Glenn S. Dardick

The 2007 Analysis of Information Remaining on Disks Offered for Sale on the Second Hand Market

All organisations, whether in the public or private sector, increasingly use computers and other devices that contain computer hard disks for the storage and processing of information relating to their business, their employees or their customers. Individual home users also increasingly use computers and other devices containing computer hard disks for the storage and processing of information relating to their private, personal affairs. It continues to be clear that the majority of organisations and individual home users still remain ignorant or misinformed of the volume and type of information that is stored on the hard disks that these devices contain and have not considered, or are unaware of, the potential impact of this information becoming available to their competitors or to people with criminal intent. This is the third study in an ongoing research effort that is being conducted into the volume and type of information that remains on computer hard disks offered for sale on the second hand market. The purpose of the research has been to gain an understanding of the information that remains on the disk and to determine the level of damage that could, potentially be caused, if the information fell into the wrong hands. The study examines disks that have been obtained in a number of countries to determine whether there is any detectable national or regional variance in the way that the disposal of computer disks is addressed and to compare the results for any other detectable regional or temporal trends.

PCI Compliance: Overcoming the Challenges

This study reviews the progress made by the introduction of the Payment Card Industry (PCI) compliance rules in the USA. Available data indicate that compliance has grown but several issues remain unresolved. These are identified within, along with an analysis of the feasibility of several solutions to the challenges that have hampered compliance with the Payment Card Industry rules. These solutions are evaluated by the extent to which they can help the merchants meet their business objectives while still safeguarding the credit card data. The first solution involves upgrading the current PCI standards as suggested by the PCI council. The second solution would require moving the burden of credit card information storage to the credit card companies and member banks, as suggested by the National Retail Federation. A third option reflects a socially responsible approach that protects the interests of all stakeholders. The study concludes by suggesting the way forward.

Interdisciplinary minor in digital forensics, security and law

Digital forensics is playing a more prominent role in law enforcement, network security, and information assurance. The field of study encompasses not just digital evidence, but also the areas of cyber law, sociology, and security to name a few. Its increasing importance is reflected in its growing role within crime investigations, civil cases and homeland security.An in-depth understanding of digital forensics will be needed by college students who will be entering the various fields within technology, business, criminal justice, law, and homeland security. Currently, many professionals in those fields are not well-prepared to understand the use and management of digital evidence - or the use of digital forensics in determining the causes of security breaches, or the avoidance of security breaches altogether.Today, many professionals are working with others from different fields - lawyers are working with IT managers, members of law enforcement are working with forensics engineers. Well, at least they are trying. Unless properly prepared, many of these professionals will not be able to communicate and work effectively with each other. Those communications will continue in their frequency and importance. The demand for forensics and investigative work by knowledgeable professionals will continue to exceed the supply available for the foreseeable future.While some topics or courses in forensics and security will be needed in a variety of majors such as criminal justice and computer science, an enhanced level of study should be provided for those wishing to have a more solid foundation in digital forensics, security and law. By having students from different disciplines participate together in a minor in digital forensics, security and law, we hope to provide a richer learning environment.The curriculum discussed contains core courses in digital forensics, security and law as well as a capstone course. The curriculum also contains individual tracks in several areas for more in-depth study outside the students chosen major. The core courses within the minor cover digital evidence and its relationship to forensics, security and the law. Many areas of law are covered within the curriculum because of the ubiquitous use of computers and the importance of such acts as Graham-Leach-Bliley Act (GLBA) of 1999, Electronic Communications Privacy Act of 1986 (ECPA), Sarbanes-Oxley (SOX), Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the USA PATRIOT Act.This article describes the background and the process of developing a minor in digital forensics, security and law to better prepare those students majoring in criminal justice, information technology and computer science. This article also presents information on extending the minor to students majoring in accounting, pre-law and public administration.

Lessons From Computer Intrusion at TJX

In January, 2007, TJX reported that it had suffered from a computer intrusion. The company was sure neither of the identity of the perpetrators nor of how many customers were affected. A deeper analysis revealed that the intrusion had started earlier and affected more customers than previously thought. Ensuing investigation concluded that TJX was collecting unnecessary information, keeping it for too long and employing obsolete and insufficient safeguards. TJX denied any wrongdoing but implemented most of the recommended remedies to strengthen their security.