Monthly Archives: June 2017

Health Care Data Breach Loophole. Some breaches need not be reported. What you need to know.

Some say hospitals that get hit by a ransomware attack need not disclose the ransomware data breach.

The question- If data is held hostage/accessed but is not taken must that be disclosed?

The supporters for disclosure say: More mandatory reporting.This regulatory gap limits the health-care system’s ability to fight cybercriminals.

Who is counted among supporters of disclosure? Congressman Ted Lieu, a California Democrat who along with Congressmen Will Hurd, a Texas Republican

What do…

Cyber Security Factoring into Debt Rating for Cities, Counties & States.

Cyber security is becoming an element in analysis for bond markets.

Is this shift a result of a catalyst? Yes, the use of malware toward local governmental entities

Does this follow inthe footsteps of other entities disclosing cyber protections to investors? Yes, utilities and hospitals are starting to disclose any information to potential investors in bond documents about cyber risks or defenses

Reuters | U.S. muni market slowly starts paying heed to cyber risks

39 States. Elections Hacked. How Land of Lincoln is Reacting to Protect Midterm Elections.

State: Illinois

Illinois’ Solutions to prevent election hacking in the 2018 mid term elections:

  • Sending election officials a letter with these instructions:
    • scrub voting systems of potential malware
    • fill any kind of security gaps
    • continue to be vigilant 

 

Politico | LAND OF LINCOLN PREPS FOR 2018

WGN | Illinois among 8 states investigating Russian hacking of its elections

Chicago Tribune | From the community: Sen. Michael E. Hastings works to protect Illinois election data from…

National Governor Association Prioritizing Cybersecurity. 4 Highlights to be Informed.

Virginia Gov. Terry McAuliffe, Chair of the National Governor Association, urges states to:

  • not wait for the federal government to protect data security and privacy
  • federal funding is needed for states
  • states must lead with coordiantion with the federal government
  • Virginia’s Executive Order creating a Cyber Security Commission should be duplicated in other states

Politico | Governor Cyber Speaks

SEC Warns Cyber Defenses Do Not Pass Muster. 3 Bits informed:intel

The Securities Exchange Commission has issued a warning investment advisers that they need to be more proactive in data security by:

  • conduct continuous cyber-risk assessments
  • performing penetration or venerability tests
  • 26% of advisers and funds examined failed to conduct periodic risk assessments of critical systems to identify cyber security threats, vulnerabilities, and the potential business consequences.

Reuters | SEC identifies adviser cyber security flaws

Reuters | Exclusive: New SEC…

3 Bits of informed:intel. Cyber Attacks & Downgrades to a City's Credit Rating

Has a US city had its credit rating downgraded after a cyber attack? No

Do financial industry analysts think it possible to downfgrade a city’s credit rating after a cyber attack? yes

What factors can play into whether a local governmental entity’s credit rating could get downgraded?

  • Does the local governmental entity, like a school district or municipal utility, have the fiscal reserves to pay the costs of cleaning up a cyber attack?
  • Does the cyber attack hamper the tax payers support of…

Bill to Require ID Protection at any State Government Data Breach. 3 Bits informed:intel

State: California

The legislation: Assemblyman Matt Dababneh sought to apply the standard applied to business of requiring 1 year of ID theft protection services for anyone who is impacted by any government breach in California. AB 241 (2017) 

The Opposition is winning as the bill stalls. The loyal opposition includes California State Assn. of Counties, the Urban Counties of California, and the League of California Cities

Opposition arguments:

  • it would cost cities & counties too much
  • state…

4 Future Data Security regulatory issues for Health Care.

The federal HEALTH CARE INDUSTRY CYBERSECURITY TASK FORCE released 27 recommendations in its June 2017 report, and set forth these 5 future regulatory issues for health care cybersecurity:

 

  • Develop a cohesive plan for implementing this report’s recommendations and develop appropriate metrics to measure data security implementation progress.

  • Conduct a risk analysis, similar to the National Infrastructure Protection Plan, with an overlay for health care cybersecurity and privacy.…

27 Recommendations. Health Care industry & Cybersecurity. New Federal Task Force Report. Precursor to State Laws. See the Future.

Create a cybersecurity leader role within HHS to align industry- facing efforts for health care cybersecurity. 

Establish a consistent, consensus-based health care-specific Cybersecurity Framework 

Require federal regulatory agencies to harmonize existing and future laws and regulations that affect health care industry cybersecurity. 

Identify scalable best practices for governance of cybersecurity across the health care industry. 

Explore potential impacts to the…