InfoHive – Data Security

What did New York’s Shield Act, an amendment to the states data breach notification law, require that we may see replicated in mass?

requiring that state data security rules must be tailored to the size of the business

CSO | New York’s SHIELD Act could change companies’ security practices nationwide

Where: Ohio

What election measures is OHIO considering for its now postponed primary election? Only mail in ballots

How many states allow elections to be conducted only by mail? 21

How many allow full statewide elections by mail? 4 — Colorado, Hawaii, Oregon and Washington

What is voter turn out in mail-in ballot states?

•  Colorado 63%
• Oregon 61%
• Washington 58.9%

What’s Ohios voter turn out? 50.9%

Plain Dealer via Governing | Ohio Considers Vote-from-Home for Postponed Primary Election

What are tech companies saying and doing?

• Google: Issued statement it would limit government access to location data
• Facebook: CEO Zuckerberg: “I don’t think it would make sense to share people’s data if people haven’t opted in for that”
• Apple: Does not collect iPhone user location data

Politico | In another coronavirus-related security issue for tech giants

The Hill | Google to limit federal access to location data as it fights coronavirus

Washington Post | U.S. government, tech industry discussing ways to use smartphone location data to combat coronavirus

• Dark web ransomware sites offering coronavirus packages
• Trump Administration Relief plan includes the following data security funding:
  • $21 million for Department of Energy cybersecurity
  • $47 million for FEMA for data security + data networks
  • $17 million for Interior Department for network upgrades
  • $5.5 million for National Archives and Records Administration to provide electronic remote access and accelerate security upgrades

Morning Cybersecurity | Cybersecurity money part of emergency coronavirus request

Issues for Cannabis Companies:

• What customer and supply chain information are you retaining?
• Is that information protected?
• Does your company have a plan if there is a data breach or ransomware attack?
• Does your state have a track-and-trace requirement for cannabis businesses?
• How is notification of a breach impacted when a customer from State B, where cannabis is illegal, has its consumer information breached in State A where cannabis is legal, and notifies the attorney general in State B. What happens to customer B?
• Will cyber liability insurance policies be written for the industry?

JURIST | Cannabis Companies are Overlooking Data Security Laws and Regulations

Where: California

What: AB 2320 (2020 | CA)

Which contractors would be impacted?

• contractors that receive or are given access to records that contain personal information protected under the state’s Information Practices Act

What type of personal information is the state protecting?

• names
• social security numbers
• physical descriptions
• home addresses
• home telephone numbers
• education
• financial matters
• medical or employment history

Government Technology | California considers mandating cyberinsurance for contractors

Where: Utah

What: HB 158 (2020 | UT) creates an affirmative defense from litigation for businesses that follow state law on maintaining cyber security programs

How does the state define the cyber security programs with which businesses will have to comply?

• conforms to an industry recognized cybersecurity framework
• example programs:
  • NIST special publication 800-171;
  • NIST special publications 800-53 and 800-53a;
  • the Federal Risk and Authorization Management Program Security Assessment Framework;
  • the Center for Internet Security Critical Security Controls for Effective Cyber Defense; or
  • the International Organization for Standardization/International Electrotechnical  Commission 27000 Family – Information security management systems;

• and if the protected personal information is regulated by a government, cybersecurity protection programs must comply with the law

Next up on the ban list: Drones made in foreign countries

Who is issuing the ban? Trump Administration by Executive Order

Why ban foreign made drones? national security

Which entities will be forbidden from using foreign made drones? federal departments & agencies

Are there exceptions? Yes, military and the intelligence community

Tech Crunch | US preparing to ban forge in-made drones by government use

The city: New Orleans

The cyber attack: a ransomeware attack in December 2019

The cost to modernize the city computers: $7 million

What will the $7 million cover for New Orleans?

• ransomware attack recovery
• fixing city email services and networking infrastructure
• modernizing the computer systems

Governing | Louisiana Has Spent $2.3M in Recent Cyberattack Responses

The state: Lousiana

What type of cyber attack did Lousiana experience?

• A ransomware attack against state computer systems.
• Lousiana did not pay the ransom.

The cost: $2.3 million

• $1.7 million to restore state systems
• $333,000 to assist school districts

What did $2.3 million cover? paying staff to go to various school districts, state agencies and New Orleans to help re-image computers

Which agency was the most impacted? DMV

• 45 year old computer system
• down for weeks after the attack

Governing | Louisiana Has Spent $2.3M in Recent Cyberattack Responses