Jon Washburn

Jon Washburn

As Chief Information Security Officer, Jon Washburn manages the firm’s information governance and security program in alignment with established national and international standards and the firm’s strategic plan. Jon acts as the firm’s “Compliance Officer” as necessary and/or required by regulatory agencies and works directly with the Chief Operating Officer and Firm Counsel to maintain a strong enterprise information governance and security posture through policy, strategy, operational processes and training programs.

Subscribe to all posts by Jon Washburn

Is your organization ready for global privacy regulations?

By Jon Washburn on Posted in ePrivacy, Privacy
The Internet Society’s Online Trust Alliance (OTA) released a report this week that measured 1200 U.S.-based organizations’ readiness for three major global privacy regulations: the General Data Protection Regulation (GDPR) in the European Union,  the California Consumer Privacy Act (CCPA) in the United States that goes into effect January 1, 2020, and the Personal Information … Continue Reading

New tool released that may allow bad actors with almost any skill set to bypass many implementations of Two-Factor Authentication (2FA)

By Jon Washburn on Posted in Cyber Attack, Cyber Crime, Phishing, Security, Software
Until recently, hackers have had limited success stealing Two-Factor Authentication (2FA) PIN and token information.  Unfortunately, a tool has been released that will now make it much easier for practically any bad actor to bypass many implementations of 2FA: https://www.zdnet.com/article/new-tool-automates-phishing-attacks-that-bypass-2fa/ This does not mean we should stop using Two-Factor Authentication (2FA). We should still use … Continue Reading

The Senate Commerce Committee held a second hearing on consumer data privacy, this time with privacy advocates

By Jon Washburn on Posted in ePrivacy, Events, Privacy
This past Wednesday, the Senate Commerce Committee held another hearing on consumer data privacy, this time giving voice to prominent privacy advocates. Previous testimony in September from leading technology businesses focused on concerns with the complexity of having to comply with a patchwork of different state privacy regulations, broad definitions of “personal information” in the … Continue Reading

NIST announces project to develop new Privacy Framework

By Jon Washburn on Posted in Announcements, ePrivacy
The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) announced recently that it has launched a collaborative project to develop a voluntary privacy framework to help organizations manage risk. According to NIST Director Walter G. Copan, “The development of a privacy framework through an open process of stakeholder engagement is intended to … Continue Reading

When was the last time you looked at RDP access?

By Jon Washburn on Posted in Cyber Attack, Cyber Crime, Data Breach, Security
A presentation at Black Hat recently revealed that the creators of the “SamSam” ransomware have netted over $6M to date, attacking mostly medium-to-large public and private sector organizations. And they’re showing no signs of slowing down. In the most recent SamSam attacks, the attackers concentrated their efforts on brute-force hacking of weak passwords on devices accessible … Continue Reading

New threat targeting old medical imaging equipment

By Jon Washburn on Posted in Cyber Attack, Cyber Crime, HIPAA, Industrial Control Systems, Security
Health care providers and suppliers should be wary of the “Orangeworm” threat, an implementation of malware out in the wild that’s gathering information off of compromised medical equipment, especially old systems where file shares and Windows XP are still in use: https://www.zdnet.com/article/mysterious-cyber-worm-targets-medical-systems-found-on-x-ray-machines-and-mri-scanners/ While this group seems to be limiting their actions to reconnaissance and compromising … Continue Reading

Email tracking services – are they really worth it?

By Jon Washburn on Posted in ePrivacy, Security
As illustrated in this recent article in Wired, email tracking services and their counterparts, anti-tracking services, have been rapidly gaining ground on the web; to the point that 40% of all email being sent, and 99% of the majority of the emails you receive (newsletters, marketing materials, notifications and transactional emails) are now being tracked. … Continue Reading

How does your leadership remain aware of cyber security threats?

By Jon Washburn on Posted in Cyber Attack, Industrial Control Systems, Security, Software
Some notable stats showed up in the recently-released 2017 Veracode State of Software Security report: while “nearly a third (29 percent) of survey respondents indicated that they are actively pursuing digital transformation projects [and] … a further 29 percent stated that they are either planning for or considering digital transformation projects for the future,” there … Continue Reading

The more people interact with AI, the more they like it – but that doesn’t diminish their privacy fears

By Jon Washburn on Posted in ePrivacy, EU, Software
According to a recent Genpact study: Nearly two-thirds of consumers (63%) are worried that Artificial Intelligence is going to make decisions that will impact their lives without their knowledge Less than one-third (30%) are at least “fairly comfortable” with the idea of companies using AI to access their personal data Almost three-quarters (71%) say they … Continue Reading

Funds transfer fraud in real estate transactions has seen an explosive increase this year

By Jon Washburn and Tamara Boeck on Posted in Cyber Crime, Fraud, Phishing, Security
As a firm with a large real estate practice, we are keenly aware of the risks of wire transfer fraud in real estate transactions – which has exploded from a reported $19 Million in 2016 to almost $1 Billion in 2017. Often this fraud is the result of the hacker compromising a legitimate email account … Continue Reading

You may be subscribing to US-CERT … but have you heard of ICS-CERT?

By Jon Washburn on Posted in Industrial Control Systems, Security
The United States Computer Emergency Readiness team (US-CERT) operates within the U.S. Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC), protecting America by responding to major incidents, analyzing threats, and exchanging critical cyber security information with trusted partners around the world.  You may have already signed up for the popular email alert … Continue Reading

Cyber thieves will target anything they can hold for ransom

By Jon Washburn on Posted in Cyber Attack, Security
Back in August, the Associated Press ran this article profiling how a North Carolina manufacturer has been attacked twice by cyber criminals looking to install malware and cripple the “just-in-time” nature of their operations so that they’d be willing to pay a ransom to return to production. While this manufacturer avoided paying the ransom so far, … Continue Reading

What is FOSS, and why should I be worried about it?

By Jon Washburn on Posted in Software
Free and Open-Source Software (FOSS) is computer software that can be classified as both free software and open-source software. Anyone who wishes to use FOSS is freely licensed to use, copy, study, and change the software in any way, and the source code is openly shared so that people are encouraged to voluntarily improve upon … Continue Reading

The Security Risk Assessment (SRA) Tool

By Jon Washburn on Posted in HIPAA
If you’ve been looking for a simple tool to help you with an initial self-assessment of how compliant you are with the HIPAA Security Rule, the ONC – in collaboration with the HHS Office for Civil Rights (OCR) and the HHS Office of the General Counsel (OGC) – developed a downloadable tool to help guide … Continue Reading

Hacking vs. Phishing – and Why the Difference is Important for Cyber Insurance Coverage

By Jon Washburn on Posted in Cyber Attack, Insurance Coverage
As you work to finalize your cyber insurance riders or supplemental policies, it’s important to pay attention to the language around what is specifically covered. To ensure you’re receiving the coverage desired, the first step is to understand the difference between hacking and phishing, and how this is being applied to your policy, and to … Continue Reading
LexBlog