TREND. Voting Technology Needs Upgrade. 1 Big Hurdle to Overcome.

Voting machines need a tech upgrade like a 2005 laptop needs an upgrade. Technology changes. Hackers adapt faster than lawmakers.

The hurdle to upgrade voting machines?

  • Taxpayers have to foot the bill. 
  • Legislatures are going to have vote to fund it
  • There will have to a repeat of the 2002 federal funding to upgrade voting equipment

Techwire | Voting Technology Needs an Upgrade, But Who Will Pay for It?

Top 5 Data Security Risks for Public Schools. Bonjour Procurement Contracts.

Who identified the public education data security risks? Missouri State Auditor 

Was the auditor acting under a special audit program? The Cyber Aware School audits initiative

What 5 data security risks did the MO auditor identify?

  • Data management programs are not fully utilized to ensure senstive data is available to those who need the data but maintains privacy
  • Account management. Need policies and procedures for authorizing, reviewing and removing user access
  • Security precautions  Need security training for teachers and staff and designated security  administrators
  •  Incident response planning.  need a formal breech response plan
  • Vendor contracts need data security provisions and contract monitoring of those provisions.

Christian County Headliner News | Auditor Galloway issues report on school data security risks

TREND. New Rules on Data Privacy. +1 Federal Agency with cybersecurity rules. 4 Points to be Informed.

The agency with new data protection rules: The FCC

The new FCC rules will require broad band and wireless providers to:

  • offer 3 tiers of privacy protections: opt-in, opt-out, and inferred
  • opt-in will be the standard for this information held by providers:
    • sensitive personal data
    • financial data
    • location
    • social security numbers
    • health or medical information
    • internet browsing or app history
    • message content
    • data belonging to minors.
  • opt-out standard for non-sensitive data like email addresses
  • providers also have to provide clear, conspicuous and persistent notice about information gathering

Think Progress | Internet users will have more control over their private information, thanks to new FCC rules

The State leading the Way in CyberSecurity Regulations for Financial Institutions:

New York.

The pinnacle of these regulation is New York Department of Financial Services rule, known as Cybersecurity Requirements for Financial Services Companies. 

The New York rules target financial services companies and their advisors. Lawyers call the NY rules “… a more comprehensive framework for cybersecurity than has been seen in any other U.S. jurisdiction.”

insurance news net | New York Jumps Ahead In Data Security Regs

Insurance. Data Security. Bill of Rights for Consumers.

To whom does the model insurance-cybersecurity law apply?  To anyone who holds a license, registration or is authorized by a state insurance agency

There’s a revision to the model law, what’s changed?

  • No preemption by the model law
  • No private causes of action. tort reformers rejoice. 
  • No contractual requirements for 3rd party vendors, but 3rd part vendors must be capable of protecting information
  • Stronger notification requirements that trigger notification within 3 days of learning that personal information has been taken, removing a requirement that the information be toed to “substantial harm or inconvenience”
  • Penalties have been removed and left to state regulators

National Law Review | Insurance Regulators Fine Tuning Cybersecurity Guidance

 

 

 

Your informed intel from August 25, 2016:

What entity is proposing model data security laws for insurance?  the Cybersecurity Task Force (Task Force) of the National Association of Insurance Commissioners (NAIC)

Is it final? No, its a revised draft after taking into account stakeholder positions

What issues are covered in the model act draft?

  • Require licensees to create a “comprehensive written information security program”
  • Required Data Security programs will detail the:
    • administrative,
    • technical, &
    • physical safeguards for the protection of personal information
  • Require licensees to contract only with 3rd service providers who are “capable of maintaining appropriate safeguards for personal information.”
  • Creates standards for investigations of a data breach, including:
    •  When a data breach occurs
    • That  the licensee must properly investigate the breach
    • Assessing the nature and scope of the breach
    • Identifying the personal information that may have been involved
    • Determining if the personal information had been acquired without authorization
    • Taking reasonable measures to restore the security of the systems compromised in the breach.

To comment: Email Sara Robben at srobben@naic.org by close of business on Friday, September 16, 2016.

Lexology | Mayer Brown | NAIC Issues Revised Insurance Data Security Model Law

 
 

The Top Lines. U.S. Chamber of Commerce on Cybersecurity.

The U.S. Chamber of Commerce penned a cybersecurity letter to President #45. The highlights:

  • Cybersecurity is the most urgent threat to our security
  • Keep the cybersecurity public-private partnership between business and government growing 
  • Too many overlapping regulations among all agencies. Harmonize regulations.
  • Foster information sharing ecosystem
  • Cybersecurity is international our laws and regulations should take that into consideration

U.S. Chamber| Dear 45: Let’s Make Strides Towards Better Cybersecurity

Colonial State. Attorney General. Gets into middle of College Data Breach. 3 Things to Watch Out for 3rd party vendors.

The state: Vermont.

The players in this drama: Vermont College, the Vermont Attorney General, and the 3rd party software company whose product was breached

Why did the Attorney General get involved?

  • the 3rd party vendor software affects more than just the Vermont College
  • the 3rd party vendor software will affect Vermont’s businesses
  • its an outreach opportunity to educate people about Vermont’s data breach notification law

Vermonth Biz | Attorney general enters data security settlement after college breach