Today we've released an updated version of our business case for a security awaeness program . I wrote the first complete version of this paper a few years ago, developing a set of ideas I'd had and written into budget applications and investment proposals over previous years. It gets updated every year or so to reflect the state of the art and remains one of the most popular white papers on our website. I'm currently working on an ENISA project developing advice for organizations on building the business case for security awarness. The project team members represent a variety of experiences and backgrounds so it will be fascinating to see how things work out. I'm sure the end result of our work will be a useful and worthwhile document but, as is so often the way with collaborative projects of this nature, a productive team gets even more value from the writing process - sharing thoughts and methods, discussing common issues, explaining things and illuminating the t...

According to the Beeb , the UK credit reporting agency Experian has analyzed its records to profile typical victims of identity theft. The results are thought provoking. "Company directors or those running their own businesses are most likely to be victims of identity theft, according to a report from Experian." Um. So company directors are unable to spot phishing and similar ID theft scams? I thought being in a responsible management position implied a level of intelligence, integrity and ability. Perhaps the phishers and other identity thieves are a step ahead after all. "The credit reference agency said 6,000 victims in the UK asked its staff for help last year, a 66% rise on 2006." Oh oh. Either ID theft has risen significantly, or Experian's marketing wizards have had an exceptional year. "The most likely victims were aged between 26 and 45, earned more than £50,000, rented their home and lived in London, Experian's analysis found." OK,...

It's out! The latest NoticeBored awareness module on phishing and identity theft. It's no coincidence that this module follows last month's on IT fraud, integrity & trust. We try to link successive modules in some way for continuity, making the awareness program flow a little. It will be an interesting challenge for us to link from phishing/ID theft to next month's one on information security and risk management, though, but we'll give it a go.

The BBC reported that over 38,000 patients' confidential health records have gone missing on a backup tape from an NHS Health Centre on the Isle of Wight. The tape was lost by a courier firm en route back to the centre after having been checked for integrity. Though the centre was clearly concerned about data integrity, confidentiality seems to have been further down their priority list: "The risk of the tape being misused is extremely small," the trust spokesman added. "The tape requires specialist computer equipment to run it and the data is password-protected. Highly advanced computer skills and/or access to a specialist programme only normally used by GPs and the data verification company are needed to make any sense of the information on the tape." The 'specialist computer equipment' is presumably some sort of tape drive. OK, so it's not the kind of thing that everyone has laying around in their bedroom but some do, and specialist data rec...

(ISC)2 , the organization behind SSCP, CISSP and CISSP-concentration certifications, has released a new blog aimed primarily at qualified information security professionals but also relevant to those just considering qualification and in fact anyone with an interest in information security. I'm delighted and humbled to have been invited to join the blogging panel alongside a range of well known and highly experienced colleagues. As the (ISC)2 blog develops, I expect I will be blogging less frequently here on the NoticeBored blog on topics that are not directly related to our current monthly awareness topic, moving those general interest posts over to the (ISC)2 blog ... so, if you want to continue seeing all these little pearls of wisdom plus others from the erudite (ISC)2 blogging panel, please subscribe to the (ISC)2 blog as well as this one. It's free, of course, and easy to track through blog aggregators such as Bloglines .

Most inbound 419 scams go directly to my spam box but every so often one escapes detection and lands up in my inbox. 99% of those get instantly deleted .... but oh I do enjoy the remaining 1%. Here's a classic example: ------------------------- Assistant Director in Charge Joseph Persichini, Jr J. EDGAR. HOOVER BUILDING WASHINGTON D.C 13/10/2007 http://www.fbi.gov ROBERT MUELLER EXECUTIVE DIRECTOR FBI FBI SEEKING TO WIRETAP INTERNET. ATTNETION THIS IS TO BRING TO YOUR NOTICE THAT WE THE FEDERAL BUREAU OF INVESTIGATION (FBI) HAVE BEEN CONTACTED BY THE OFFICE OF THE PRESIDENCY FEDERAL REPUBLIC OF NIGERIA TO COMMENCE WORK THROUGH OUR INTELLIGENCE MONITORING NETWORK TO MONITOR THE ON GOING TRANSACTION BETWEEN YOU AND THE (INTERNATIONAL CREDIT SETTLEMENT DEPARTMENT/KTT CENTRAL BANK OF NIGERIA.) WE HAVE BEEN INSTRUCTED TO MAKE SURE THAT THE OUT STANDING PART PAYMENT WHICH IS SET AND READY TO BE PAID TO ALL THE BENEFICIARIES AND INHERITORS IS MADE TO THEM COMP...

Today I've been browsing the good stuff going on over at Unified Compliance Project whose aim, as I understand it, is essentially to help organizations find and exploit alignments between various compliance requirements, eliminating duplication and hence reducing the total amount of compliance effort required. For example, implementing an ISO/IEC 27001-compliant Information Security Management System (ISMS) should simultaneously satisfy most if not all legal requirements for information privacy controls (with no additional effort), and should at least partially satisfy governance requirements arising from SOX, in addition to miscellaneous business benefits as a result of having a best practice ISMS. One of the issues I've been pondering relates to "mandatory" requirements and obligations such as those enshrined in laws, regulations and contractual terms. It seems to me that, despite initial impressions, compliance with "mandatory" requirements may not be...