Within the next five to 10 years, quantum computing will get so powerful that it could be used to break encryption on the fly, predicts Steve Marshall, CISO at U.K.-based Bytes Software Services.

"We rely on cryptography to prevent people from decoding our credit cards and to protect highly sensitive data that we share. Quantum computing is going to have a major influence on all of these things," Marshall says in an interview with Information Security Media Group.

"At the moment, quantum computers have about 72 qubits of quantum information. ... In order to crack things like RSA 2048 public key cryptography, you require about 400 qubits of power. So it's only a matter of time before quantum computers get to the point where they have got enough power in order to be able to crack RSA and other asymmetric cryptography."

In this interview (see audio link below image), Marshall also discusses:

Marshall, who is based in the U.K., is CISO at Bytes Software Services, a computer support and services firm. He specializes in business consulting, payments, compliance, breach clean-up, enterprise architecture validation, assurance, corporate/information security, security restructures and risk across many business verticals and markets.

Threat intelligence sharing is all about trust, speed and context. And yet many enterprise intel programs lack one or more of those qualities. Jon Clay of Trend Micro discusses what it takes to stand up a customized threat intelligence program.

"We did a study about this, and only about 5 percent [of respondents] were willing to share their indicators of compromise with their community," says Clay, director of Global Threat Communications at Trend Micro. "Yet, 95 percent of them wanted to obtain those same IOCs from their fellow members. Obviously, that shows a lack of trust."

In an interview about setting up a customized threat intelligence program, Clay discusses:

Clay is responsible for managing marketing messages and external publication of all the threat research and intelligence within Trend Micro as well different core technologies. As an accomplished public speaker with hundreds of speaking sessions around the globe, he focuses on the threat landscape and the use of AI/machine learning and big data in protecting against today's sophisticated threats. He has held roles within Trend Micro as a Sales Engineer, Sales Engineering Manager, Training Manager and Product Marketing Manager for SMB prior to taking over as Director of Global Threat Communications.

Healthcare organizations and their business associates must be careful to avoid making mistakes with their HIPAA security risk analysis in case they ever undergo a compliance review or breach investigation by federal regulators, says privacy attorney Adam Greene.

"What I see a lot of - and it's both sad and frustrating - is that a covered entity or business associate might hire an outside security consultant to do a security risk assessment ... but what they end up getting is a gap analysis against the HIPAA Security Rule or another set of controls," he says in an interview with Information Security Media Group.

While a gap analysis can be helpful, "it's not the sort of risk assessment that the Department of Health and Human Services' Office for Civil Rights is looking for ... if there's an investigation, audit or breach," he stresses.

What OCR is looking for in a HIPAA security risk analysis "is threat/vulnerability pairings" involving protected health information, he explains.

"But what we sometimes see instead is a checklist approach of the different security rule requirements ... sometimes without even mention of 'threat,' 'vulnerability,' 'likelihood' and 'impact' - the terms that OCR guidance says must be part of any risk analysis."

Documentation Issues

Providing security risk analysis documentation to OCR when faced with a compliance review or investigation can also prove tricky, Greene notes.

For instance, a list of recommendations that grow out of security risk analysis aren't necessarily what an entity should turn over to OCR, he says.

"[Legal] counsel can play an important role in making sure you end up with deliverables that can be delivered to OCR while having a claim of privilege with respect to initial recommendations that may not have been ready for prime time and required some level of legal review and counsel," he says.

In this interview, (see audio link below photo), Greene also discusses:

As a partner at Davis Wright Tremaine LLP in Washington, Greene specializes in HIPAA and HITECH Act issues. He formerly was senior health information technology and privacy specialist at OCR, where he played a significant role in administering and enforcing the HIPAA privacy, security and breach notification rules.