{"id":281,"date":"2015-09-24T20:11:00","date_gmt":"2015-09-24T20:11:00","guid":{"rendered":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/2015\/09\/24\/regulatory-trend-agency-fines-for-failing-policies-before-data-breach\/"},"modified":"2015-09-24T20:11:00","modified_gmt":"2015-09-24T20:11:00","slug":"regulatory-trend-agency-fines-for-failing-policies-before-data-breach","status":"publish","type":"post","link":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/regulatory-trend-agency-fines-for-failing-policies-before-data-breach\/","title":{"rendered":"Regulatory Trend: Agency Fines for Failing Policies before Data Breach"},"content":{"rendered":"<p><strong>Which agency is issuing fines for lacking\u00a0data security policies?<\/strong>\u00a0The Securities and Exchange Commission.\u00a0<\/p>\n<p><strong>Why is the SEC fining a company?<\/strong>\u00a0Two reasons:<\/p>\n<ol>\n<li>It failied to have an adequate daa security policy in place before it experienced a data breach that exposed financial records of 100,000.\n<ol>\n<li>Let&#8217;s repeat, the company<strong> never adopted <\/strong>written policies and procedures<\/li>\n<li>The company did not conduct periodic risk assessments<\/li>\n<li>The company did not implement a firewall<\/li>\n<li>The company did not encrypt its personally-identifiable information<\/li>\n<li>The company did not\u00a0maintain a response plan for any incidents either.\u00a0<\/li>\n<\/ol>\n<\/li>\n<li>The financial information was stored on a\u00a0third party-hosted web server.<\/li>\n<\/ol>\n<p><strong>What was the data breach that triggered the $75,000 fine?<\/strong>\u00a0In\u00a0July 2013, the 3rd party web server was breached by an unknown hacker from China after which the financial company\u00a0contacted all parties offering free identity theft monitoring<\/p>\n<p><a href=\"http:\/\/www.investmentnews.com\/article\/20150922\/FREE\/150929966\/sec-nails-advisory-firm-for-cybersecurity-failure-before-data-breach\">Investment News:\u00a0SEC nails advisory firm for cybersecurity failure before data breach<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Which agency is issuing fines for lacking\u00a0data security policies?<\/strong>\u00a0The Securities and Exchange Commission.\u00a0<\/p>\n<p><strong>Why is the SEC fining a company?<\/strong>\u00a0Two reasons:<\/p>\n<ol>\n<li>It failied to have an adequate daa security policy in place before it experienced a data breach that exposed financial records of 100,000.\n<ol>\n<li>Let&#8217;s repeat, the company<strong> never adopted <\/strong>written policies and procedures<\/li>\n<li>The company did not conduct periodic risk assessments<\/li>\n<li>The company did not implement a firewall<\/li>\n<li>The company did not&#8230;<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10,18],"tags":[],"class_list":["post-281","post","type-post","status-publish","format-standard","hentry","category-banking","category-regulatory-enforcement","entry"],"_links":{"self":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts\/281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/comments?post=281"}],"version-history":[{"count":0,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts\/281\/revisions"}],"wp:attachment":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/media?parent=281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/categories?post=281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/tags?post=281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}