InfoHive – Data Security – Page 109

New Study.Procurement. More Requirements for Election Vendors.

WHO: Brennan Center for Justice

WHAT: A Framework for Election Vendor Oversight

WHY:

80% of voting systems controlled by 3 vendors
little or no oversight of the security of these vendors

RECOMMENDATIONS:

New federal certification program to issue standards
Enforce vendors’ compliance with the standards
Institute mandatory compliance audits
Utilize a Technical Guidelines Development Committee that includes cyber security experts

Politico | Morning Cybersecurity | MORE PRESSURE ON VENDORS

NIH Wants Industry Feedback on Data Security + Health

Where do I see the proposal: Federal Register Request for Public Comments on a DRAFT NIH Policy for Data Management and Sharing and Supplemental DRAFT Guidance

The goals: improve the current data management and sharing policy for NIH funded or conducted research (Bonjour, to all your medical research and pharmaceutical research clients)

What best practices does NIH want to establish?

responsible management and sharing of scientific data
including exceptions or limits to data sharing

Comment deadline: January 10, 2020.

Health IT Security | NIH Seeks Input on Data Sharing Plan, Including Privacy, Security

New Kid on the Block. Corporate Partnership to Protect Infrastructure

WHO: The Chertoff Group + Dragos

WHAT: A policy intelligence & communication shop + a industrial control system shop

WHY: High Tech infrastructure is a data security target

WHAT ARE INFRASTRUCTURE OPERATORS SAYING?

Texas Central Rail: “As we usher in 21st century transportation solutions represented by high-speed rail, we believe that the safety of our future passengers is paramount.”

Yahoo Finance | The Chertoff Group and Dragos Form Strategic Partnership to Help Industrial Organizations Improve Risk Mitigation, Threat Detection and Incident Response

Data Breach at Health Agency. By the Numbers.

$1.6 million cost of federal fine to the state health agency

6,617 people had their personal health information accessible

How did the data breach occur?

“an internal application was moved from a private, secure server to a public server, where a software flaw allowed the private information to be viewed without access credentials.”
no risk analysis conducted
no access and audit controls

The state agency: Texas Department of Aging and Disability Services

Government Technology | Data Breach Costs Texas Health Agency $1.6 Million

3 Reasons for Standard Cyberattack Reporting

Who is calling for standard reporting? Harvard Business Review

Why? The nature of attacks are borderless, fast moving and difficult to predict or manage

What reasons support standard cyberattack reporting?

Information Sharing. The wheel isn’t being recreated. Attackers will repeat methods.
Certain Data will inform planning and defenses. this includes:
- dates relevant to the incident
- type of incident
- size of impact on financial results or ability to conduct business
- type of impact
- method used to access the network or data
- how the incident was resolved
Enforcement. Regulators need this data too to enforce bad actors and educate constituencies

Harvard Business Review | We Need a Global Standard for Reporting Cyber Attacks

Regulatory TREND. Allowing Cyber Security Donations to Physicians

Which regulatory agency is considering this? United States’ Department of Health and Human Services

What type of donations would be permitted? non-monetary exception to the regulatory Anti-Kickback Statute

What do the rules look like? DHHS proposed cybersecurity donation rules

Why is this critical? Interoperability and data sharing in healthcare makes an entire health care system vulnerable to one office with a cybersecurity weakness

InfoSecurity | US Proposes Legalizing Cybersecurity Tech Donations to Doctors

Legislation to Shore Up City Cyber Security

Where: Congress

What is the legislation: Klobuchar, Peters, Johnson, Lankford Introduce Bipartisan Bill to Strengthen Cybersecurity for Local Governments

What will it do?

Require the Department of Homeland Security to provide resources and assistance to cities
Provide cities with .gov domains administered by the federal government

The Hill | Senators introduce bill to strengthen cybersecurity of local governments