Electronic Data Security

On March 15, Fox Rothschild partner Scott Vernick will participate in a panel discussion on Developments in Data Privacy & Security as part of the 2017 Argyle Chief Legal Officer Leadership Forum. The Forum will take place from 8 a.m. to 5 p.m. at the Convene Conference Center at 730 3rd Ave in New York City.

Scott L. Vernick, Partner, Fox Rothschild LLPScott and his fellow panelists will discuss the evolution of the GC role to include cybersecurity and data privacy, how cybersecurity fits into an organization’s risk management structure, as well as proactive risk assessments GCs can use to identify and prioritize critical assets and data for their business. Attendees will also receive information on new regulatory challenges, how GCs can best collaborate with and advise other organization leaders on the topic of cybersecurity, and working with outside counsel on these and related issues. The panel discussion is scheduled from 10:10 a.m. to 11:00 a.m.

To register for the event, please visit the Argyle Forum event page.

For the second time in just four months, Yahoo has announced a massive cyberattack. The first attack, which occurred in 2014, set a record with the breach of 500 million user accounts. But the company now believes that twice as many accounts were compromised in a second data breach.

Search engine conceptAn internal investigation at the search engine company revealed a 2013 attack in which cyber criminals stole approximately 1 billion end user names, email addresses, telephone numbers, and dates of birth. Also stolen were hashed passwords as well as security questions and answers, some of which may have not been encrypted.

Yahoo did not explain why only some account recovery questions and answers were encrypted, but said it does not believe any financial data was stolen in the newly discovered earlier breach.

The news complicates Yahoo ongoing negotiations with Verizon for the $4.8 billion acquisition of Yahoo and could jeopardize the deal if Yahoo’s valuation decreases substantially.

The increasing frequency of data breaches underscores the need for privacy officers and legal counsel to be diligent. Plans should be in place to enable a quick response to unauthorized disclosures of data. Experts recommend collecting and storing only the minimum amount of data and limiting access to data only to those who need it to complete their job functions. An internal privacy policy is essential and keeping abreast of and adhering to industry best security practices can protect against and mitigate the consequences of a data breach.

In what may be the largest data breach ever publicly disclosed, Yahoo, disclosed that a 2014 cyberattack breached at least 500 million user accounts. The company said it believes state-sponsored actors were responsible and that the data stolen includes names, email addresses, telephone numbers, dates of birth, and hashed passwords.

Data privacy and securityThe data could also include security questions and answers, but Yahoo said that some accounts were encrypted. The company said its investigation did not reveal unhashed passwords or credit card or bank account information.

News of the breach comes soon after the $4.8 billion Verizon acquisition of Yahoo. Yahoo shares tumbled after the announcement but analysts said the Verizon deal is not likely to be affected by the news. With the disclosure, Yahoo joins a growing list of U.S. companies to suffer a serious data breach since 2013.

There are five fundamental truths that a company’s privacy officers and legal counsel must be aware of in order to protect consumer data:

Only Required Data Should Be Collected and Stored
Sweeping up and storing data beyond what is needed in order to provide a company’s services opens the door for cyber criminals to access and expose more consumer personal data. A company’s leadership must think very carefully about what personal data it is collecting and why it is collecting it from its consumers – collecting and storing unnecessary personal data exposes consumers and the company to additional risk that is avoidable.

Adhere to the Principle of Least Privilege
The Principle of Least Privilege is a restrictive computing practice that only allows a user to access the data necessary for its legitimate purpose. By only giving the least amount of access privileges to employees, a company can minimize the number of employees who will have access to consumer personal data, thus making the pool of employees who do have heightened access smaller and easier to manage.

Follow an Internal Privacy Policy
Having a privacy policy that establishes internal controls for who collects consumer personal data, how it is collected, where it is stored, and for how long it is stored is critical for protecting consumer personal data. The privacy policy should obligate every employee with access to consumer personal data to protect that data as well as obligating the company to provide annual training and updates to employees.

Plan for the Inevitable Breach
When, not if, a company is breached, it must stick to its breach plan to stay ahead of law enforcement, regulators, the media, and further disclosure of consumer personal data. The breach plan should be written alongside the company’s internal privacy policy – the documents go hand in hand and work together to help control a breach. Employees must know what their roles are during a breach, when they must act, and who they need to contact when they discover a breach. Not having a breach plan can lead to a reactive response, which makes investigating and containing the effects of the breach more difficult.

Industry Best Practices
Above all else, following industry best security practices is the best way to protect consumer personal data. Having a chief information security officer, legal staff and/or information technology director staying on top of trends, events and changes is the only way a company can minimize the potential of a data breach, but also to decrease the amount of data that is breached. Implementing and maintaining an updated and secure corporate network may be costly and scare executive management into inaction, but the cost of cleaning up a breach is far greater than finding money in the budget to hire security-minded staff and to harden the company’s systems.

It seems likely that the next decade will be difficult for IT professionals as breaches become increasingly common. Instead of fighting the trend, IT pros should embrace their fate and prepare for the inevitable breach.

 

The United States and Canada have teamed up to alert both nations of the threat of ransomware, illustrating the harmful impact of these cyberattacks to individuals and organizations all over the world.

The United States Computer Emergency Readiness Team (US-CERT) within the Department of Homeland Security (DHS) and the Canadian Cyber Incident Response Centre (CCIRC) jointly issued alerts in response to ransomware variants infecting computers in the healthcare industry in the United States, New Zealand and Germany. The alert gives useful information about ransomware, including its main characteristics, its prevalence worldwide, variants that may be developing, and how individuals and businesses can prevent and reduce the prevalence of ransomware.

Ransomware is a type of malware that contaminates a computer system and will restrict a user’s access to said system. Often, a message will appear stating that the files have been encrypted, and the message will demand payment from the victim – usually in the form of virtual currency such as Bitcoin – as a condition to access being restored.

Amounts vary, but typically, the attacker will request $200-400 dollars, according to the US-CERT alert.

Attacks have been rampant in recent weeks with many of them targeting hospitals, and the hackers’ demands haven’t been cheap. Last week, Maryland-based MedStar Health was victimized by what appeared to be a ransomware attack in which the hacker demanded $18,500 in Bitcoin.

Earlier this year, Hollywood Presbyterian Medical Center in California paid a $17,000 ransom in Bitcoin to a hacker after the hospital’s computer systems were seized in a ransomware attack.

These recent attacks were likely ransomware variants, which typically demand more lucrative sums and can damage the entire organization’s files, not just the particular user’s device.  Sometimes, the ransomware can utilize spam emails, but in other cases, ransomware can take advantage of vulnerable web servers.

Systems damaged by ransomware are often infected with other types of malware which attempts to steal other information; one malicious malware, GameOver Zeus, was used to steal banking information and other types of data, according to the US-CERT alert.

One of the biggest impacts of ransomware, as the alert points out, is the lack of any guarantee that the encrypted files will be released, nor does decryption guarantee removal of the malware infection itself. The only thing certain is that the hackers receive the victim’s money and, in some cases, the victim or organization’s banking information.

US-CERT actually discourages organizations from paying the ransom due to the lack of guarantees that files will be released.

The US-CERT alert provides several recommendations for preventative measures individuals and organizations can take, including the following;

  • Have a data backup and recovery plan which can be tested regularly for all critical information; backups should be kept on separate storage devices;
  • Allow only specified programs to run on computers and web servers to prevent unapproved programs from running (known as application whitelisting);
  • Make use of patches to keep software and operating systems current with the latest updates;
  • Maintain current anti-virus software and scan all downloaded software from the internet prior to executing;
  • The “Least Privilege” principle should prevail – restrict users’ access to unnecessary software, systems, applications, and networks through the usage of permissions;
  • Preclude enabling macros from email attachments. Enabling macros allows embedded code to execute malware on the device. Organizations should have blocking software to cut off email messages with suspicious attachments;
  • Do not click on unsolicited Web links in emails.

As usual, report hacking or fraud incidents to the FBI’s Internet Crime Complaint Center (IC3).

——–

Randall J. Collins is a law clerk in Fox Rothschild’s Philadelphia office.

In my previous post, I reviewed the New York State Department of Financial Services’ (NYDFS) findings and conclusions of survey results of financial institutions and insurers’ programs, costs, and future plans related to cybersecurity.

Anthony J. Albanese – Acting Superintendent of Financial Services – writes in a November 9, 2015 letter to Financial and Banking Information Infrastructure Committee (FBIIC) Members that these conclusions have demonstrated a need for new cybersecurity regulations for financial institutions.

Such “robust regulatory action” would be a coordinated effort between state and federal agencies to create a thorough cybersecurity framework addressing critical concerns as well as covering New York-specific interests.

Potential regulations implemented by the NYDFS would require covered financial entities to meet specific cybersecurity obligations in the following areas:

  • Cybersecurity policies and procedures;
  • Third-party service provider management;
  • Multi-factor authentication (i.e., requiring covered entities to apply such authentication to customer, internal, and privileged access to confidential information as well as any access to internal systems or data from an internal network);
  • Chief Information Security Officer (i.e., covered entities will be required to have a CISO responsible for overseeing and implementing a cybersecurity policy, among other duties);
  • Application security (i.e., covered entities must have and set forth written policies, procedures, and guidelines to ensure the security of all applications utilized by the entity which need to be updated annually by the CISO);
  • Cybersecurity personnel and intelligence (i.e., covered entities will need to hire cybersecurity personnel who can handle certain cyber risks and perform core functions of “identify, protect, detect, respond and recover,” as well as providing mandatory training to such personnel);
  • An audit function; and
  • Notice of cybersecurity incidents.

Some of these proposed requirements are set forth in more detail below.

 

Cybersecurity Policies and Procedures

Covered entities, Albanese writes, would need to implement and maintain written cybersecurity policies and procedures addressing the following areas:

(1) information security;

(2) data governance and classification;

(3) access controls and identity management;

(4) business continuity and disaster recovery planning and resources;

(5) capacity and performance planning;

(6) systems operations and availability concerns;

(7) systems and network security;

(8) systems and application development and quality assurance;

(9) physical security and environmental controls;

(10) customer data privacy;

(11) vendor and third-party service provider management; and

(12) incident response, including by setting clearly defined roles and decision making authority.

 

Third-party Service Provider Management

Albanese wants covered entities to ensure that third-party cybersecurity policies and procedures are implemented. Third-party service providers who hold or have access to sensitive data or systems will need to adhere to certain contractual terms, including the following provisions:

(1) the use of multi-factor authentication to limit access to sensitive data and systems;

(2) the use of encryption to protect sensitive data in transit and at rest;

(3) notice to be provided in the event of a cyber security incident;

(4) the indemnification of the entity in the event of a cyber security incident that results in loss;

(5) the ability of the entity or its agents to perform cyber security audits of the third party vendor; and

(6) representations and warranties by the third party vendors concerning information security.

 

Audits

Annual penetration testing as well as quarterly vulnerability assessments will be a new requirement for covered entities. Such entities will also be responsible for maintenance of an audit trail system that perform the following functions:

(1) logs privileged user access to critical systems;

(2) protects log data stored as part of the audit trail from alteration or tampering;

(3) protects the integrity of hardware from alteration or tampering; and

(4) logs system events, including access and alterations made to audit trail systems.

 

Notice of Cybersecurity Incidents

Covered entities, Albanese writes, will need to immediately notify the NYDFS of any cyber security incident that is reasonably likely to materially affect such entity’s normal operation, including a cybersecurity incident

(1) that triggers certain other notice provisions under New York Law;

(2) of which the entity’s board is notified; or

(3) that involves the compromise of “nonpublic personal health information” and “private information” as defined under New York Law, payment card information or any biometric data.

 

These potential requirements are subject to further review and revision by the NYDFS, and there is no timetable for when these requirements will become the law of the land in New York. It will be interesting to see if and when covered entities begin implementing these requirements in advance of a legal obligation to do so. Will other states’ regulatory agencies enact similar regulations modeled on the NYDFS proposals? Look for developments on this topic in the news and on this website.

——–

Randall J. Collins is a law clerk in Fox Rothschild’s Philadelphia office.

In reaction to two surveys of more than 150 regulated banking organizations and 43 regulated insurers in New York, the state’s Acting Superintendent of Financial Services issued a letter to all Financial and Banking Information Infrastructure Committee (FBIIC) Members addressing the need for potential new cybersecurity regulations in the financial sector.

The New York State Department of Financial Services (NYDFS) expects that the November 9, 2015 letter will trigger more “dialogue, collaboration and, ultimately, regulatory convergence” among New York agencies on “strong” cybersecurity norms for financial institutions.

In the letter, Anthony J. Albanese – Acting Superintendent of Financial Services – discusses the NYDFS’ review of the two surveys which were conducted in 2013 and 2014. The surveys asked about the banks’ and insurers’ programs, costs, and future plans pertaining to cybersecurity. Albanese writes that the findings of those surveys led to some additional actions:

  • The NYDFS expanded its information technology examination procedures to focus more attention on cybersecurity;
  • NYDFS began conducting risk assessments of its financial institutions in late 2014 and early 2014 to compile information about risks and vulnerabilities;
  • In response to a realization of the financial industry’s reliance on third-party service providers for banking and insurance functions, the NYDFS conducted an additional survey of regulated banks in October 2014, specifically pertaining to banks’ management of third-party service providers; and
  • NYDFS published an April 2015 update to its earlier report with the most critical observations.

Those reports and risk assessments as well as the “dozens of discussions” the NYDFS has held with New York financial entities, cybersecurity experts, and other stakeholders have led to several “broad conclusions,” Albanese writes:

  • Financial institutions need to stay “dynamic” to keep pace with ever-changing technological advances and sophisticated cyberthreats;
  • Financial institutions’ third-party service providers must also have sufficient cybersecurity protections as these service providers often have access to an institution’s sensitive data and information technology systems; and
  • Cybersecurity is a “global concern” that affects every industry as evidenced by recent data breaches.

My next post will analyze the proposed regulatory actions and requirements NYDFS is considering for financial institutions and insurers.

——–

Randall J. Collins is a law clerk in Fox Rothschild’s Philadelphia office.

Fox Partner and Chair of the Privacy and Data Security Practice Scott L. Vernick was a guest on Fox Business’ “The O’Reilly Factor” and “After the Bell” on February 17, 2016, to discuss the controversy between Apple and the FBI over device encryption.

A federal court recently ordered Apple to write new software to unlock the iPhone used by one of the shooters in the San Bernardino attacks in December. Apple CEO Tim Cook has vowed to fight the court order.

The Federal Government vs. Apple (The O’Reilly Factor, 02/17/16)

Apple’s Privacy Battle With the Federal Government (After the Bell, 02/17/16)

 

 

 

U.S. Capitol Building, Washington, D.C.A recent bill proposed by the U.S. Senate states requirements for publicly traded companies to increase transparency about cybersecurity threats, risks and breaches. The bill includes disclosure standards such as having publicly owned companies reveal whether anyone on its board of directors has cybersecurity expertise or specialization. Companies would provide this information through U.S. Securities and Exchange Commission investor reports.

The bill stems from an urgency to combat cyber threats in light of investigative findings from cybersecurity practices of top 100 financial firms as well as recent attacks on major publicly traded companies like Sony and Home Depot. If the bill passes, investors and shareholders can monitor how well public companies secure private data and information, motivating companies to enhance security measures.

The September 2015 data breach at Experian exposed the personal information of nearly 15 million wireless carrier customers, and we are just now learning the cost.

Data privacy and securityA recent earnings report revealed the company has expended $20 million in its response to the breach, which exposed information including names, addresses, birthdates, social security numbers, driver’s license numbers, and passport numbers.

The data is used by Experian in the credit-check process and as part of its customer registration. The breach expenses stemmed from notification and credit monitoring for the affected individuals and is likely just the beginning of the company’s deepening woes. Several class action lawsuits were filed and there are government probes that Experian must cooperate with.

So far in 2015, security lapses have affected tens of millions of individuals. As in other high-profile breaches, Experian may ultimately find itself liable for tens of millions of dollars – even after insurance payouts – due to the part it played in leaking personally identifiable information to unauthorized third parties.

The sheer enormity of breach-related damages must also be consider in conjunction with the loss of both shareholder and customer confidence. These combined consequences underscore the need for companies to be exceedingly vigilant and proactive in matters of information security.

Businesses that relied previously on the EU’s Safe Harbor exception to transfer data from Israel to the United States have had that authorization revoked by the Israeli Law, Information and Technology Authority (ILITA).

It’s part of the ongoing ripple effect caused by the invalidation of Safe Harbor.

Now that Safe Harbor is off the table, businesses must rely on standard contractual clauses, binding corporate rules or other legal strategies, to transfer data out of the EU, and now Israel.

Israel is not an official member of the so-called “Euro Data Zone,” but it was granted an exception in 2011 under the EU Data Protection Directive, allowing data to be transferred out of the EU to Israel without requiring companies to use standard contractual clauses or binding corporate rules.

Israel’s 2001 Privacy Protection Regulations permitted moving data from Israel to a database outside the country if the transferee country had laws regulating data protection that were at least as strict as Israeli law. It included an exception for companies located in countries with inadequate legal protections by allowing data transfers to nations to which the EU allows data transfers.

In effect, that allowed Safe Harbor compliant U.S.-based companies to transfer data out of Israel.