Lege Trend: Notify State Tax Agency of Some Breaches. Good for Businesses.Read the Bill.

State: Virginia

The breach that triggered legislation: rampant W-2 phishing e-mails that have plagued businesses

Why was a legislative fix necessary? These data breaches and scames cost many states millions of dollars as a result of payments made and investigations conducted on fraudulent tax returns.

The legislative fix:

  • Notification to Attorney General & VA Department of Taxation
  • When employers and payroll service providers experience a breach
  • The breach must involve taxpayer identification numbers & withholding information 

Virginia H2113 (2017)

Utilities & Cyber Security. 3 Reasons Utilities Say CyberSecurity is the #1 issue.

The survey of utility professionals: Utility Dive’s fourth annual State of the Electric Utility Survey, surveying more than 600 utility professionals

The #1 most pressing issue facing utility companies: cyber and physical security 

what you need to know:

  • In 2015 & 2016 cyber and physical security was the 6th most pressing issue for utilities
  • Increased media attention to cyber threats has raised the issue’s importance
  • How the issues ranked as very important to the companies surveyed:
    • cyber and physical security  36%
    • DER policy. 32%
    • state regulatory model reform 32%
    • rate design reform. 29%
    • aging grid infrastructure 28%
    •  threat to reliability from integrating variable renewables and DERs 28%

Utility Dive | Why utilities say grid security is the most pressing sector issue of 2017

Regulatory Trend. Election Hacking Unit. 3 Key Points for your state.

The U.K. Parliament is working to create an election hacking unit that:

  • The unit’s goal: help ensure the integrity of UK Democracy & public confidence
  • The unit will be monitoring only
  • Recommendations focus on an executive level, law enforcement driven unit

SC Magazine UK | Parliamentary committee proposes unit to combat ‘election hacking’

Lege Trend. Exception to Data Notification.

Trendy new exception to data breach notifications: encrypted data

How Tennesee worded the exception in its legislation: 

(1) “Breach of system security”:
      (A) Means the acquisition of the information set out in subdivision (a)(1)(A)(i) or (a)(1)(A)(ii) by an unauthorized person that materially compromises the security, confidentiality, or integrity of personal information maintained by the information holder:

           (i) Unencrypted computerized data; or

           (ii) Encrypted computerized data and the encryption key;

 

Tennessee SB 547 (2017) 

State insurance Regulators + Familiar State Cybersecurity Finance Rules= More Cybersecurity Rules in 2017

The National Association of Insurance Commissioners is being urged to adopt New York’s Cyber Finance Security Rules in each of their respective states.

NAIC will release proposed rules soon

Reuters | New York Regulator Wants Other States to Model Cyber Laws After Its Rules

Refresher on the New York Cyber Security Rules from January 2nd, 2017 informed:intel:

The state upping the ante on data security rules for the finance industry: New York

The new New York rules announced December 28th will:

  • Effective Date will be March 1, 2017 instead of January 1st
  • Require annual reporting to the state about data security compliance
  • Requires financial institutions to maintain comprehensive audit trails
  • Mandatory reporting of any cybersecurity event within 72 hours
  • Financial institutions must appoint a Chief Information Security Officer (CISO)
  • Required multifactor authentication for staff accessing internal networks or information systems externally

Business Insider | New York delays new cybersecurity rules for financial firms​

3 Procurement Opportunities from the Dallas Emergency Siren Hack

Background on the emergency system hack:

  • all 156 of Dallas’ emergency sirens were hacked and triggered to sound last weekend
  • The hack of the system exposed that the system had to be shut down 

Procurement Opportunities for Emergency IT:

  • Mayor Rawlings called it “evidence of a need to upgrade and safeguard the city’s technology infrastructure”
  • The hack was tracked down because of the ability to coordinate with other security professionals
  • The sirens triggered a heavy load on the city’s 911 system that triggered up to 11 minute wait times

New York Times | Hacking Attack Woke Up Dallas With Emergency Sirens, Officials Say

Lege Trend. A Data Protection Bill Called Bad for Business. The Competing Interests…

The  Bill:  Illinois Right to Know Bill

What does the Right to Know Bill in Illinois do? It allows a person to know what information is collected about the person and to which businesses that information could be sold.

Why is it considered bad for business? 

  • complex compliance regulations, which would apply to businesses of all sizes,
  • enormous burden on small businesses statewide
  • “requires any business with a website — even a local flower  shop or pizza parlor — to draft privacy policies longer and more confusing than anything required by existing law and to create new IT (information technology) systems”
  • pro-trial lawyer legislation

Dispatch Argus | Bill will crush small business, tech investment

Which hospital type is at greatest risk to a data breach?

Teaching Hospitals. 

Johns Hopkins Carey Business School looked at data for data breeches at hospitals:

  •  1,798 data breaches hit hospitals from Oct. 21, 2009, to Dec. 31, 2016
  • 33 hospitals reported more than one breach — many of them teaching hospitals. 
  • Of the 141 acute care hospitals that reported breaches to HHS, 52 were major academic medical centers
  • In 2016, the overall number of electronic records that were compromised grew by 566% to more than 4 billion

Health Care Dive | Teaching hospitals at higher risk for data breaches, study finds