Cybersecurity Archives - Page 25 of 30

DOJ Settlement with Netcracker Technology Corporation Highlights Cybersecurity and Export Control Best Practices for Government Contractors and Information Technology Companies

This week the U.S. Department of Justice (DOJ) and Netcracker Technology Corporation (NTC) announced that they had settled charges that NTC had violated U.S. controls on foreign access to sensitive data. The settlement underscores many of the export control and related compliance risks surrounding the provision and use of cloud computing services and global networks. At the same time, the Enhanced Security Plan issued by NTC and DOJ as part of the settlement provides a helpful set of benchmarks and best practices for companies that may be considering the use of cloud services and network infrastructure to house and transmit their most sensitive data.

According to DOJ’s settlement announcement, NTC had worked as a subcontractor on two federal government contracts with the Defense Information Systems Agency (DISA), a combat support agency of the U.S. Department of Defense (DoD), and performed some product support work from locations outside the United States, including Russia. DOJ alleged that by failing to maintain adequate controls on the cloud and network infrastructure supporting these contracts, NTC had threatened the security of sensitive data about individuals, DoD projects, networks and critical U.S. domestic communications infrastructure. DOJ further asserted that uncleared NTC foreign national employees in Russia and Ukraine worked on the DISA projects and were aware of the sensitive nature of the projects and the data stored and transmitted through the network managed by DISA.

Continue reading “DOJ Settlement with Netcracker Technology Corporation Highlights Cybersecurity and Export Control Best Practices for Government Contractors and Information Technology Companies”

NAIC Adopts Insurance Data Security Model Law

The National Association of Insurance Commissioners (NAIC) adopted the Insurance Data Security Model Law (“Model Law”) in October 2017. The purpose of the Model Law is to establish standards for data security and the investigation of and notification to the Insurance Commissioner of a Cybersecurity Event[1], but is not intended to create a private right of action.

The Model Law is based largely on the New York Department of Financial Services’ Cybersecurity Regulations, 23 NYCRR 500 (“NYDFS Cyber Regulations”), which took effect on March 1, 2017. [2] In fact, a drafting note to the Model Law indicates that compliance with the NYDFS Cyber Regulations is intended to constitute compliance with the Model Law.

Continue reading “NAIC Adopts Insurance Data Security Model Law”

Another State-Lead Data Breach Action Results in High Fines and Strict Compliance Requirements

Massachusetts Attorney General Maura Healey and Multi-State Billing Services (MSB), a Medicaid billing company that provided processing services for 13 public schools, signed a no-fault consent judgment settling a 2014 data breach resulting from a stolen laptop that put 2,618 children at risk for identity theft and fraud. The MSB laptop contained unencrypted personal information, including names, social security numbers, Medicaid identification numbers and birth dates.

The settlement requires MSB to pay $100,000 and implement improved security practices after an investigation by the attorney general’s office determined it violated state consumer protection and data security laws. More specifically, the judgment requires MSB to continue to develop, implement and maintain a written and comprehensive information security program and review and update its existing policies and procedures for compliance with data security laws. It must also train its staff on how to protect personal information and regularly report on its compliance with such requirements to the state attorney general’s office.

Continue reading “Another State-Lead Data Breach Action Results in High Fines and Strict Compliance Requirements”

Investigation Continues After Massive Data Breach at Henry Ford Health System

An unknown hacker gained access to 18,470 patients’ personal health information via employee emails at Detroit-based Henry Ford Health System (HFHS).

According to the press release, HFHS first learned of the incident on October 3, 2017, after becoming aware that the email credentials of a group of employees were compromised. Even though the emails were name and password protected by encryption, they remained vulnerable to such illegal access. The email accounts contained patient health information, including:

Patient name
Date of birth
Medical record number
Provider’s name
Date of service
Department’s name
Location
Medical condition
Health insurer

Continue reading “Investigation Continues After Massive Data Breach at Henry Ford Health System”

The SEC’s Cyber Specialty Unit Strikes With Its First Case

On December 4, 2017, the SEC Enforcement Division’s new Cyber Unit filed its first enforcement case for a fraudulent initial coin offering (ICO). This new specialty unit was established in late September to increase the Enforcement Division’s focus on cyber-related securities law violations. The focus areas of this unit include securities laws violations involving “blockchain” technologies and ICOs.
Continue reading “The SEC’s Cyber Specialty Unit Strikes With Its First Case”

Agenda and Panelists Announced for FTC’s Information Injury Workshop in December

The Federal Trade Commission released the agenda and panelists for the Information Injury Workshop which will be held on December 12.

As we covered in a previous DBR on Data post, the goal of the workshop is to explore how to characterize information injuries, how to accurately measure such injuries, and their prevalence. In addition, panelists will discuss what factors businesses and consumers consider when evaluating the tradeoffs between providing information and potential exposure to injuries.

The panelists come from a variety of fields and disciplines, including information technology, privacy and data security, business, academia, legal and nonprofit fields.

The full agenda and list of panelists is available at this link. The workshop is free and open to the public and will also be available via live webcast through the FTC’s website.

DISCERNING DATA

A Faegre Drinker Blog Covering the Latest in Privacy, Cybersecurity and Data Strategy

Category: Cybersecurity