1E9Ct5D

stored) format in many states may limit or eliminate breach notification requirements.3. Multi-Layered Authentication Offers Another Barrier.Adding another barrier to data access adds an additional layer of protection. Outlook,Gmail, and Twitter now offer a double-layered sign-in process. Many companies andfirms similarly offer: (1) the entry of standard log-in credentials followed by (2) entry of atoken code/secure ID code. Outside of the email context, companies should also haveprotocols for authenticating phone calls. For example, if an executive calls the helpdesk to retrieve his forgotten log-in information, the help desk needs to authenticate therequest before providing access to company databases.4. Update, Complicate, and Do Not Duplicate Credentials.A company should require employees and vendors (including outside counsel) toroutinely change passwords. A 90-180 day timeline for systems to automatically promptusers to change passwords is becoming more commonplace. A best practice would bea 90 day password change cycle. Likewise, accounts for temporary employees orvendors can be set up to automatically shut off when work is complete.Complexity of passwords is also critical. Common words or sequences like 123456 areweak passwords. Passwords should be at least 8 characters long, containingupper/lower case letter combinations, numbers, and symbols. Passwords should not beduplicated or saved (if it is easier for you, it is easier for the bad guys).5. Making Public Wi-Fi More Secure: Virtual Private Networks.To help protect against Dark Hotel malware (discussed above at Section III(B)(iii)(1)),March 6, 2015 16 © 3-6-2015 ALFA International Business Litigation P.G.