8x8 Inc · NASDAQ:EGHT

8x8 — Conference Presentation (January 2015)

21 slides from 8x8's conference presentation, Jan 20, 2015

  1. Slide 1: Is Your Compliance Strategy Putting Your Business at Risk?

    Is Your Compliance Strategy Putting Your Business at Risk? January 20, 2015 © 2015 NASDAQ-LISTED: EGHT

  2. Slide 2: Today's Speakers

    Today’s Speakers Michael McAlpen Exec. Dir. of Security & Compliance, 8x8, Inc. David Leach Business Communications Consultant, 8x8, Inc. 22

  3. Slide 3: Mike McAlpen - Executive Director, IT Security & Compliance

    Mike McAlpen - 8x8, Inc. Executive Director, IT Security & Compliance • Business Leader, Global Information Security & Compliance, Visa Inc. • Senior Director, Hewlett Packard Professional Services Information Security, CIO/CISO Advisory, Enterprise Architecture Practices • American Bar Association

  4. Slide 4: Health Insurance Portability and Accountability Act

    Health Insurance Portability and Accountability Act Pre-2013 HIPAA covered any business associate who performed or assisted in any activity involving the use or disclosure of individually identifiable health information, such as third-party administrators, pharmacy benefit managers and benefit consu

  5. Slide 5: Companies Impacted by HIPAA (partial list)

    Companies Impacted by HIPAA (partial list) Cloud Accounting Administrative Healthcare Data Tax Storage Provider Advisor Health Healthcare Plan Clearinghouse Finance Legal Billing Consulting 5

  6. Slide 6: Penalties for Non-Compliance

    Penalties for Non-Compliance Enforced by U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) Violation Category Each Violation All Such Violations Annual Max Did not know $100 - 50,000 $1,500,000 Reasonable cause $1,000 - 50,000 $1,500,000 Willful neglect, corrected $10

  7. Slide 7: HIPAA Impact on Communications

    HIPAA Impact on Communications Electronic Personal Health Information (E- PHI) may be contained in any one of these forms. 7

  8. Slide 8: PCI-DSS Security Breach Fines

    PCI-DSS Security Breach Fines  MasterCard  Level 1 & 2 Merchants  First Violation – up to $25,000  Second Violation – Up to $50,000  Third Violation – up to $100,000  Fourth Violation – up to $200,000  Level 3 Merchants  First Violation – up to $10,000  Second Violation – Up to $20,000  Th

  9. Slide 9: PCI-DSS Best Practices

    PCI-DSS Best Practices If you take credit card numbers, be sure you . . .  Never store or write down the CVV2 data (card security code)  All other card information, if stored, must be encrypted and/or tokenized (i.e. number, user name, exp. Date)  Ideally pass this data through to your card proce

  10. Slide 10: Other Regulatory Compliance

    Other Regulatory Compliance  Any business concerned with data privacy (Energy, Bio-Tech, Hi-Tech, Law Firms, Labor Unions, Construction, etc…)  FISMA/FedRAMP (local, state, Federal, defense and the 3rd parties supporting them)  FERPA - Education  FFIEC – Financial Services  GLBA – Financial Ser

  11. Slide 11: World's Biggest Data Breaches – 30,000+ Records

    World’s Biggest Data Breaches – 30,000+ Records 12

  12. Slide 12: Other Compliance Best Practices

    Other Compliance Best Practices Develop a Culture of Compliance to Maintain Data Privacy What auditors look for:  Separation of duties  Evidence of training & authorization  Secure storage practices (data encryption)  Reputable 3rd party attestation of any 3rd party vendors persistently handling

  13. Slide 13: Complete, Secure & Compliant Portfolio

    Complete, Secure & Compliant Portfolio 14

  14. Slide 14: The Most Secure & Compliant Cloud Communications Provider

    The Most Secure & Compliant Cloud Communications Provider Alliances Compliances Achieved 3rd Party Compliance Validations 15 15

  15. Slide 15: Quality and security similarities

    Quality and security similarities  Deming’s TQM principles turned around the Japanese auto industry  You can’t inspect-in quality, you must build quality into a product throughout production.  The same is true for security, it takes time, effort and complete commitment. 8x8 has done this over man

  16. Slide 16: What does it take to meet HIPAA Compliance Requirements?

    What does it take to meet HIPAA Compliance Requirements? The HIPAA related data in: Must be safeguarded by: 1. Back end systems -(50 Policies, 150 1. Physical audit controls, training, physical securtiy, 2. Administrative monitoring, Defense in Depth, OWASP 3. Technical Application Security, DR/BCS

  17. Slide 17: ChenMed Primary Care Provider Turns to 8x8 for HIPAA-Compliant Cloud Communications

    ChenMed Primary Care Provider Turns to 8x8 for HIPAA-Compliant Cloud Communications  Innovative, physician-led primary care provider; HIPAA compliance a must  Over 1,400 employees in 38 locations and six states  Deployed Virtual Office in all locations; completed in under five weeks  Customer sa

  18. Slide 18: Always Secure Communications

    Always Secure Communications DDOS Hardened protected Encryption software network • Data in motion • Data at rest Protected from End point man in the authentication middle attacks 23

  19. Slide 19: Questions?

    Questions? © 2015 NASDAQ-LISTED: EGHT

  20. Slide 20: Additional Resources

    Additional Resources • U.S. Department of HHS HIPAA web site http://www.hhs.gov/ocr/privacy/hipaa/understanding/index.html http://www.hhs.gov/ocr/privacy/hipaa/administrative/enforcementrule/hitechenforcementifr.html http://www.hhs.gov/web/508/accessiblefiles/checklists.html • CMS Security Risk Anal

  21. Slide 21: Thank you

    Thank you Contact us: Mike McAlpen security-compliance@8x8.com © 2015 NASDAQ-LISTED: EGHT

8x8 — Conference Presentation (January 2015) on 6ix