SEC Warns Cyber Defenses Do Not Pass Muster. 3 Bits informed:intel

The Securities Exchange Commission has issued a warning investment advisers that they need to be more proactive in data security by:

  • conduct continuous cyber-risk assessments
  • performing penetration or venerability tests
  • 26% of advisers and funds examined failed to conduct periodic risk assessments of critical systems to identify cyber security threats, vulnerabilities, and the potential business consequences.

Reuters | SEC identifies adviser cyber security flaws

Reuters | Exclusive: New SEC enforcement chiefs see cyber crime as biggest market threat

3 Bits of informed:intel. Cyber Attacks & Downgrades to a City's Credit Rating

Has a US city had its credit rating downgraded after a cyber attack? No

Do financial industry analysts think it possible to downfgrade a city’s credit rating after a cyber attack? yes

What factors can play into whether a local governmental entity’s credit rating could get downgraded?

  • Does the local governmental entity, like a school district or municipal utility, have the fiscal reserves to pay the costs of cleaning up a cyber attack?
  • Does the cyber attack hamper the tax payers support of the local governmental entity, and thus the local governmental entity[s ability to raise additional taxes?

Governing | Can a Cyberattack Cause a Credit Rating Downgrade?

 

Bill to Require ID Protection at any State Government Data Breach. 3 Bits informed:intel

State: California

The legislation: Assemblyman Matt Dababneh sought to apply the standard applied to business of requiring 1 year of ID theft protection services for anyone who is impacted by any government breach in California. AB 241 (2017) 

The Opposition is winning as the bill stalls. The loyal opposition includes California State Assn. of Counties, the Urban Counties of California, and the League of California Cities

Opposition arguments:

  • it would cost cities & counties too much
  • state agencies store their information in shared data centers so it would be too hard to discern whcih agency should pay the cost of the services

Government Tech | New Legislation Pressures California Lawmakers to Strengthen Data Security

4 Future Data Security regulatory issues for Health Care.

The federal HEALTH CARE INDUSTRY CYBERSECURITY TASK FORCE released 27 recommendations in its June 2017 report, and set forth these 5 future regulatory issues for health care cybersecurity:

 

  • Develop a cohesive plan for implementing this report’s recommendations and develop appropriate metrics to measure data security implementation progress.

  • Conduct a risk analysis, similar to the National Infrastructure Protection Plan, with an overlay for health care cybersecurity and privacy. Based upon the analysis, develop a comprehensive cybersecurity roadmap for the HPH Sector.

  • Establish an ongoing public-private forum, similar to this Task Force, to further the discussions of health care industry cybersecurity as the industry evolves. The Task Force members found this engagement with federal partners beneficial to understand our common cybersecurity challenges and concerns.

  • HHS leadership should partner more closely with existing DHS efforts with the insurance industry in helping identify a roadmap to enable private insurance approaches in the health care industry. The sometimes-conflicting roles of HHS as a regulatory body and facilitator for improved security could be mitigated by encouraging an industry-based insurance market.

  • Enable an ongoing conversation and develop strategies to identify resources and incentives that would help to overcome the barriers faced by small and rural organizations. 

27 Recommendations. Health Care industry & Cybersecurity. New Federal Task Force Report. Precursor to State Laws. See the Future.

Create a cybersecurity leader role within HHS to align industry- facing efforts for health care cybersecurity. 

Establish a consistent, consensus-based health care-specific Cybersecurity Framework 

Require federal regulatory agencies to harmonize existing and future laws and regulations that affect health care industry cybersecurity. 

Identify scalable best practices for governance of cybersecurity across the health care industry. 

Explore potential impacts to the Physician Self-Referral Law, the Anti-Kickback Statute, and other fraud and abuse laws to allow large health care organizations to share cybersecurity resources and information with their partners. 

Secure legacy systems. 

Improve manufacturing and development transparency among developers and users. 

Increase adoption and rigor of the secure development lifecycle (SDL) in the development of medical devices and EHRs. 

Require strong authentication to improve identity and access management for health care workers, patients, and medical devices/EHRs. 

Employ strategic and architectural approaches to reduce the attack surface for medical devices, EHRs, and the interfaces between these products. 

Establish a Medical Computer Emergency Readiness Team (MedCERT) to coordinate medical device-specific responses to cybersecurity incidents and vulnerability disclosures. 

Every organization must identify the cybersecurity leadership role for driving for more robust cybersecurity policies, processes, and functions with clear engagement from executives. 

Establish a model for adequately resourcing the cybersecurity workforce with qualified individuals. 

Create MSSP models to support small and medium-size health care providers 

Small and medium-sized health care providers should evaluate options to migrate patient records and legacy systems to secure environments (e.g., hosted, cloud, shared computer environments). 

Develop executive education programs targeting Executives and Boards of Directors about the importance of cybersecurity education. 

Establish a cybersecurity hygiene posture within the health care industry to ensure existing and new products/systems risks are managed in a secure and sustainable fashion. 

Establish a conformity assessment model for evaluating cybersecurity hygiene that regulatory agencies and industry could rely on, instead of a diversity of auditors. 

The NIST Baldrige Cybersecurity Excellence Builder, should be further developed: 1) specific to health care, and 2) specific to the types of health care operations that are widely deployed across the industry and have limited access to cybersecurity resources (e.g., small hospitals or practices, rural locations with limited access to security resources). 

Increase outreach and engagement for cybersecurity across federal, state, local, tribal, territorial, and the private sector partners through an education campaign including meetings, conferences, workshops, and tabletop exercises across regions and industry. 

Provide patients with information on how to manage their health care data, including a cybersecurity and privacy grading system for consumers to make educated decisions when selecting services or products around non-regulated health care services and products. 

Develop guidance for industry and academia on creating economic impact analysis and loss for cybersecurity risk for health care research and development. 

Pursue research into protecting health care big data sets. 

Tailor information sharing for easier consumption by small and medium-size organizations who rely on limited or part-time security staff. 

Broaden the scope and depth of information sharing across the health care industry and create more effective mechanisms for disseminating and utilizing data. 

Encourage annual readiness exercises by the health care industry. 

Provide security clearances for members of the health care community. 

HEALTH CARE INDUSTRY  CYBERSECURITY TASK FORCE  REPORT | June 2017

The Hill | Federal task force: Here’s how to fix healthcare cybersecurity

Lege TREND. Office of Cyber Defense Coordination. 4 Bits informed:intel

The State Legislature that created the Office of Cyber Defense Coordination​: Nevada

Within which state agency will the Office live? Nevada’s Department of Public Safety

The Legislation creating the office: Nevada’s AB 471 (2017)

What do these cyber offices look like in other states?

Government Technology | Nevada Governor Signs Bill to Create Office of Cyber Defense Coordination

TREND. State adds 4 Executive Level Data Security Positions.

State: Massachusetts

The highest level Massachusetts government position created: Secretary of Technology

The MA Secretary of Technology would be tasked with hiring:

  • chief data officer
  • chief privacy officer
  •  chief digital officer

Originator of the MA Secretary of Technology post: The Massachusetts Governor

Data and cyber positions are gaining power insisde and outside government.

Greenfield Recorder  | New Baker bill creates Cabinet position for technology

Intelligent Transportation Cybersecurity Task Force. 3 Bits of informed:intel

The brainchildren behind Intelligent Transportation Cybersecurity Task Force: Intelligent Transportation Society of America & nonprofit Cyber Future Foundation

Which stakeholders are involved? auto manufacturers, government leaders and transportation officials

What will the task forces study? cybersecurity issues-  legal and liability issues and policy, regulation and legislation- to esnusre the highest elevel of safety and privacy in a connected transportation environment

Politico | Morning Cyber Security | NEW TRANSPORTATION THINKING