Cyber Defense eMagazine May 2019

More documents

Recommendations

Info

‘assume breach’ has become the dominant defensive strategy. While this may reflect the modern reality, our national defensive posture will never improve if we aspire to such a low bar. Understanding the necessity for thoughtful regulation to help shift incentives to encourage greater defenses and data protection, and absent a federal law, individual states have proposed or passed their own data privacy and security legislation. At a recent Senate hearing on a federal data privacy framework, the discussion highlighted the growing patchwork of regulations in the United States, including over 90 data protection and privacy proposals currently at state capitols. Similarly, last year Alabama and South Dakota became the final two states to enact data breach notification laws. There are now over 50 different data breach notification laws in the United States, with Puerto Rico, the U.S. Virgin Islands, Guam, and Washington, DC also passing their own laws. Each of these data breach notification laws has different requirements and penalties, and may be contradictory from state to state. The most prominent piece of state privacy legislation is the California Consumer Privacy Act (CCPA), which will take effect in 2020. The CCPA focuses on unauthorized data access and intentionally targets both cyber attacks and third-party data disclosure violations. Individuals can hold organizations accountable for failing to protect their data, while organizations are required to implement “reasonable security measures” to protect their data. Accountability is core to any data protection framework as it provides the necessary incentives to drive organizational change in favor of security. Despite the range of cyber attacks and third-party data sharing, accountability has largely been absent in the United States. Vermont has taken a different approach and passed a law focused on the data brokers themselves. As we saw with Equifax and the Office of Personnel Management breaches, organizations with significant amounts of personal data are ideal targets but may not prioritize implementing best security practices. Data brokers have largely remained off the radar but manage significant amounts of data. Vermont’s data broker law requires data brokers to take appropriate security measures and penalizes them for failing to do, while also prohibiting the use of the data for criminal purposes. This is the first such law in the United States that holds significant data aggregators and sellers accountable for data security. Legislation introduced in Massachusetts, Washington, Colorado and Washington, DC further reflects the current movement toward greater privacy and security in the absence of a federal framework. Largely driven by the ongoing data breaches as well as unauthorized data sharing, these laws explicitly aim to incentivize greater data protection as well as transform data sharing and storing practices, while also looking ahead to the future data challenges with biometrics, surveillance, and facial recognition. Left unprotected, these too will be a gold mine for bad actors. Given the steady pace of security and privacy hearings on the Hill coupled with new state-level privacy laws, as well as foreign laws such as the European Union’s General Data Protection Regulation, the likelihood for U.S. federal privacy regulation continues to grow. Until then, states are setting the bar and forcing the federal government to evaluate what core components should be included at a federal level. 58
This federal push will not be a silver bullet and requires thoughtful and deliberate input from the security community. If it includes accountability and enhanced security measures as core components, federal data privacy regulations may finally provide the impetus for organizations to prioritize security and limit the hemorrhaging of data that is the current status quo. About the Author Dr. Andrea Little Limbago is the Chief Social Scientist of Virtru, a data protection and privacy software company. She specializes in the intersection of technology, information security, and national security, and specifically focuses on the geopolitics of cybersecurity, global data protection and privacy trends, and usable security. Andrea is also the Program Director for the Emerging Technologies Program at the National Security Institute at George Mason. She previously was the Chief Social Scientist at Endgame, a cybersecurity software company. Prior to that, Andrea taught in academia and was a technical lead in the Department of <strong>Defense</strong>. Andrea earned a PhD in Political Science from the University of Colorado at Boulder. Andrea can be reached online on Twitter @limbagoa and at https://www.virtru.com/ . 59
Page 1 and 2:
5 Reasons Why Cloud Security is Imp
Page 3 and 4:
Data Sniffing is Threatening Your P
Page 5 and 6:
CEO, Cyber Defense Media Group Publ
Page 7 and 8: 7
Page 9 and 10: 9
Page 11 and 12: 11
Page 13 and 14: 13
Page 15 and 16: Your website could be vulnerable to
Page 17 and 18: 17
Page 19 and 20: Cloud computing helps organizations
Page 21 and 22: the day, if the customer data store
Page 23 and 24: 8 Cybersecurity Practices In Health
Page 25 and 26: V. Amplified M&A activities in the
Page 27 and 28: 7. Maintain Compliance with HIPAA T
Page 29 and 30: Whether it’s malicious outsiders
Page 31 and 32: About the Authors Cody Cornell is t
Page 33 and 34: altered. And with the decentralized
Page 35 and 36: Simplifying Cybersecurity Deploymen
Page 37 and 38: If you do not want Alert Logic auto
Page 39 and 40: Backups like The Last Resort The im
Page 41 and 42: About the Author Pedro Tavares is a
Page 43 and 44: Legacy Infrastructure Legacy infras
Page 45 and 46: Enterprise Insider Threats on The R
Page 47 and 48: Your Security Teams are Destroying
Page 49 and 50: Using Behavior to Detect Complete A
Page 51 and 52: Ivanti Priorities this month:
Page 53 and 54: Phishing Awareness - The More They
Page 55 and 56: ecognized leader for security aware
Page 57: On Security and Privacy, States Are
Page 61 and 62: miniature bridges - an email can cr
Page 63 and 64: Network Traffic Analysis (NTA) By T
Page 65 and 66: Traffic Analysis Engine These are t
Page 67 and 68: The Internet of Things Signal Trans
Page 69 and 70: oth - convenience and security of t
Page 71 and 72: 4. Cloud and Speed: Companies that
Page 73 and 74: Two Steps on - One Step Back By Mil
Page 75 and 76: Always Take Care about Your Trainin
Page 77 and 78: CTI in some way, which is an increa
Page 79 and 80: would show that it’s so hard to a
Page 81 and 82: It’s All About The Logs Looking i
Page 83 and 84: A well designed and properly implem
Page 85 and 86: Salaries have significantly grown i
Page 87 and 88: Let’s take a look into a kid’s
Page 89 and 90: What happened then? This destroys a
Page 91 and 92: Opt Parental Controls for all your
Page 93 and 94: “Standards-based cybersecurity ri
Page 95 and 96: the de facto security standard simi
Page 97 and 98: About the Authors Dan Jetton is the
Page 99 and 100: According to KPMG’s Global Sector
Page 101 and 102: Data Sniffing is Threatening Your P
Page 103 and 104: About the Author William J. Tomlins
Page 105 and 106: if the line meets the acceptable le
Page 107 and 108: Is Your Encryption Flexible Enough?
Page 109 and 110:
to other chat apps is geometric, an
Page 111 and 112:
The Critical Role TAPs Play in Netw
Page 113 and 114:
About the Author Alastair Hartrup i
Page 115 and 116:
Thanks to these attacks, the demand
Page 117 and 118:
Why CIOs/CISO’s Positions Are Bec
Page 119 and 120:
slowly to how they would normally.
Page 121 and 122:
Over time, as operators compile mul
Page 123 and 124:
QIDs from associated metadata, the
Page 125 and 126:
125
Page 127 and 128:
127
Page 129 and 130:
129
Page 131 and 132:
131
Page 133 and 134:
133
Page 135 and 136:
135
Page 137 and 138:
137
Page 139 and 140:
139
Page 141 and 142:
141
Page 143 and 144:
143
Page 145 and 146:
145
Page 147 and 148:
147
Page 149 and 150:
149
Page 151 and 152:
You asked, and it’s finally here
Page 153 and 154:
Marketing and Partnership Opportuni
Page 155 and 156:
Regent University’s Institute for
Page 157 and 158:
157
Page 159 and 160:
159
show all

Cyber Defense eMagazine May 2019

Create successful ePaper yourself

Delete template?

Save as template?