as full time employees or contractors and employers accepting the economic downturn as a reason for an extended unemployment, IT job candidates should take heart that their employment status will not significantly bias a potential employer.”

Although in the minority, 19 percent of those surveyed do prefer candidates who are currently employed as regular, full-time employees. Candidates who are either employed full-time or currently employed as temporary or contract workers are preferred by 22 percent.

Of all hiring executives, 53 percent did not care if a candidate was laid off in a first round as opposed to a subsequent round. While the majority did not have an issue with laid off workers, 17 percent of respondents found it more acceptable if a worker was not one of the first to be laid off.

- more info



Where CIOs spend their time

In a survey of CIOs, it was found that they spend most of their time:

  • Aligning IT with enterprise goals
  • Cultivating the IT and enterprise relationship
  • Improving IT operations and system performance
  • Leading change efforts
  • Implementing new systems and architecture
  • Driving business innovation
  • Redesigning business processes
  • Controlling IT costs
  • Developing the business strategy
  • Looking for a competitive advantage
  • Managing IT crises
  • Managing security
  • Selecting and negotiating with vendors
  • Developing customer market strategies and technologies
  • Studying and understanding market trends and customer needs
- more info



US at risk for cyber attacks according to study

A survey released by Lumension Security Inc. states that nearly three-quarters of federal IT decision-makers who work in national defense and security departments or agencies say the possibility is “high” for a cyber attack by a foreign nation in the next year. Additionally, a third of these respondents say they have already experienced such a cyber attack within the last year.

Of about 200 IT security managers in civilian and noncivilian federal agencies surveyed, 61% said there was a "high" threat of an attack being launched by a foreign nation sometime in the next year.

  • 33 percent of respondents who work for departments or agencies affecting national security say they have experienced an attack by a foreign nation or terrorist organization in the last year;
  • 61 percent of respondents view the threat of a cyber attack from foreign nations against critical U.S. IT infrastructure in the next year as “high”;
  • 42 percent of respondents believe the U.S. government’s ability to prevent or handle these attacks is only fair or poor;
  • 64 percent of respondents identified the increasing sophistication and growth in the volume of cyber attacks as the number one IT security risk; and,
  • 49 percent of respondents believe that negligent or malicious insiders/employees are the largest IT security risk.

At the same time, more than four out of 10 respondents in the Lumension survey said that they believe the U.S. government's ability to defend against the attacks is "poor" to "fair" at best.

- more info



Feds could learn from private sector IT

The federal government can learn a lot from the private sector to improve IT program management and customer service and create a more modern government, concluded attendees of a forum comprised of both federal and private-sector leaders.

The government should take a more business-minded approach to how it manages its IT projects, as well as step up efforts already in place to increase transparency and accountability, according to a recently released report about the White House Forum on Modernizing Government.

- more info



PCI DSS compliance is more than checklist managment

PCI DSS applies to any organization that accepts, stores or processes payment cards of any type and is a comprehensive checklist of actions these organizations must take to improve the security of global payment systems. Although the adoption of PCI DSS by an organization will most likely improve its security posture, being compliant with the PCI DSS does not ensure the organization is secure.

If Enterprises mechanically follow the PCI DSS checklist and our organization suffers a data securitybreach, they are still held responsible, and the organization still gets fined, suffers brand damage and may lose its ability to process credit card transactions. While checklists are useful tools, following them can lull us into a false sense of security.
To rely solely on the PCI DSS checklists to secure cardholder data is similar to a pilot relying only on the pre-flight checklist before takeoff, then colliding with another plane during takeoff. A checklist is not enough. In reality, the goal of effective security controls is to prevent security breaches from occurring, and when they do, to allow quick detection and recovery. This requires not just following a checklist, but understanding the organization’s compliance and security objectives, understanding what the top risks to achieving those objectives are, having adequate situational awareness to identify where we need controls to mitigate those risk, and then having implementing and monitoring the correct production controls.

- more info



Cost cutting starts with simplifying operations

Complexity produces cost, so IT departments may choose to standardize on a handful of preferred technologies or vendors. The biggest line item in IT budgets is people, so staffing must be addressed. That could mean hiring freezes, cutting back on use of consultants, replacing employees who leave with automation technologies (not another person) and similar measures to limit spending on people.

CIOs should plan proactively for spending cuts before they are mandated. That may involve rebalancing IT initiatives to focus on projects with near-term benefits while keeping momentum on longer-term, strategic projects. They also may need to align IT more closely with the business priorities, which are likely to focus on revenue.

- more info



Tax laws hamper IT independent contractors

 Section 1706 of the 1986 Tax Reform Act, an obscure law, certain classes of workers, including anyone who engages as a "computer programmer, systems analyst, or other similarly skilled worker engaged in a similar line of work," are considered de facto employees for tax purposes, regardless of whether they claim to operate their own businesses as independent contractors. The IRS can impose significant tax penalties on companies who hire such workers as contractors rather than full employees, a fact that can make it extremely difficult for self-employed programmers to find work.

Section 1706 was originally sponsored by Sen. Daniel Patrick Moynihan of New York, who hoped that forcing highly paid software developers to become employees would limit their ability to take advantage of tax breaks for small businesses. Ironically, it was also Moynihan who, when a study determined the law was not bringing in the desired tax revenue, tried to have it repealed a year later. He failed, and it's still on the books today.

Employees typically do not  have to pay for their own health insurance, the way contractors do. Individual health plans generally offer worse coverage than group plans, and they can be incredibly selective about who they allow to join. Those who are accepted can expect their premiums to rise every year, often by double-digit percentages. Given these conditions, developers who have families to support or preexisting medical conditions are well advised to hang on to their salaried jobs for dear life rather than run the gauntlet of the dysfunctional American health insurance industry.

And if the prospect of being bankrupted by medical bills is not frightening enough, add the increasingly hostile legal climate surrounding the software development profession. In response to all-too-common reports of software bugs and security breaches, some organizations have begun lobbying for contractual language that makes software developers accountable for any defects in their code. For example, the SANS Institute has proposed a detailed contract that would require developers to certify that they had received appropriate training, observed any and all security procedures deemed necessary, and that their code was free of defects to the best of their knowledge, among other clauses.

- more info



Windows Live Potential Data Breach

Microsoft is looking into reports that some Windows Live customers may have gotten access to other users' information.

"Microsoft is investigating reports of a limited number of instances in which Windows Live customers may have access to other customers' accounts when accessing their account through mobile Web browser," the company said in a statement Tuesday. "Microsoft takes customers' privacy seriously, and immediately upon learning of these reports, we started an investigation."

The company added that it "will take appropriate action once we have completed the investigation."

- more info



Metrics to Manage Performance Defined by Janco

The performance of the people within an organization determines the success of business outcomes. Without optimal performance an organization can find itself floundering in the market and eventually fizzling out. Measuring the performance of our people and our HR department is a critical function for making sound business decisions and performance management decisions. HR metrics can be valuable tools for ensuring our people practices are aligned with our organizational goals and supporting the effective and efficient use of our most valuable asset, our people.

- more info



Outsouring impact IT Service Management

Lack of proactive monitoring threatens end-user satisfaction and application performance

To operate a cost-effective business in today’s highly competitive market, an organisation requires an extremely efficient IT infrastructure to link its data centers, business operations and globally distributed customers. All business-critical applications must run smoothly to satisfy end-users’ and customers’ service level expectations. Consequently, an enterprise's IT support services play a vital role. Many international businesses, for example, operate multiple hosted data centers and have communication rooms in many of their overseas locations. These same businesses often outsource some of their IT operations management 

However, executives are concerned about poor visibility of IT infrastructure problems, high levels of service disruption, low end-user satisfaction and the impact on application availability. Visibility of an enterprise's infrastructure’s performance and availability are often inadequate because they have very little monitoring and performance information. Thus, they are a reactive organization. Enterprises must introduce an IT Service Transformation process to improve all aspects of IT Service Management (ITSM) and act as a foundation to monitor the critical business processes, which cover multiple applications and infrastructure integrated incident, problem and asset management.

Key objectives are to manage the infrastructure and applications proactively; generate a centralized system for their outsourced service providers; and link problems to their existing help desk.

- more info



Data Breachs Costly

Security Policies and Procedures and Audit ProgramThe financial consequences of data breaches can be severe. Many organizations lose customers and revenue because of the violation of trust incurred from a breach. Due to the growing number of state privacy laws, most breaches require that those whose information is compromised must be notified. Most organizations now pay for credit monitoring services for several years for all those impacted by a breach -- these services typically cost about $100 per person per year. And in some cases, organizations are subject to fines for revealing personal information.

Security Policy Manual (policies and procedures template) is over 240 pages in length. All versions of the Security Manual template include both the Business & IT Impact Questionnaire and the Threat & Vulnerability Assessment Tool (both were redesigned to address Sarbanes Oxley compliance). In addition, the Security Manual Template PREMIUM Edition contains 16 detail job descriptions that apply specifically to security and Sarbanes Oxley, ISO 27000 (ISO27001 and ISO27002), PCI-DSS, and HIPAA. Data Protection is a priority and security myths need to addressed.

- more info



Dow sinks over 600 points as China and Obama square off

Security Policies Procedures Security Audit ProgramWASHINGTON-- The Dow skids by over 600 points as the Obama adminsitration squares off with China.  China responds with "no more loans". 

U.S. Internet companies might soon need to find a new strategy for dealing with China.

In announcing that it is now U.S. policy to advocate a free and open Internet around the world, Secretary of State Hillary Rodham Clinton on Thursday essentially dared U.S. companies to follow Google's lead and put an end to their complicit censorship of Internet content. Google has said it will shut down its Chinese search engine if it can't find a way to offer an uncensored version under Chinese law, and while no one else has jumped on that bandwagon, they may soon have little choice.

"We are urging U.S. media companies to take a proactive role in challenging foreign governments' demands for censorship and surveillance. The private sector has a shared responsibility to help safeguard free expression. And when their business dealings threaten to undermine this freedom, they need to consider what's right, not simply what's a quick profit," Clinton said in remarks Thursday at the Newseum, before an audience including members of Congress, representatives from nonprofit groups, and perhaps more than one Internet company executive forced to ponder the meaning of that paragraph.

Clinton stopped short of actually proposing regulations or sanctions on Internet companies that comply with censorship laws. But her tone was clear: it's now the policy of the U.S. government to renounce corporate "engagement," or the belief that by merely being in countries like China, U.S. Internet companies are helping expand access to information.

Will it work? Google, Microsoft, and Yahoo have already formed the Global Network Initiative, a consortium of companies and organizations designed to provide guidelines for operating in countries with authoritarian governments without turning into tools of those governments. Clinton acknowledged the work of the GNI during her speech, but is calling on companies to do more.

- more info



Firefox plugs away in a tough market

Mozilla released a second release candidate of Firefox 3.6 browser, a modest upgrade that embodies Mozilla's effort to increase the frequency the open-source browser is developed.

The president of Firefox, announced second Firefox 3.6 release candidate Sunday but didn't share details. The release notes were equally mum, but the update process called the new software a "security and stability update."

Browser Market Share

        

The software is available from Mozilla's download site. More than 1 million people are testing Firefox 3.6 at present, and more than 300 million overall use Firefox, Mozilla said.

The new version includes Personas to let people customize the browser's appearance; blocks third-party software from encroaching on its file system turf to increase stability; and--perhaps most significantly given the competitive threat from Google Chrome--shortens start-up time and improves responsiveness and JavaScript performance.

- more info



Wireless spectrum may be overloaded

IT Infrastructure, Strategy, & Charter TemplateThe FCC has identified the limited supply of wireless spectrum as one of the factors that could limit the growth of broadband Internet services in the U.S., which could result in slower economic growth and job creation.

Wireless spectrum will be addressed, along with other factors affecting broadband access and services, in a national broadband plan that the FCC is now assembling. The plan was originally due to be completed next month, but the FCC received a 30-day extension from the U.S. Congress.

The wide array of devices on display at CES that rely on wireless broadband underscores the urgency of resolving the spectrum issue, Genachowski said. "The wireless infrastructure in the U.S. will be our platform for ongoing innovation and investment," he said.

Order Infrastructure TemplateDownload Infrastructure Template

With the explosion of technology into every facet of the day-to-day business environment there is a need to define an effective infrastructure to support operating environment; have a strategy for the deployment and technology; and clearly define responsibilities and accountabilities for the use and application of technology.

- more info



New CTO for Virginia

Virginia Bob McDonnell has nominated Jim Duffey to serve as his secretary of technology, according to announcement today from the Northern Virginia Technology Council.

IT Hiring IT Job Descriptions Salary SurveyIT Salary SurveyIT Job Descriptions

Duffey, president and chief executive of Duff Consulting, spent 24 years at EDS Corp., where he held a variety of positions in the United States and Europe, including three years as vice president and public-sector general manager, responsible for all of EDS' state and local, federal, civilian, military and Medicare client relationships.

He also is a former vice president and public-sector general manager at Dell.

Duffey has served on NVTC’s board of directors since 2004 and was vice chair from July 2006 to January 2009.

"Jim will bring a strong private-sector perspective to state government and enthusiastically champion the issues and initiatives that are so critical to our regional and statewide technology community," said NVTC Chairwoman, president of U.S., Europe and Asia at CGI.

 

- more info



Credit Card Haker Pleads guilty

Security Policies Procedures (Reuters) - A 28-year-old college dropout pleaded guilty on Tuesday to charges that he stole tens of millions of payment card numbers by breaking into corporate computer systems.

The hacker, Albert Gonzalez, told a federal judge in Boston that he had engineered electronic thefts at companies including the card processor Heartland Payment Systems, the convenience store 7-Eleven and the Hannaford chain of New England grocery stores.

Mr. Gonzalez has previously pleaded guilty to computer break-ins at the retailers TJX Companies, BJ's Wholesale Club and Barnes & Noble.

"You face a considerable amount of time in jail as a result of your plea," Federal District Judge P. Douglas Woodlock told Mr. Gonzalez. "All aspects of your life are to be affected."

OrderTable of Contents

A federal court in Boston last week sentenced one of Mr. Gonzalez's conspirators, Stephen Watt of New York, to two years in prison for developing the software used to capture payment card data. It also ordered Mr. Watt to pay $171.5 million in restitution.

- more info