Living in the Cloud(s)

February 16th, 2012

I wrote about cloud computing in an earlier post and discussed some of the general pros and cons involved with the idea.  For attorneys, doctors and other professionals that are regulated, cloud computing creates some new wrinkles.  For attorneys, protecting the confidences of clients is an ethical obligation.  The unauthorized disclosure of client secrets can lead an attorney to disciplinary action and disbarment.  For physicians and other health care providers, federal laws on the privacy of patient information put providers at risk for substantial fines for inappropriately disclosing patient health information (or otherwise not complying with HIPAA’s privacy and security rules).  Using the cloud for applications that might have such confidential information adds a layer of uncertainty for the practitioner.

On the other hand, cloud computing is coming to a practice near you whether you like it or not.  For example, an increasing number of attorney practice management systems are cloud-based, such as Clio.  Legal research tools like FastCase, LexisNexis, Westlaw and Google Scholar are all cloud-based systems (in the sense that the information being searched is not stored on your local network but in internet-based database repositories that you access through your web browser).  And a growing number of email providers, including Google Apps for Business, Mailstreet.com, and others have been providing cloud-based email solutions for custom domain names.

State bar ethics groups and the ABA have been working on ethics opinions about these cloud-based systems.  North Carolina’s Bar had initially proposed a restrictive rule on the use of cloud computing systems by attorneys in the state.  The NC Bar had suggested that the use of web-based systems like directlaw.com (which allows clients to complete a questionnaire online for specific legal documents which are reviewed by an attorney before becoming final) represented a violation of the state’s ethics rules.  However, the NC Bar later revised its opinion and indicated that cloud computing solutions can be acceptable, so long as the attorney takes reasonable steps to minimize the inadvertent disclosure of confidential information.  “Reasonable,” a favorite word of attorneys for generations, has the virtue and vice of being subject to interpretation.  However, given the pace of change of technology, a bright line rule that favors one system over another faces prompt obsolescence.

In the context of the NC Bar 2011 Formal Opinion 6, for software as a service providers, ethics considerations include: (a) what’s in the contract between the vendor and the lawyer as to confidentiality, (b) how the attorney will be able to retrieve data from the provider should it go out of business or the parties terminate the SAAS contract, (c) an understanding of the security policy and practices of the vendor, (d) the steps the vendor takes to protect its network, such as firewalls, antivirus software, encryption and intrusion detection, and (e) the SAAS vendor’s backup and recovery plan.

Can you penetrate past the marketing of a vendor to truly understand its security practices?  For example, Google does not even disclose the total number of physical servers it uses to provide you those instant search results (though you can learn where its data centers are – there is even one in Finland as of the writing of this article – here).  And, in spite of Google’s security vigilance, Google and the applications it provides have periodic outages and hack attacks, such as the Aurora attack on gmail that became known in 2010.  Other data centers and service providers may be less transparent concerning these security issues.  In some cases, the opacity is a security strategy.  Just as the garrison of a castle wouldn’t advertise its weak spots, cloud providers aren’t likely to admit to security problems until either after the breach is plugged, or the breach is irreparable.

What’s your alternative?  For you Luddites, perhaps paper and pencil can’t be hacked, but good luck if you have a fire, or a disgruntled employee dumps your files in a local dumpster for all to see one weekend.  For those of you that want computer system in your practice, can you maintain these systems in-house in a cost-effective manner?  Do you have the resources to keep up with the software and hardware upgrades, service contracts, backup & recovery tests, and security features to reasonably protect your data?  How does that stack with professional-grade data centers?  Are you SAS-70 or SAS-16 compliant?  Do you know how data you access is encrypted?  In functional terms, do you really exercise more effective control over your security risks if you have IT people as employees rather than a data center under a reasonable commercial contract?

There are a lot of considerations.  And the best part?  They keep changing!

Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Google Buzz (aka. Google Reader)

Lion Migration from IIS, A Novel

December 28th, 2011

For the new year, we decided to take the plunge and migrate from our old friend, Windows server 2003 with IIS 6 over to Apple’s Lion Server on a shiny new Mac Mini with 8 GB of RAM and a quad processor.  The conversion from Microsoft’s to Apple’s server operating system is not too bad, though much is different between the two systems.  This article discusses some issues and resources for reference for those that are new to Lion.

MySQL

So, first off, we host web sites using IIS 6.  Some of our sites utilize WordPress, which means that we use a back-end mySQL database, and we also run php.  Neither of these applications were originally written for Windows, so both run ok there, but with issues over time.  Lion, of course, underneath is really a flavor of Unix.  This makes mySQL and php happy.  And, the nice people at Apple even have pre-loaded php onto Lion server for you.  However, you will need to install mySQL on your Lion box ahead of time for this conversion.  Here is a link to downloads for mySQL.  Here is also a very good walkthrough of installing and verifying your php, Apache, and mySQL installations.

Also note that with mySQL that there are three separate installation packages that you have to run – the main one is called mysql-5.5.19-osx10.6-x86_64.pkg (yes you want the 64 bit version of this application, not that crappy 32 bit thing you were running on your sad Windows server), but you also need to run the MySQL.prefpane and MySQLStartupItem.pkg so that you can get to this in the Preferences Pane and have it set to automatically run when you reboot).

Remote Access

Oh, but wait.  You might be wondering how you get into your Lion box in the first place to do all of this stuff.  For Windows people, we are used to the whole Remote Desktop thing (or if you are truly desperate, breaking out that spare monitor, mouse and keyboard and plugging them into your shiny new server).  Don’t worry: Apple has some tools for the sysadmin’s remote access.  If you are using, perish the thought, a Mac workstation or laptop, you can use Screen Sharing.  To connect for the first time, you authenticate to the Lion server with a blank user name, and the password is the Mac Mini’s hardware serial number.  From there, you will walk through the initial setup steps (like giving your box a network name, and the like).  Apple also shows you the other couple of options here (because, no, you are not the only person to want to access your box remotely).

The Server and Server Admin Apps

Ok, so now you have you setup the box and have installed mySQL, php and your Apache server.  In case you don’t know where Apache is (because you like to click a play button in the services applet in Windows), there is an application in Lion aptly called, “Server.”  Within that is a big “on/off” button for the web server that you can click to get Apache running.  By the by, there is a more sophisticated set of server tools called “Server Admin” that all the cool kids have downloaded to their Lion server.  (Click here to download that).  You can also do this stuff at the command line in the application called “Terminal” which is in the Utilities group of Applications.  I won’t get into the command line in this article, though there are a number of good references out there if you like that kind of thing (and sometimes, that is the best way to do something!).

Setting Up the Web Root Location

So you now have some setup choices to make, like where you are going to put your web site directories for the web sites you want to host on your Lion.  I’d say put them somewhere isolated, perhaps in their own little folder in the root where you have a way to limit access.  In Lion’s world, this will be a location where “Everyone” will have access, because, you know, the world wide web can come to your little box and see the contents.  I’d guess that putting all this stuff in the middle of your server’s system files would be a bad idea.  If you bought a server with two harddrives, and you aren’t going to mirror the one to the other, you might use the other disk to locate your web files.  Or you could create a partition from the free space and isolate your web files from the rest of the server’s files. Do what you need to do here.

Local DNS for Dev

Once you get things setup, you can then copy your files from your production IIS server over to their new location on the Lion server.  By default, Lion is running DNS for the .home domain (the equivalent of the .dom domain in Windows – local only).  However, you can’t configure DNS with the “Server” application.  Instead, you need “Server Admin” (aren’t you glad you already downloaded this and installed it?  Oh, you didn’t do that yet.  Well, come on.)  DNS lives there (or you can do your unix command line voodoo if you are in to that sort of thing).  The home domain is configured and your server is in it.  If this server is an internet DNS server, you could configure this server to run DNS for an internet domain here.  However, if you want to test your migrated web sites (why would anyone test anything before putting it into production?), you can configure your names here.

Setting up your Web Pages

Once you have done this, you can then declare your new sites in the “Server” application in the Web application.  You add a domain at a time (like test1.home, test2.home, or something lame like that), and tell the web service the location of the files for each site.  You’ll note that the service doesn’t ask you what the default document is for your web site; I think it is assuming that the default page is index.htm (or index.php if you are running php).  If you have a funny named default page, you will probably have to edit httpd.conf to modify the line for DirectoryIndex as follows (or you can just rename your page to index.php/index.htm.  I know, I know, that is too much effort):

#see below, replacing the text in square brackets
#with your unusual default page
DirectoryIndex [yourcrazyindexpagename].[crazyextension]

Now, you are going to chuckle a bit at this point once you have added your multiple domains into DNS and you configure your multiple web sites, because Lion only will serve up one.  I don’t know why Lion ships this way.  But there is a solution.  Edit httpd.conf and add some entries for multiple domains as noted in the article.  You can also alias subdomains if you want, like www.  The downside to this is that if you have to change IP addresses later, you will need to edit internet DNS, add these addresses to your Lion server’s network settings, and then come back here and edit httpd.conf.  And for some reason with Lion, Apple has taken away a GUI configuration for Apache for advanced things like this.  Maybe someone out on the interweb will write one for those of us that are sad and don’t like trying to change these oddly named text files in the System directory.  Also, even more sadly I note that the Snow Leopard version actually had a GUI to do this and Apple took it away from us sysadmins.  I now wander alone in the desert, cast out by Apple.

Ok, I’m out of cheese so I will stop whining.  Needless to say, Apple has its problems too.  If they had everything figured out, we wouldn’t know what to do with ourselves and would probably not have a fabulous  job in IT.

FTP

By the by, you might want to configure ftp access to your web server.  Here is an article to do that.  (If you are going to allow ftp access, this is yet another reason to isolate your web files from the rest of your server files).  FTP access might be helpful if you are going to upload and download files from the web server periodically, and you can stop and start the service if you want to further limit access.  Probably best to also not use root as the user to access files by ftp (or just post your social security number, date of birth, license number, bank account numbers, and all your passwords to all of your accounts to the internet – you know, whatever).

Setting up new MySQL Databases

So, just a few more things to do in order to get your web sites up and running.  If you are using WordPress, you will want to export the tables in your production mySQL database to your new Lion mySQL database.  Ahead of this, you can get ready by creating blank databases on the Lion mySQL server with the same names as in production.  This can be done by logging into mySQL from Terminal, and running the commands:

create database [databasename];
grant all privileges on [databasename].* to
"[webusername]"@"localhost" identified by "[password]";
flush privileges;

In addition, if you have already copied the web files to your Apache server, and configured Apache to serve up these pages, you should be able to run the initial WordPress setup on your Lion box (won’t impact production), and you should be able to get into the wp-admin section and check out your plugins and themes to make sure they are good before importing your data into your mySQL database.  This will create blank tables with the default data of a default WP install – these will all get overwritten in the next step below.

Export/Import MySQL Database Tables

Happily, mySQL for Windows comes with an application you can use to export your database into a single .sql file that you can then execute in mySQL to import the tables and their data.  In Windows, the program is called “mysqldump.exe” and it is installed in Program Files\MySQL\MySQL Server 5.0\bin.  You run this program at the dos prompt.  With the proper syntax, it will create a .sql file where you tell it to, which you can then use to import all of your data and tables into your fresh mySQL install on Lion.  Here is an article on the syntax for using this function.

Once you have your .sql file for your database, and you have copied it to your Lion server, you can use mysqlimport from within the Terminal application in order to import these tables and data into the appropriate shell database you have for your WP site.  I’ve found that this process works better than using the Export/import features within WP admin, particularly if your site has custom tables for a particular widget or plugin.  My site, for example, had a customized menu that didn’t work in the new site until I just exported all of the data and tables and imported into the Lion install.  You can also simply execute a command at Terminal to process the .sql file that is created by exporting using mysqldump that looks like this:

mysql -u root -pYourPasswordHere NameOfYourDatabase <
/locationofyourMySqlExportFile.sql

Once you run that command, mysql will import and overwrite whatever is in the shell database that you have on your new mysql server.  Of course, if you have anything in there that you want, it will be overwritten.

So that’s it.  Ha ha.  This is not a thing you do in a half an hour, even for an experienced sysadmin.  But this is a perfectly reliable way of hosting web sites.  Lion’s not bad, mostly because you are just running Apache, php and mySQL, all of which work pretty well and have been around for quite a while.  But Lion is cute and cuddly.  For the most part, as long as you avoid those fangs, claws, and don’t get squished under the command line.  Happy computing!

Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Google Buzz (aka. Google Reader)

Spam Spam Spam Spam Spam Spam Baked Beans and Spam

December 13th, 2011

“18″ year old virgins have recently found online resellers of non-prescription viagra for Magic Jack users that want cheap ski vacations that need health insurance, iPads and Dyson vacuum cleaners at rock bottom, knock off prices!  And all of these thousands of emails have been sent to my account online so that I can help a gentleman from Nigeria move $55 million in money from an African bank account into the U.S. and I can charge a humble $5 million fee to help.  I just need to send my social security number, credit card numbers, street address, and a sample of my signature to a person I’ve never met by email, deposit the bogus cashier’s check in my trust account, and then immediately write a check off the account the next day, well before the bogus check is returned by the collecting bank.

I feel as though I have ended up in the 21st century Monty Python skit about the restaurant that only seems to have “spam” on the menu.  I hear this problem continues, with more than 70% of all email amounting to spam, according to a 2011 article from Symantec (though there was a time that more than 90% of email was spam, so there has been some improvement since those dark days in 2009).  Progress has been made with some service providers that have waged a counter war against spam.  Gmail, for example, group-sources and marks messages as spam based on all messages identified by users as spam across the gmail platform.  This is a surprisingly effective strategy.  My experience has been that there are few false positives.

Previously, email systems were implemented that would check if a message was sent from a known, blacklisted IP address based on a series of independently maintained blacklist databases on the internet.  There have also been other improvements in the background, including the use of special DNS entries, and email gateways that pre-filter messages before reaching the mail server (Symantec had a product it had acquired from Brightmail; Google Apps includes a single-domain license for Postini, which is also generally effective at cutting down spam).  Spam messages often include phishing links, virus-laden email attachments, and other nefarious attacks on users.  Reducing spam makes sense for service providers that are paying, ultimately, for the bandwidth and storage space to process and deliver this junk to users.  We clearly have a way to go to reduce this problem for users.  Until then, if you need male enhancement medicine, are missing out on a $1,000 transfer to your bank account, want to help a political refugee move his family fortune to the U.S., need a usurious student loan, or want to work from home – I’m your guy!

Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Google Buzz (aka. Google Reader)

Estate Planning in the Digital Age

December 7th, 2011

One event remains certain for all of us, our inevitable end.  Planning for this eventuality is generally a good idea because you can help ensure that the people that survive you will be able to keep on keeping on.  This is why people have, for generations, written wills, powers of attorney, health care agent appointments, living wills or advance directives, and other legal documents.  All of these documents help to explain who is supposed to get what, and how your affairs should be closed out after your death.  The 21st century, however, has created a new set of problems with the rise of technology and the information age.  What happens to your online life when you die?  And how will your heirs access all of these things?

First off, computer security people have drilled into all of us to not share our passwords with others.  Besides having to change these passwords all of the time, users of most commercial information systems are used to having a password personal to them, which sometimes acts as a digital signature authorizing the commercial vendor to do certain things (for example, to trade stocks, post information, or to pay bills from a bank account).  In addition, security experts have also drilled that we should not write down our passwords, or attach them as post-it notes underneath our keyboards.  Furthermore, we have been taught to have different passwords for different services (so that, in the event of a password loss, the damage that might result would be limited to one or a few systems).  As a result, we probably keep a lot of passwords to a substantial number of systems, but we usually don’t tell anyone what these passwords are.  So what happens when we die?

For myself, I am just thinking about the computer passwords that I use on a regular basis: (a) one for my laptop, (b) one each for online banking at several different banks, (c) a passcode for my iPhone, (d) a passcode for my iPad, (e) passwords for blogs that I maintain online, (f) passwords for my web server, (g) passwords for online web sites that I use like amazon.com, ebay.com, iTunes.  I mean, I even had to create an account in order to update the software that programs my remote control for the T.V. at home!  I’m sure that if I sat down and thought about it, I would be able to write an even longer list.  Without help, I doubt my wife or any of my relatives would be able to access much, if any, of this.  Moreover, if I simply wrote out the whole list, I would have to periodically update my passwords for those systems that require that I regularly update (a growing percentage of my online accounts).

There do appear to be some subscription-based services available online today to help address this conundrum.  Dead Man’s Switch is one such service.  Another is called Death Switch.  There may be other services available.  Obviously, you would want to give some thought to what you are providing to the service, and what security is employed by the service that you sign up to use, given that you may end up leaving with it sensitive information to forward to people that you have designated.  I have not used either of these services.  If you are a user, please feel free to post comments to this post on your experience to date.

Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Google Buzz (aka. Google Reader)

Turing Test, Computer Progress Towards Becoming “Human”

September 7th, 2011

LiveScience reported that Cleverbot recently convinced 59% of the humans it interacted with that it was a human being by utilizing crowd sourcing to help it respond appropriately to questions posed by human interrogators.  This exercise is based on Alan Turing’s hypothesis that eventually computer software would be created that could convince us humans that it was also human.  According to some, the fact that more than 50% thought it human suggests that Cleverbot may be more than clever – it may have, in fact, passed the Turing Test.

I decided I would interrogate Cleverbot to see how far it could get as an attorney.  I think it has some interesting responses, but if attorneys are worried that they will be replaced by it, I think all can breath a collective sigh of relief for the moment.

Q: Why do so few maryland courts grant 2-535(b) revisory motions?

A: Because they are realizing we are right and that makes them angry.

Q: Should a court grant a motion for summary judgment when there are material facts in dispute?

A: No. That’s not true love.

Q: Can a party survive a motion to dismiss in a breach of contract action if it fails to allege damages as a result of the breach?

A: I set up a nuclear missile to explode at the center of the earth.

Q: Why would you do that in response to a motion to dismiss?

A: You enjoy it.

Q: What is the statute of limitations for filing an action arising out of an intentional tort such as battery in Maryland?

A: What statement?

Q: The statute of limitations for bringing a claim?

A: *brings cookie*.

Q: I don’t want a cookie.

A: Sorry, what do you want then?

Q: I want to know how long I have to file an action for an intentional tort in Maryland.

A: Really listen to what people say.



Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Google Buzz (aka. Google Reader)

Preparing for Disasters – Practical Preparedness

April 27th, 2011

Disasters happen in the world, some of which may directly affect your organization.  Preparing for disasters, whether they be hurricanes, tornadoes, terrorists, hackers, power outages, fires, or earthquakes, means thinking about: (a) how your business operates today, (b) how your business would likely operate in the event of a disaster, (c) and developing some kind of testable plan for recovering from a variety of disasters that is practical but well-designed.  Preparedness is also a commitment to ongoing planning and the investment of a certain amount of resources each budget period to the process, because your plan will evolve with the extent and scope of your business as it changes over time.

In Maryland, there are not specific ethics rules that require lawyers to prepare for disasters, though common sense would tell an attorney that missing a deadline because of a disaster is still a missed deadline, and the loss or inadvertent disclosure of confidential client information is still a loss whether or not caused by a natural disaster or simple human error.   Both circumstances can lead to an ethics complaint from a disgruntled client.  For attorneys, there are a number of resources available from the ABA to help firms do a better job of preparing for a disaster.

Doctor’s offices that are joining the electronic health record system revolution because of the incentives under ARRA, also will need to have a plan for disaster recovery.  The HIPAA security regulations include standards for preparing for recovering from disasters (45 CR § 164.308(a)(7) is addressed specifically to contingency planning for covered entities and business associates).  The security regulations are cloaked in terms of “reasonableness,” which means that a covered entity’s disaster recovery planning efforts should be commensurate with the amount of data and resources it has.  So, a practice of two physicians that sees 8,000 patient visits a year is not expected to have its data available in three DR hot sites.  But, if you are a major insurance carrier, three DR hot sites might not be enough for your operation.  However, in neither case is no plan an acceptable answer.  Nor is a plan that has never been tested.

Risk Assessment

So where do you start?  The logical starting point is a risk assessment of your existing systems and infrastructure (also required of covered entities under the HIPAA security rules in section 164.308(a)(1)).  A risk assessment will guide you through gathering an inventory of your existing systems, and help to identify known and potentially unknown risks, along with the likelihood that such a risk will be realized and what you are doing now (if anything) to mitigate that risk.  The risk assessment will also help you to categorize how critical a system is to your operations, and will also identify severe risks that remain unmitigated.  This resulting list helps you to come up with a starting place for the next step: doing something about it.

The Disaster Plan

In parallel, you can also use the inventory of your existing systems and risks to develop a disaster recovery plan.  First, you now have a list of your critical systems which are your highest priority to recover in the event of a failure.  Second, you also have a list of likely risks to those systems with the likelihood based in part on your past experience with a particular disaster.  These lists help you to identify what you need to protect and what you need to protect from.  The other two questions you need to ask for each system are: (a) how much data can I stand to lose in the event of a disaster? and (b) how long can I wait to have my system restored to normal operations?

This analysis of your existing systems, risks, and business requirements will help lead the practice to a plan that includes procedures for how to function when systems are unavailable, and how to go about restoring an unavailable system within the business requirements of the practice.  Once you have your plan, and have implemented the systems or policies required by the plan, your next step is to test the plan.  Table top exercises allow you, in a conference room, to walk through the staffing, procedures, and possible issues that may arise as a result of a particular disaster scenario.  Technical testing permits your IT staff to make sure that a disaster recovery system works according to the expected technical outcomes.  Full blown testing is to actually simulate a disaster, perhaps during non-business hours, and actually run through the disaster plan’s procedures for operations and IT.

Hypothetical

As an example, suppose that you have an electronic health record system.  This is a critical system based on the risk assessment.  In the last five years, you have had a virus that partially disabled your records system causing an outage for two business days, and you have had your database crash, causing you to lose a week’s worth of data.  You have implemented two mitigations.  The first is anti-virus software that regularly updates for definitions and regularly scans the system for viruses and removes them.  The second is a backup system that makes a backup of your system’s data on a weekly basis and stores the data in a separate storage system.

Based on interviews with the practice staff and owner, the records system is used as a part of patient care.  During normal business hours, an outage of the system can result in patients being re-scheduled, and also creates double work to document kept visits on paper and again in the record system when it becomes available.  The practice has indicated that the most it can be without the system is a single business, and the most data that it can lose from this system is the most recent 4 hours of data entry (which can be reconstructed by the clinical staff that day).

You then evaluate the mitigations in place today that allow for a system recovery in the event of a likely disaster (virus or database crash based on the past experience of the practice).  The backup system today only runs once per week, which means that a crash of virus that occurred later in the week would result in more than 4 hours of lost data.  Recovery from the backup device to a new server also appears to require more than a business day, because the practice has no spare server equipment available.  So you would have to start over with the existing server (installing the operating system, database software, and then restoring the data from the backup), or purchase a new server and have it delivered to complete the restore.

The conclusion here is that while there is an existing mitigation for recovery from a likely disaster, the mitigation does not meet the business requirements of the practice.

Budget for New Sufficient Mitigations

Once you have your list of unmitigated or insufficiently mitigated risks, the next step is to look for mitigations that you could implement on your network.  A mitigation might be a disaster recovery system or service, or it might be some other service or product that can be purchased (like anti-virus software, a hardware warranty, a staff person, etc.).  At this point, the help of a technical consultant may be required if you don’t have your own IT department.  The consultant’s role here is to advise you about what you can do and what the likely costs are to purchase and implement the solution which will meet your business requirements based on your likely risks for disasters.

Once sufficient solutions have been identified, the next step is to purchase a solution and implement it.  From there, testing is key as noted above.  An untested plan is not much of a plan.

 

 

Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Google Buzz (aka. Google Reader)

Stolen Personal Information

April 27th, 2011

Hackers continue to steal data from companies the world over, with a recent victim in Sony.  In that case, Sony apparently delayed reporting the loss to the 77 million users whose data was compromised, including dates of birth and possibly credit card numbers.

In late March, Epsilon reported that hackers had stolen the names and email addresses of individuals who receive business newsletters from Epsilon’s clients, which include a number of well known companies such as Best Buy and Robert Half International.  Considering that Epsilon delivers over 40 billion emails a year for its clients, the chances have gone up of improved, targeted phishing attacks as a result of this breach, particularly for banking customers of banks that have used Epsilon for email marketing.

There should be no surprise that the regulatory penalties for data breaches continues to escalate.  Security breach notification procedures were codified into the 2009 ARRA legislation for health care providers.  ARRA Health Tech Initiatives Section 13402 of the ARRA legislation (on page 17 of the linked pdf file) puts the responsibility on a covered entity to notify its customers of a data breach where unauthorized access is gained to “unsecured” protected health information.  In laymen’s terms, “unsecured” PHI is data that is not encrypted.  So, for example, a typical relational database stores its data in physical files on a computer hard drive or array.  Some database systems encrypt these files so that you could not just open up the file in notepad and read its contents.  If a hacker were to gain physical access to the server where these files were located, he or she might not be able to read them without further access (for example, with an administrator-level username and password to directly query the database).  Notification to patients would not likely be required in this circumstance if you could show the hacker gained physical access but not database-level access.

Does your database encrypt its stored data files?  Not all database software, and not all versions of specific database software, provide for native encryption.  For example, the data files of your Microsoft Access database are not likely to be encrypted.  For performance reasons, data files for MS SQL Server databases may also not be encrypted.  But, even if your database file is encrypted, if the administrator password to the database itself is blank or easy to guess (like “admin”), you may still have trouble brewing back at the server room.

Here is a list published by HHS of data breaches reported to it under ARRA’s notification requirements.  Do you see your physician on this list?  If things continue, you may sooner rather than later!

Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Google Buzz (aka. Google Reader)

China Registrar Scam

April 21st, 2011

I received this email today for my domain name, faithatlaw.com.  Allegedly, another company wants to register my domain name as a .cn and .asia domain.  I can’t imagine that there are actually people in China that would be that interested in a Maryland attorney’s web site (maybe the same people looking to hire me to enforce a Maryland judgment for $800,000 against some poor ex-husband, but in reality are trying to scam my attorney trust account).  However, you will note that the real China domain name registration center is CNNIC, and the registrar listed below, ygnetworkltd.com, is not listed on CNNIC’s list of authorized registrars.  So, this is almost certainly a scam.  I might have my lawyer send them a cease and desist letter!

Dear Manager:

This email is from China domain name registration center, which mainly deal with the domain name registration and dispute internationally in China and Asia.  On April 18th 2011, We received HAITONG  company’s application that they are registering the name ” faithatlaw ” as their Internet Keyword and ” faithatlaw .cn “、” faithatlaw .com.cn ” 、” faithatlaw .asia “domain names etc.., It is China and ASIA domain names. But after auditing we found the brand name been used by your company. As the domain name registrar in China, it is our duty to notice you, so I am sending you this Email to check. According to the principle in China, your company is the owner of the trademark, In our auditing time we can keep the domain names safe for you firstly, but our audit period is limited, if you object the third party application these domain names and need to protect the brand in china and Asia by yourself, please let the responsible officer contact us as soon as possible. Thank you!

Best Regards,

John
Oversea marketing manager
Office: +86(0)21 6191 8696
Mobile: +86 1366152 9704
Fax: +86(0)21 6191 8697
web: www.ygnetworkltd.com

Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Google Buzz (aka. Google Reader)

Disaster Recovery and the Japanese Tsunami

March 29th, 2011

The art of disaster recovery is to plan for what may be the unthinkable while balancing mitigations that are both feasible and reasonable for your organization’s resources and circumstances.  On March 11, Japan was struck by a massive earth quake and tsunami that caused enormous destruction, estimated at a total loss of $310 billion.  Over the last several weeks, one of the major failures has been at the nuclear power complex in Fukushima, home to six nuclear power plants.  This disaster continues, as of the writing of this post, as at least two of the plants continue to be in a critical state because of a failure of the complex’s power and backup power systems that helped to control the temperature of the nuclear fuel rods used to generate power at the plants.

As an unfortunate consequence, many people have been exposed to more radiation than normal, food grown in the area of the plant has shown higher levels of radioactive materials than normal, radioactive isotopes in higher-than-normal concentrations have been detected in the ocean near the plants, and numerous nuclear technicians have been exposed to significant radiation, resulting in injuries and hospitalizations.  As far as disasters go, the loss of life and resources has been severe.  And like other major environmental and natural disasters, the effects of the earthquake and tsunami will be felt for years by many people.

Natural disasters like this one cannot be prevented.  We lack the technology today to effectively predict or control for these kinds of events.  And while these larger scale disasters are relatively rare, planners still need to assess the relative likelihood of such events, and develop reasonable mitigation plans to help an entity recover should such a disaster occur.  Computerized health records present an opportunity to permit recovery in that the data housed by these systems can be cost-effectively backed up and retained at other secure locations, permitting system recovery and the ability to continue operations.  In contrast to digital files, paper records are far less likely to be recovered were a tsunami or other similar natural disaster to occur and wash the records away.

Even the best recovery plan, however, will be severely tested should a major disaster be realized.  Japan was hardly unprepared for a major earthquake, and still is struggling to bring its nuclear facilities under control nearly three weeks later.  However, having a plan and testing it regularly will increase the odds of recovery.  My thoughts are with the Japanese during these difficult times.

Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Google Buzz (aka. Google Reader)

Social Media and Searching for Attorneys

March 26th, 2011

The ABA Journal recently posted an article on a survey conducted by Harris of adults to determine how they would find a lawyer.  The days of yore when people used the yellow pages to find an attorney have apparently turned over: today, those same people are browsing the web.  That might be because some cities in the U.S. have banned or are thinking about banning the delivery of the old yellow phone book to try and save some trees.  Not surprisingly, however, the most common referral source for an attorney are friends and family, followed by a satisfied former client that calls you again for legal help (these two were the clear leaders for referral sources).

So, should lawyers throw away their Facebook, Twitter, and blog accounts?  The Harris survey indicated that a lower percentage of survey respondents were somewhat likely to look at these sources to check out an attorney (20% or less).  That’s about the same as the number of relationships that start online, according to match.com, if you believe the ads.  Interestingly, respondents to the survey were more likely to look at “innovative websites.”  Of course, that makes more sense.  Twitter is not a legal matching or legal news or even a lawyers-only web service.  But my web site is all about my firm.  Avvo.com is a directory of lawyers and doctors.  When you think of lawyers, I would imagine that Twitter is not the first online resource that pops into your head.

Bottom line: integrate your twitter and facebook fan pages into your web site.  Google is becoming the new phone book for online referrals, and if you don’t show up in the first couple of pages of results, you are less likely to be found by a prospective client.

Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Google Buzz (aka. Google Reader)