Category Archives: private corporations

SEC Warns Cyber Defenses Do Not Pass Muster. 3 Bits informed:intel

The Securities Exchange Commission has issued a warning investment advisers that they need to be more proactive in data security by:

  • conduct continuous cyber-risk assessments
  • performing penetration or venerability tests
  • 26% of advisers and funds examined failed to conduct periodic risk assessments of critical systems to identify cyber security threats, vulnerabilities, and the potential business consequences.

Reuters | SEC identifies adviser cyber security flaws

Reuters | Exclusive: New SEC…

Lege Trend. Hack Back Bills. 4 Ways one Hack Back Bills is Changing.

Amendments to Congressman Tom Graves’ Active Cyber Defense Certainty Act include:

  • mandatory reporting requirement for entities that use active-defense technique
  • the reporting to federal law enforcement will ensure such tools are used responsibly
  • 2 year sunset clause
  • exemption allowing people or companies to recover their lost data if it’s found using defensive techniques and can be grabbed back without destroying other data.

Politico Morning Cyber Security | Scoop: ‘Hack back’ bill gets…

Trend. Cyber National Guard. Private cyber national guard?

Who is proposing a cyber national guard? Congressman Will Hurd, Chair of the House’s information technology subcommittee

Why push for a cyber national guard?  to help recruit stronger talent to fill cybersecurity roles in the federal government

How does the private sector factor in? a cyber nataional guard would “allow industry professionals to bring innovative ideas back into the federal government without the government having to keep up with the salaries available in the technology…

Lege Trend. +1 State Adding More Stringent Notification & Mandating Identity Theft Services

State: Delaware

 What is HB 180 in Delaware trying to do?

  • Improve notification requirements
  • Require 1 year of identity theft mitigation services when Social Security numbers are breached
  • Require businesses to safeguard personal information
  • Require notice to Delawareans affected by a breach within 60 days of discovery
  • If more than 500 residents impacted, the Attorney General must be notified

If passed, Delaware would be state #2 to require ID theft services after a breach.

News.Delaware.Go…

Lege Trend. Link Licensing to Data Security Standards.

Legislative body is located where? Australia

What triggers licensing issues when failing to meet data security standards? 

  • Licensing enforcement is triggered only for companies valued at greater than $3 million in revenue

The goal: Move data security to the forefront with business leadership

Intelligent Insurer | New data breach reporting legislation deemed cyber game changer in Australia

Lege Trend. 8 Elements. Data Breach Notification that outs the hackers.

South Africa recently enacted a new data breach notification law that requires companies to:

  • Notification by the company will have to factor in the needs of law enforcement
    • Delay is only permitted if it undermines or impedes an investigation
  • Companies are asked to restore the integrity of their information system.
  •  Notification itself must be in writing  either via email or regular mail 
  • Alternative notification if mail fails, is  prominent position on the website, published in the…

Lege Trend: Notify State Tax Agency of Some Breaches. Good for Businesses.Read the Bill.

State: Virginia

The breach that triggered legislation: rampant W-2 phishing e-mails that have plagued businesses

Why was a legislative fix necessary? These data breaches and scames cost many states millions of dollars as a result of payments made and investigations conducted on fraudulent tax returns.

The legislative fix:

  • Notification to Attorney General & VA Department of Taxation
  • When employers and payroll service providers experience a breach
  • The breach must involve taxpayer…

Lege Trend. A Data Protection Bill Called Bad for Business. The Competing Interests…

The  Bill:  Illinois Right to Know Bill

What does the Right to Know Bill in Illinois do? It allows a person to know what information is collected about the person and to which businesses that information could be sold.

Why is it considered bad for business? 

  • complex compliance regulations, which would apply to businesses of all sizes,
  • enormous burden on small businesses statewide
  • “requires any business with a website — even a local flower  shop or pizza parlor — to draft privacy policies…

8 States Data Privacy Laws. States Beating Feds to the Punch & the Koolaide.

  • Illinois
    • “right to know” bill
      • will let consumers find out what information about them is collected & what kinds of businesses the information is shared with
    • A bill to regulate when consumers’ locations can be tracked by smartphone applications
    • A bill to limit the use of microphones in internet-connected devices like mobile phones, smart TVs and personal assistants like Amazon’s Echo
  • California and Connecticut
    • Updated their laws to restrict government access to online…

Legal Trend. New FBI Guidelines. Healthcare. Cybersecurity.

What guidance is the FBI giving medical and dental providers on cybersecurity? That file transfer protocols, FTP, transfers csn be accessed by anonymous users without passwords. Cyber secuity measures should be taken to correct server settings.

What speficially did the FBI say about protected health information (PHI) pr personally identifiable information (PII) ? PHI & PII should not be kept on FTP servers allowing for anonymous operation

National Law Review | New FBI Warning for Healthcare…