Cyber Defense eMagazine December 2019

110
former governor, this bill also fights predators. The intentions of the Act are to provide residents with a
suite of rights, including the rights to:
• Know what personal data is being collected about them.
• Know whether their personal data is sold or disclosed and to whom.
• Refuse the sale of their personal data.
• Access their personal data.
• Request a business to delete any personal information collected on them.
• Sue companies which collected data that was later stolen or breached.
• Protection against discrimination for exercising such privacy rights.
Much like GDPR, the CCPA will impact businesses far beyond its immediate geographic borders. Any
company which serves California residents and has at least $25 million in annual revenue will need to
comply with the law. In addition, companies that have personal data on at least 50,000 people or that
collect more than half of their revenues from the sale of personal data will also be required to comply.
From an IT perspective, the CCPA will necessitate that security teams work closely with database
administrators. Tools for dealing with the issue will need to have full visibility into data stored across a
range of the internal corporate environment, while still ensuring that access to such data is properly
secured. If the data is stored on the cloud, the problem becomes even more complicated. But hey, your
companies will have a whole 30 days to figure that out before it can be fined for violations. And it’s only
up to $7,500 per record. So, if you meet the minimum threshold of 50,000 people that’ll only cost around…
375… million… dollars…
The 2020 Elections
Hoo boy, here’s a big one. Election fraud has been gaining an increasingly acute level of scrutiny,
especially following accusations of Russian meddling in 2016. While paper ballots have significant pros
over electronic ones, it seems that many electorates are all aboard the electric train, so we need to find
ways to prepare to roll with the punches. As Bruce Lee said, “Be water, my friend.”
In an act that is unprecedented in U.S. history, seven government agencies have issued a joint statement
warning that foreign powers intend to manipulate the 2020 elections. While your SecOps team might not
be responsible for protecting voting booths, if your organization is tasked with stewarding any appreciable
volume of personally identifiable information, you could still come under attack. Any sort of personal
information could be used by malicious actors to target groups or areas that may be crucial in the
upcoming election. While this threat may not imply some sort of qualitative break with the past, it means
that the threat level we can expect for the next year to be higher, putting an even greater level of pressure
and responsibility on cybersecurity teams.
SecOps teams should be on the lookout for DDOS attacks , phishing, and malware attacks against
infrastructure and networks that may be deemed critical to the elective process. While these are standard
threats that cyber analysts have been dealing with for years, their level of sophistication is increasing,
and the channels for attack are sure to multiple alongside the spread of 5G and IoT.