Mueller indictments of Russian cyber criminals put election hacking at top of mind

State officials expressed grave concerns about election hacking the day after Special Counsel Robert Mueller handed down indictments of 13 Russian nationals on charges of interfering with the 2016 presidential election. The Washington Post reports:

At a conference of state secretaries of state in Washington, several officials said the government was slow to share information about specific threats faced by states during the 2016 election. According to the Department of Homeland Security, Russian government hackers tried to gain access to voter registration files or public election sites in 21 states.

Although the hackers are not believed to have manipulated or removed data from state systems, experts worry that the attackers might be more successful this year. And state officials say reticence on the part of Homeland Security to share sensitive information about the incidents could hamper efforts to prepare for the midterms.

Granted, the Mueller indictments allege disinformation and propaganda-spreading using social media, not direct election hacking. However, taken together with the attacks on state elections systems, it is now indisputable that Russian cyber criminals used a highly sophisticated, multi-pronged approach to tamper with the 2016 election. While there have been no reported attacks on state systems since, there is no reason to believe that election hacking attempts by Russians or other foreign threat actors will simply cease; if anything, cyber criminals are likely to step up their game during the critical 2018 midterms this November.

These aren’t new issues; cyber security was a top issue leading up to the 2016 election. Everyone agreed then, and everyone continues to agree now, that more needs to be done to prevent election hacking. So, what’s the holdup?

One of the biggest issues in tackling election hacking is the sheer logistics of U.S. elections. The United States doesn’t have one large national “election system”; it has a patchwork of thousands of mini election systems overseen by individual states and local authorities. Some states have hundreds, even thousands of local election agencies; The Washington Post reports that Wisconsin alone has 1,800. To its credit, Wisconsin has encrypted its database and would like to implement multi-factor authentication. However, this would require election employees to have a second device, such as a cell phone, to log in – and not all of them have work-issued phones or even high-speed internet access.

Not surprisingly, funding is also a stumbling block. Even prior to the 2016 elections, cyber security experts were imploring states to ensure that all of their polling places were using either paper ballots with optical scanners or electronic machines capable of producing paper audit trails. However, as we head toward the midterms, five states are still using electronic machines that do not produce audit trails, and another nine have at least some precincts that still lack paper ballots or audit trails. The problem isn’t that these states don’t want to replace their antiquated systems or hire cyber security experts to help them; they simply don’t have the budget to do so.

Congress Must Act to Prevent Election Hacking

Several bills that would appropriate more money for states to secure their systems against election hacking are pending before Congress, including the Secure Elections Act. Congress can also release funding that was authorized by the 2002 Help America Vote Act, but never appropriated.

The integrity of our elections is the cornerstone of our nation’s democracy. Proactive cyber security measures can prevent election hacking, but states cannot be expected to go it alone; cyber attacks do not respect borders.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

New data breach notification regulations aren’t a matter of if, but when

The U.S. Securities and Exchange Commission plans to update its six-year-old guidelines regarding data breach notification and cyber risk disclosure, Bank Info Security reports:

The agency has indicated that it expects to refine guidance around how businesses disclose cybersecurity risks to investors as well as require insider trading programs to include blackout rules in the event that a suspected data breach gets discovered.

“Unfortunately, in the reality that we live in now, cyber breaches are going to be increasingly common, and this is in part why the SEC, NFA is so fully focused on cybersecurity,” says Matt Rossi, a former assistant chief litigation counsel to the SEC, NFA who’s now an attorney specializing in securities litigation and enforcement as well as data privacy at global law firm Mayer Brown. “Chairman [Jay] Clayton said it’s one of the greatest risks to the financial system right now.”

There is great irony in the SEC’s announcement. Less than two weeks after the Equifax breach came to light last fall, the agency disclosed that its EDGAR database, which is used to disseminate company news and data to investors, had been hacked – over a year prior.

Be that as it may, data privacy is at top of mind for consumers. The General Data Protection Regulation (GDPR) is about to become law in the European Union, and 2017 saw numerous high-profile incidents where breached organizations sat on their hands for extended periods of time before notifying potential victims.

Equifax Breach Incites Outrage from Congress, But No Action

The SEC’s guidelines are just that – guidelines, not legislation – and they apply only to publicly traded firms. While 48 states have data privacy laws on the books, and companies in certain industries are subject to industry-specific regulations or standards, such as HIPAA and PCI DSS, there is no federal data privacy or data breach notification law that applies across industries.

For the past several years, the U.S. government has been under increasing pressure to establish federal data breach notification regulations and address other data privacy issues. This pressure intensified after the Equifax breach was disclosed, and many privacy advocates hoped the incident would finally push Congress to act. Unfortunately, lawmakers’ initial public outrage over the Equifax breach quickly died down, and Congress’ focus shifted back to healthcare and tax reform.

Frustrated with the lack of progress in Washington, states have begun taking matters into their own hands. Last year, New York State passed a sweeping cyber security law that was heavily steeped in data governance and integrated risk management. Effective January 1, 2018, Maryland’s data breach notification law was amended to not only require companies to notify victims within 45 days of a data breach but also expand the definition of “personal information.”

Could We Ultimately See an “American GDPR”?

However, the lack of progress on a federal level doesn’t mean U.S. companies should assume that we will never see an “American version” of the GDPR on a federal level. The New York Times recently reported on businesses that do not accept cash as a form of payment. While these are isolated incidents, they are a sign of the rapid digitization of our society. Consumers are seeing more and more of their personal information being preserved for posterity in digital files kept by a dizzying array of government entities and private-sector organizations, with almost no control over where it goes or what happens to it. Even minors’ information is stored digitally, and children can easily become victims of identity theft.

Businesses, meanwhile, are struggling to stay abreast of an ever-changing compliance landscape complicated by the fact that while states have borders, ecommerce does not. This forces businesses that sell in multiple states to reconcile a confusing patchwork of regulations, some of which contradict each other. Depending on individual states to regulate data breach notification and data privacy is rapidly becoming untenable, and the federal government will eventually be forced to step in, as it did with HIPAA in the 1990s.

In the meantime, the best option for businesses is to adopt a data-centric, integrated risk management approach to ensure they have control of their data and are able to quickly adapt to changing regulations.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

The General Data Protection Regulation and GDPR Compliance Explained

The deadline for GDPR compliance is right around the corner; is your company ready? Here’s what you need to know about this important new data protection law and what your organization must do to prepare for it.

What is GDPR?

The General Data Protection Regulation, or GDPR, was adopted by the European Parliament in April 2016 as a replacement for an outdated data privacy directive that passed in the 1990s. The goal of the GDPR is to protect the personal data of EU citizens in the digital age. EU citizens will have numerous data privacy rights under the GDPR, including the right to prompt notification of a breach, the right to access their personal data, and the “right to be forgotten.”

What Constitutes “Personal Data” Under the GDPR?

Under the GDPR, “personal data” is a broad term encompassing “[a]ny information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person.” This covers everything from an individual’s name and street address to their physical address to their health or biometric information. Even social media posts are considered “personal data.”

Who Must Comply With GDPR?

Although the GDPR is technically a European regulation, in reality, it applies internationally. In addition to applying to all companies with a presence in the EU, any company that sells goods and services to individuals or companies located in the EU or that “monitor[s] the behaviour of EU data subjects” must comply with the GDPR, regardless of where the company is located.

This means that GDPR compliance applies to nearly all large businesses, as well as many small and medium-sized businesses; if you have even one customer located in the EU, you must comply.

When is the GDPR Compliance Deadline?

Organizations must comply with the GDPR by May 25, 2018.

How Will Brexit Impact GDPR Compliance? What If I Only Sell to UK Customers?

Companies that are located in the UK or that sell to UK customers should still prepare to comply with GDPR. The UK is not scheduled to leave the EU until March 29, 2019, 10 months after the GDPR compliance deadline. Further, the British government has stated that it intends to pass its own data protection bill that will be at least as stringent as the GDPR, if not more so.

What Constitutes GDPR Compliance?

At its core, the GDPR is about data governance. Organizations will need to change the way in which they process, store, and protect customers’ personal data, keeping in mind the various data privacy rights outlined in the GDPR. Similar to HIPAA, the GDPR does not outline specific technical controls but instead tells organizations what they need to achieve; it’s up to them to figure out how.

One of the biggest changes is the GDPR breach notification requirement; companies must notify the authorities and affected customers within 72 hours of detecting a breach. This requirement is meant to prevent scenarios like the Uber hack, where the company not only waited a year to notify its customers but actually tried to cover the incident up.

The GDPR also addresses the growing problem with third-party vendor breaches. Organizations that hire third-party vendors who will be handling the personal data of their EU customers will have to ensure that their contracts with those vendors comply with the GDPR.

Additionally, some organizations will have to appoint a Data Protection Officer (DPO) to oversee GDPR compliance and overall data security. This requirement applies to organizations that are public authorities, “engage in large scale systematic monitoring,” or “engage in large scale processing of sensitive personal data.”

What Are the Penalties for Non-Compliance?

Depending on the severity of the infraction, organizations can be fined up to 4% of their annual global turnover, or 20 million euros (approximately USD $24 million).

How Can I Get Ready for GDPR Compliance?

The best way to prepare for the GDPR is to enlist help from an experienced IT audit and compliance firm like the GRC experts at Lazarus Alliance. The full text of the GDPR is 88 pages long, and what “compliance” means for your organization depends on your individual data environment, cyber ecosystem, risks, and vulnerabilities. For example, the GDPR specifies that companies must provide “reasonable” levels of data privacy and protection to EU customers, but what is considered “reasonable” is left open for debate – and you don’t want to end up on the losing side of that one!

While many organizations are dreading GDPR compliance, in the end, it will be a net positive for everyone. The GDPR will force companies to closely examine their data governance policies and controls and enact proactive cyber security measures to prevent breaches.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.