Category Archives: data encryption

Banking Regulator Announces 2 New Data Security Initiatives

The FDIC announced on May 9th, 2 new data security initiatives:

  • improved software to force encryption of portable devices
  • hiring of a third party to assess FDIC information technology security and privacy programs

Bloomberg BNA | FDIC Takes New Initiative on Data Security Following Breaches

Executive GOV | FDIC Plans New Security Measures After Retroactive Data Breach Report

INTERIM. How 1 State Protects Health Care Data. 3 Key Points.

In 2015, ​New Jersey expanded its data breach laws to apply to include these health care information holders that service New Jersey patients:

  •  health insurance companies
  • health service corporations
  • hospital service corporations
  • medical service corporations
  • health maintenance organizations 

New Jersey also adopted new encryption standards that:

  • Encrypt confidential patient information or secure personal information
  • Utilize any method of technology rendering the information…

INTERIM. 4 Credit Card Processing Recommendations for TX House Committee on Investments & Financial Institutions.

The Credit Union National Association proposed the following changes to credit card processing in Texas to improve data security:

  • Data Security at Merchant Level. Require merchants receiving payment by credit or debit cards to protect the sensitive personal financial information they receive;
  •  Require Consumers to Notify Card Processors of Breaches. Require card recipients to notify their card processor immediately upon detecting a breach, and require the information be provided to the…

INTERIM. TREND. Data Breach Law Changes. Read the Bill. New Requirements for Business.

Which state jumped on the enanced data breach notification law bandwagon? Nebraska

What 3 changes did Nebraska make to its data breach laws?

  • Expand the Data Triggering Notification to incude:
    • user name or email address along with
    • a password or security question and answer
    • that would permit access to an online account
  • Expands who Receives notice of a breach. Companies also have to notify the State Attorney General.
  • Encryption standard changed so that if the hackers got a hold…

Lege Trend: Requiring Tech Companies to Decrypt. Read the Bill. Plan your Strategy.

What state legislature considered a bill to fine companies that do not decrypt after receiving a court order? California

What happened to this bill to fine companies? Died in committee without a vote

What did opponents to the bill say?

  • forced decryption weakens security and personal privacy
  • “Do we have a world where there’s no privacy whatsoever for the average citizen?
  • Assuming that this body is OK with every agency in the U.S. having access to everything, every application, every…

Tech & Privacy Interests Do Not Like Data Security Legislation. 3 Keys Informed Intel

  • Tech & Privacy Interests don’t like provisions forcing technical assistance to government investigations
  • Why the hestiancy over forced assistance? It will lead to greater data insecurity
  • Ties the hand of businesses that want to provide their customers greater security

The Hill | Encryption bill draft worries tech community

CNET | Encryption bill would force companies to surrender user data

All the State Budget Data Security Items. Procurement. Procurement. Procurement.

In Legislative Appropriation Request Trends:

  • 3rd party contracts to assess security at agencies
  • HB 2783 (2013) required a study to see if agency computer systems were legacy.
    • Hello, 3rd party contracts to replace or upgrade legacy systems
    • Legacy systems are a higher security risk
    • Over 1/2 agency computer systems are

In 2015’s State Budget:

  • Article IX, Section 9.10 : DIR prioritization of state agencies’ cybersecurity projects
  • Article IX, Section 9.11, Cybersecurity…

Lege Trend: Reworking Agency Data Security. Procurement. Procurement. Procurement.

Which state passed new data security laws in 2016? Wyoming

Were the new laws the result of a breach or a legislative mandate? The result of a 2 year,  4-member Joint Task Force on Digital Information Privacy

What are agencies asked to do?  2 tasks

  • Agencies must review their data collection, handling, security and management.
  • Agencies must assess their stored data and explain why it collected it; and whether it really still needs to be stored

Where does procurement come into…

INTERIM. 2 Points Informed Intel. Regulatory Guidance for Data Security while Government Teleworking. Contracting Opportunities.

What entity released guidelines on teleworking and cyber security? The National Institute of Standards and Technology

What suggestions in the guidelines that will direct procurement opportunities?

  • virtual mobile infrastructure technologies

    • that create temporary, secure environments for teleworkers who need to access organizational data that are destroyed when the session is over

  • mobile device management technology
    • technology to force devices to adhere to certain security…

Another Healthcare Facility Hit with Ransomeware. The Informed Intel in 3 Points.

  • Methodist Hospital in Kentucky was hit by ransomeware
  • The ransomeware, of the “Locky” strain,  encrypted, deleted original files  and is holding hostage all its data for $1,600, or 4 bitcoins
  • Hospital paperwork is being processed by hand

Krebs on Security | Hospital Declares ‘Internal State of Emergency’ After Ransomware Infection

Governing | Hackers Target Hospitals for Ransom