Lessons in Risk Management: What We Should Learn from the FAA Fire

Too often in information security we focus on the confidentiality of (more…)

Cindy Kaplan2025-12-22T19:05:04+00:00Tags: FAA, information risk, Risk Assessments, risk management, security incident|

Code Spaces Spaced Out On Data Security

The information security community is abuzz with the news of Code (more…)

Cindy Kaplan2024-07-03T20:42:46+00:00Tags: Amazon, AWS, Code Spaces, hack, security|

Vendor Risk Management Hype Extends Beyond Target®

(more…)

Cindy Kaplan2026-03-18T19:17:13+00:00Tags: hacking, NIST, Risk Assessment, security, Target, third party risk management, third party vendor management, TPRM, vendor risk management|

Universities Remain a Rich Target for Hackers

(more…)

Cindy Kaplan2025-12-23T18:14:12+00:00Tags: breaches, Hackers, intellectual property, personal information, PII, W-2|

Darrell Issa Just Learned the Difference Between Compliance and Security. Let’s Hope for a Payoff.

Darrell Issa’s House Committee on Oversight and Government Reform has been (more…)

Cindy Kaplan2024-08-01T18:56:59+00:00Tags: ATO, CISO, Committee on oversight, Darrell Issa, department of health, government reform, Healthcare.com, human services, ISO27000, Issa, NIST, PCI, PII|

Common Hazards in Risk Management: The Selfish Risk Assessment

Information security laws and regulations are telling us to conduct cyber (more…)

Cindy Kaplan2024-07-03T19:22:46+00:00Tags: Breach, identity Theft, Information Security, ISO 27005, NIST SP 800-30, Risk Assessment, risk management|

• 

Higher Education (sampled colleges and universities) is a Prime Target for Security Breaches

FOR IMMEDIATE RELEASE

HALOCK Investigation finds that 25% (more…)

Cindy Kaplan2026-01-16T22:48:50+00:00Tags: China, college, email, entrance, Hackers, Higher education, Personally Identifiable Information, PII, security breach, W2|

• 

Risk Acceptance Levels: Managing the Lower Limits of Security Costs

 

Last week I presented a topic here at Halock’s blog site (more…)

Cindy Kaplan2025-06-17T19:51:06+00:00Tags: impact, Information Security, reasonable and appropriate, risk, Risk Assessment, risk management, risk register, the hand rule|

• 

The Hand Rule: Managing the Upper Limits of Security Costs

While presenting a talk at CAMP IT last week I got (more…)

Cindy Kaplan2025-07-22T17:07:09+00:00Tags: burden, hand rule, HIPAA, likelihood, negligence, NIST 800-30, Reasonable, reasonable and appropriate, Risk Assessment, Risk Treatment, security control|

If HIPAA Compliance Seems Too Hard … Then You’re Doing it Wrong. Here are the Basics of Doing it Right.

(more…)

Cindy Kaplan2025-07-16T22:54:49+00:00Tags: Compliance, HIPAA, NIST SP 800-30|