# data[].attributes.body
This is an article about the Exactis Breach which exposed millions of records, in the US this year. Although most of the information is personal in nature and it has not been found to be used in any major attacks yet. It is information that can be used to create phishing scams or other social engineering attacks that could compromise security on many levels and cost individuals immeasurable amounts of money in identity theft resolutions in the future.

-These types of breaches might be what eventually pushes the US to adopt stricter privacy laws in the near future, or at least we can hope.

# data[].attributes.attachment_link.readable_text
An exposed database at data broker Exactis exposed nearly 340 million records amounting to around two terabytes of information.

"If U.S. citizens did not think their personal information has ever been compromised, this should convince them it definitely is," said Robert Capps, vice president and authentication strategist for NuData Security, noting the Exactis "breach blows up the 2018 tab with 230 million [consumer] records exposed in just one incident."

The exposed database, which contains details on Americans and businesses, was discovered by security researcher and Night Lion Security Founder Vinny Troia, who told Wired that it had "pretty much every U.S. citizen in it."

While payment information and Social Security numbers aren't included in the trove, Troia found personal information on individuals' interests and their children.

"What's most shocking about the leak is how Exactis, which prides itself in having one of the world's largest universal data warehouses, has failed to secure their data with the most basic measures, i.e., storing them all in private servers, fire-walled, etc.," said Chris Olson, CEO of The Media Trust, who explained that securing data is a part of doing business for every organization. "Data providers need to keep in mind that they are prime targets for cybercriminals who want to commit identity theft and have tools to find databases on publicly accessible servers."

There's no evidence yet that the information exposed on the Exactis database has been pilfered and used maliciously but it put individuals and consumers at risk of a number of attacks. "The data reported to have been leaked is incredibly comprehensive and can be used by hackers to develop more targeted phishing scams," said John "Lex" Robinson, cybersecurity strategist at Cofense, who contended that consumers and businesses should be outraged. "Phishing scams are more successful when the attacker can craft messages that are relevant to the victim-utilizing data such as addresses, personal interests or information about their family."

As breaches, exposed databases and servers and other risks come to light, "consumers are rapidly realizing that there are companies out there that have amassed significant information on them but are failing to provide adequate cybersecurity protections," said Carl Wright, chief revenue officer at AttackIQ. "These companies are using this data to generate significant revenue and in most cases providing little to no value to the consumers."

The numbers in this latest incident might compel the U.S. to adopt stronger privacy protections. "The scope of and negligence behind this leak could prompt greater demand among already wary U.S. consumers for stronger regulations around data privacy like the EU's GDPR," said Olson.

Such regulations, he said, "would restrict how personal data is not only stored but used in the U.S."

Indeed, if any EU citizens are among those affected "by this data breach, it will be interesting to see how the recent enforcement of the EU GDPR will be impacted and how the EU will respond if indeed citizens' data is included in the massive data breach," said Joseph Carson, chief security scientist at Thycotic, who called the Exactis incident "careless and irresponsible."

Because GDPR calls for user consent for personal information processed and collected by companies like Exactis, in addition to adequately protecting and securing it "from unauthorized access by using a least privileged approach," Carson said that "Companies who fail to show they have failed in the basic cybersecurity best practices should be held accountable and responsible for failing to protect those who have entrusted them with their data."

Wright added, "Corporations and government entities must be required to continuously prove that their cybersecurity protections are able to defeat or detect attackers."

David Ginsburg, vice president of marketing at Cavirin, pointed to California's impending Consumer Privacy Act, saying, "this may serve as a template for protections at the federal level."

Noting that the company's website was down in a likely response to "this massive data breach," Carson is waiting to see "if Exactis has a solid and well-prepared incident response plan. Frankly, I hope they have practiced and tested it for such an event as this."

# data[].attributes.attachment_link.title
Exactis breach exposes 340M records, may compel GDPR-like reg in U.S. | SC Media

# data[].attributes.attachment_link.description
An exposed database at data broker Exactis exposed nearly 340 million records amounting to around two terabytes of information. "If U.S. citizens did not think their personal information has ever been compromised, this should convince them it definitely is," said Robert Capps, vice president and authentication strategist for NuData Security, noting the Exactis "breach blows up the 2018 tab with 230 million [consumer] records exposed in just one incident."

# data[].attributes.body
https://www.scmagazine.com/home/news/navionics-misconfigured-mongodb-server-exposes-260000-records/

Navionics, a marine navigation company owned by Garmin, was recently alerted of a breach in their information security. A cyber risk researcher found the vulnerability with a serch engine, up to 19GB of data unprotected. Luckily it was brought to the attention of the company and secured before any malicious attackers got in, at least to the best of their knowledge.

Compliance with data protection rules and regulations could have helped prevent an exposure such as this.

# data[].attributes.body
https://www.scmagazine.com/home/news/privacy-compliance/disney-sued-accused-of-violating-child-data-privacy-laws/

Last year, Disney was accused of violating COPPA, and faced a lawsuit (not their first one) for it.  The accusation states that Disney apps allow third parties to collect information about certain web activity in order to subject them to "behavioral advertising."

Disney responded by stating that is has a "robust COPPA compliance program" and that "the complaint is based on a fundamental misunderstanding of COPPA principles."

This issue highlights a gray area in COPPA regarding what data should be protected.  Although the apps weren't collected traditional PII, they were collected information that about the habits of an individual.   As the article states:

“The definition of personally identifiable information includes the concept of persistent identifiers — mechanisms such as cookies, unique device identifiers, or IP addresses, that can be used to identify a user over time and across different sites, even if the user’s name and address are not collected,” Cherepennikova said. “Unfortunately, the very definition of what constitutes ‘personally identifiable’ is open for debate as new technologies and services emerge.”

# data[].attributes.body
https://www.scmagazine.com/home/news/weak-passwords-outlawed-out-west-california-law-aims-to-secure-iot-devices/

This article is about a law passed in California banning what are known as "weak" passwords. It is scheduled to go into effect in 2020. This law mandates the that companies require users to either have strong passwords or have a more secure way for users to login to a site. This government intervention may or may not help the password security problem because as we discussed in earlier classes, requesting more difficult passwords also leads to users repeating the same password for many sites which is counter productive where security is concerned. This law seems to address one aspect of the problem but isn't a silver bullet.The law also pushes for a stronger alternative to passwords which may help address this security issue more effectively.

# data[].attributes.attachment_link.readable_text
California passed has just passed a law effectively banning weak passwords and enforcing other security measures to more effectively secure connected devices.

While its unlikely individuals or businesses will be raided by local law enforcement for attempting to lock down their computer or Wi-Fi using "Password123," the new law will require that manufactured devices be preprogramed with unique passwords as opposed to uniform default login credentials.

The Information Privacy: Connected Devices law will also mandate devices to contain security features requiring the user to generate a new means of authentication before access is granted to the device for the first time as well as other measures to ensure devices are protected.

High-Tech Bridge CEO Ilia Kolochenko praised the move as serving a laudable example to other governments that insecure IoT and network devices pose an invisible but rapidly growing security and privacy risk today.

"Millions of connected devices become an essential part of our daily life," Kolochenko said. "Widely present default or weak passwords may now cause not just cyber problems but physical injuries or even death."

He added that banning weak password may also have the collateral effect of people deciding to reuse the same passwords everywhere that they eventually forget, subsequently leaving their devices without regular updates making it more prone to attacks.

Users could also be pushed to create more passwords that may not fall under the legal definition of a weak password but are still bruteforceable.

Experts agree, Amit Sethi, senior principal consultant at Synopsys said the law is unlikely to make connected devices more secure in the long run.

"Another issue is that the password uniqueness requirement only appears to apply to connected devices that are 'equipped with a means for authentication outside a local area network,'" Sethi said. "This assumes that connected devices are deployed in completely trusted local area networks - this is rarely the case in real life."

Other researchers suggested the law doesn't address admin password nor the way in which large organizations administer them One Identity Senior Director Bill Evans suggested governments should use tax incentives to promote security.

"Imagine a regulation that suggests that every dollar spent on a privileged management solution can be deducted from next year's tax burden," Evans said. "Governments should use the 'carrots' available to them, rather than the "sticks," to incentivize enterprises to make the security investments that are best for them."

The bill will go into effect in 2020.

# data[].attributes.attachment_link.title
Weak passwords outlawed out West, California law aims to secure IoT devices | SC Media

# data[].attributes.attachment_link.description
California passed has just passed a law effectively banning weak passwords and enforcing other security measures to more effectively secure connected devices. While its unlikely individuals or businesses will be raided by local law enforcement for attempting to lock down their computer or Wi-Fi using "Password123," the new law will require that manufactured devices be preprogramed with unique passwords as opposed to uniform default login credentials.

# data[].attributes.body
The Internet Association has expressed their favor in national regulation with regards to internet privacy. This comes from the many separate laws and regulations that reside in state level jurisdiction which differs across each border. With a national policy, companies and agencies need to adhere to the national law in conjunction with state laws, patching up the loopholes that exist within current laws.

# data[].attributes.attachment_link.readable_text
The Internet Association, which represents more than 40 companies, including Facebook, Alphabet, Microsoft and Twitter, came out Tuesday in favor "an economy-wide, national approach to regulation that protects the privacy of all Americans" rather than adhere to a bundle of individual state laws like the recently passed California Consumer Privacy Act.

The group seeks "meaningful controls over how personal information they provide" and supports the rights of consumers to delete information as well as data portability.

"A national data privacy law, like GDPR which aligns with the proposed U.S. approach, is a huge step forward in data privacy for citizens and for keeping organizations accountable when collecting sensitive data," said Egress Software CRO Mark Bower, who noted that the regulation provided relief from the EU's "patchwork of legislation" amassed over more than 20 years.

"The volume and diversity of regional laws made it difficult to comply with all of the regulation and also provided loopholes for less scrupulous businesses to flout individual country law across borders," said Bower.

"The vision of a national law for the US brings together the learnings from the EU with a desire to protect U.S. citizens cross-state," he said, resulting in "a single set of rules that business will be governed by, regardless of which state they reside, or where their data subjects reside" and which "will reduce the complexity for both business and individual and ultimately result in a more effective set of regulations."
The California law is set to take effect in 2020.

# data[].attributes.attachment_link.title
Internet companies push for national privacy law | SC Media

# data[].attributes.attachment_link.description
The Internet Association, which represents more than 40 companies, including Facebook, Alphabet, Microsoft and Twitter, came out Tuesday in favor "an economy-wide, national approach to regulation that protects the privacy of all Americans" rather than adhere to a bundle of individual state laws like the recently passed California Consumer Privacy Act.

# data[].attributes.body
https://www.scmagazine.com/home/news/national-breach-notification-law-would-usurp-patchwork-of-state-laws/

It is a necessary that laws are starting to circle around data breaches that can affect us financially. Since many of our finances are tied to the digital world, aside the very few people who would only use cash hidden in pillowcases and around their house, a data breach to a financial institution could cost millions of people their lives. There have been several cases that have already happened that prove these actions are necessary. JPMorgan Chase was cyberattacked in summer 2014, which led to disruption of almost 80 million houses and 7 million businesses, costing the bank one billion dollars. In 2012, Global Payments Inc. took a big hit on it's North American servers as 1.5 million card accounts got hacked and data was stolen. Citibank had known of a digital vulnerability, resulting in a $19.4 million loss and affecting 360,000 credit holders. Again in 2009, 130 million cards were compromised with Heartland Payment Systems from a breach that resulted in a $2.8 billion cost. There are several other cases not listed here, but it is important to note that even high security financial institutions can be breached.

The recent bipartisan amendment to the Gramm-Leach-Bliley Act, or GLBA, hopes to empower consumers to better protect themselves if and when a breech or compromise occurs. It would mandate that financial institutions who are made aware of any breach notify their affected customers within a set period of time following the incident. It offers a standardization of existing laws that would supersede current state laws that may be lacking, and may mean that a consumer is able to take action before such a compromise negatively impacts them and their financial well-being.

First, you’ll want to check and confirm if you were affected by the breach. Companies are required to notify consumers on the incident some companies may provide links to check if you were affected and other may just tell you the situation. Companies may offer free services to help those affected, take advantage of the free perks. After that you’d want to know the potential impact of the breach to ensure your credit, address, social security or email information wasn’t breached. From there, check your credit reports and bank statements actively to notice any changes in case of identity theft. If there is, call or go to your bank immediately and clear things up. You may have to consider doing a credit freeze to ensure no new accounts get opened in your name. In the case that companies learned about the situation too late and you are already a victim of acts of identity theft placing Fraud Alerts on your accounts to inform creditors of your situation of being a victim could help find anyone using your information. If you find out someone is using your information report it and websites like Identitytheft.gov will help you with reporting that information.

# data[].attributes.body
This article covers a report that found how much not following regulations, self-auditing, and training employees properly can cost a company. On average a non-complying company spends more than twice that of a company with an effective compliance program on compliance related costs. In some industries, such as financial services, there is almost a 600% difference in compliance costs.

# data[].attributes.attachment_link.readable_text
Data is King. Understanding where it travels, where it resides and how to best protect it is no longer just an option-it's a necessity for all businesses. Organizations are burdened with the responsibility of protecting customer, partner and vendor data, and storing it as securely as possible. Government mandates and regulations such as the General Data Protection Regulation (GDPR), Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA) and Sarbanes Oxley are constructed to help us do just that: keep private data, private.

The enforcement of these privacy regulations underscores the new era of complex policies developed to protect data at the individual level from increasingly sophisticated cyberattacks. We're just getting started, as more data protection regulations and frameworks are expected to be developed and implemented globally in the near future.
Pay now, or, pay much, much more later
Globalscape recently partnered with the Ponemon Institute to quantify the cost of compliance and non-compliance to businesses. The report, called True Cost of Compliance with Data Protection Regulations, found that if companies invested in compliance activities upfront-such as audits, enabling technologies, training and expert staffing-that they could avoid the astronomical financial impact of non-compliance.

Consider these staggering numbers: Non-compliance costs businesses on average $14 Million; a 45 percent increase since 2011. For those businesses that do comply, costs averaged around $5.47 million annually-less than half the cost of non-compliance.
Factors of compliance readiness
Compliance readiness varies by organizational size and industry. When adjusting compliance and non-compliance costs by each organization's headcount, smaller companies (<5000 employees) incur substantially higher per-capita compliance costs than larger companies (> 5,000 employees).

Understandably, organizations in heavily regulated industries have the highest compliance costs. For example, we saw a spread of $7.7 million for media to more than $30.9 million for financial services. Between 2011 and 2017, healthcare organizations, and technology companies experienced the highest growth in cost at 106 percent and 99 percent, respectively. Energy and utilities, and retail companies experienced the lowest growth in total compliance cost at 6 percent and 40 percent, respectively, according to our report.
Reducing compliance costs
Whether you choose to invest in technologies such as managed file transfer (MFT), data loss prevention, data classification or governance, risk and compliance solutions, or better enforcement of current data protection policies, the risks and rewards from a cost perspective are clear. Keep the following in mind on your journey to compliance:
Evaluate data governance programs and auditing process
The deployment of a centralized data governance program can reduce total compliance costs by $3.01 million, according to our report. Similarly, we found that conducting compliance audits reduces total compliance costs by $2.86 million. Governance can help organizations maintain the appropriate oversight required to understand, track and audit where sensitive data is shared, and ultimately, stored. This is increasingly important as there are specific response times or data protection measures required in regulations like GDPR or PCI DSS. Regular audits can provide details on where an organization fails to meet compliance measures before an incident or regulatory body enacts fines or other penalties.

Among individual regulations, 90 percent of survey respondents said they believed GDPR will be the most difficult to achieve within their organization. PCI-DSS was the second most difficult, followed by U.S. state laws and HIPAA.
Does your managed file transfer solution meet compliance mandates?
Data privacy matters. It's the core reason why compliance regulations are in place. Do you understand how data moves throughout your organization? Are you certain that your MFT solution meets compliance mandates?
Empowering employees
In addition to complying with regulatory guidelines, organizations should provide employees with the right training and tools to ensure they're consistently working in ways that improve their security posture. To counter the problem of end user error, or poor data sharing practices, companies should consider offering their workers intuitive, convenient tools that automatically provide higher levels of protection, such as encryption. This strategy aims to make sure team members don't disregard best practices and resort to less dependable consumer-grade programs.
Ensuring data privacy is worth the long-term investment
Organizations can implement preventative measures to better control, integrate and govern data so that compliance is easily achievable and staggering costs are avoided. Through the use of technology, regular audits and the strengthening of governance and visibility structures, these compliance mandates are not only achievable but worth the long-term investment.

Peter Merkulov serves as Chief Technology Officer at Globalscape. He is responsible for leading product strategy, product management, product marketing, technology alliances, engineering and quality assurance teams. Merkulov has more than 16 years of experience in the IT security industry, specifically in product strategy and management. Merkulov has a Masters from Moscow State Institute of International Relations (University) MFA Russia MGIMO.

From the May 01, 2018 Issue of SC Media

# data[].attributes.attachment_link.authors[].name
Peter Merkulov, Chief Technology Officer, Globalscape

# data[].attributes.attachment_link.title
The staggering costs of non-compliance | SC Media

# data[].attributes.attachment_link.description
Data is King. Understanding where it travels, where it resides and how to best protect it is no longer just an option-it's a necessity for all businesses. Organizations are burdened with the responsibility of protecting customer, partner and vendor data, and storing it as securely as possible.

# data[].attributes.body
This article is about the bipartisan legislation to modernize the Department of Homeland Security's Continuous Diagnostics Mitigation and make it a recognized program.  CDM will provide automation for our cyber security activities.

# data[].attributes.attachment_link.readable_text
Two weeks after it passed the U.S. House of Representatives, a bill that would codify and modernize the Department of Homeland Security (DHS) Continuous Diagnostics Mitigation (CDM) cybersecurity program was introduced into the Senate.

Known as the Advancing Cybersecurity Diagnostics and Mitigation Act, the legislation was originally proposed last July by Rep. John Ratcliffe, R-Tex., and ushered into the Senate yesterday by Sen. John Cornyn, R-Tex. and Sen. Maggie Hassan, D-N.H.

"Cyberattacks are escalating at an alarming rate, making it vital that our federal agencies have access to programs and tools to help mitigate these risks," Cornyn said in a press release. "This legislation would help ensure the Department of Homeland Security can continue to rely on and evolve the CDM program to understand and defend against the cyber threats before them."

"By establishing in law the Continuous Diagnostics and Mitigation program at the Department of Homeland Security and requiring the Department to develop policies for updating the program's vulnerability detection capabilities to keep pace with ever-evolving threats, this bipartisan bill will further strengthen our nation's defense in the face of cyber threats from Russia, China, criminal hackers, and cyber terrorists," said Hassan in the same release.

DHS's CDM program provides the federal government with automation capabilities and tools for monitoring vulnerabilities and unauthorized network activity, and identifying and prioritizing security risks for mitigation.

# data[].attributes.attachment_link.title
Bill to codify DHS cyber program introduced into Senate after passing House | SC Media

# data[].attributes.attachment_link.description
Two weeks after it passed the U.S. House of Representatives, a bill that would codify and modernize the Department of Homeland Security (DHS) Continuous Diagnostics Mitigation (CDM) cybersecurity program was introduced into the Senate. Known as the Advancing Cybersecurity Diagnostics and Mitigation Act, the legislation was originally proposed last July by Rep.

# data[].attributes.body
The article discusses a proposed law that would report any data breaches in the financial sector to consumers in a timely manner. This would be a federal law, and as such, will supersede any reporting laws that are currently in place in state law. This standardization will allow financial institutions to develop and utilize a framework across the board to allow for more efficient reporting of breaches. In turn, this will allow easier government enforcement of disclosure if a successful attack occurs, hopefully leading to better confidence in the security of consumers' financial data.

https://www.scmagazine.com/home/news/national-breach-notification-law-would-usurp-patchwork-of-state-laws/

# data[].attributes.headline
Group 2 (Jesse Roberts and Jared Futral) 

# data[].attributes.subject
Group 2 (Jesse Roberts and Jared Futral) 

# data[].attributes.body
This article is about the 'Right to be Forgotten.' Currently this is only a law in the European Union and Argentina. One issue with this case is which court of law presides over this matter. Google is an American corporation but they have servers worldwide, mainly due to their presence in cloud technology. Because they have servers in EU domain, EU law can demand the data be taken down on servers within their territory. In America, there is no Right to be Forgotten; because of this, Google is within the law for this data to remain on their servers and in public access.
The American people are evenly split on this issue. Many find this idea to contradict the Freedom of Expression and Free Speech. Others recognize the harm of having "inaccurate, irrelevant, inadequate, or excessive" data where the public can access it. Most Americans that are proponents of some form of Right to be Forgotten strictly target innacurate and false data which harms a person's quality of life. In the past, U.S. courts have ruled there to be "limits to the right to control one's life and facts about oneself," and that a person cannot ignore data simply because they want to.

# data[].attributes.attachment_link.readable_text
A businessman, whose "right to be forgotten" request was denied by Google to "defend the public's right to access lawful information", has filed a lawsuit in the high court in a bid to make Google remove online references to his criminal past.

The businessman was convicted in the late 1990s for his role in a business malpractice that had garnered widespread condemnation, including in parliament. Having served his sentence, he now wants any online references to the conviction to be removed so that his past does not affect his relations or his business interests. The online references in question are several search results that link to old news articles on his conviction.

However, Google is contesting his right to be forgotten, stating that he can not "rewrite history" or "tailor his past". The company added that the business malpractice he was involved in was "serious and sustained" and "involved deceptive and misleading criminal practices".

The company said it reserves the right to not honour "right to be forgotten" requests if it feels that an individual's right to privacy does not outweigh the public interest in the existence of such information in the public domain. According to a judgment delivered by the European Union's court of justice in 2014, right to be forgotten can be exercised only if the data that an individual wants removed is irrelevant or outdated.

Commenting on the question of an individual's right to be forgotten and the public's right to access lawful information, Ralph Echemendia, known to many as "The Ethical Hacker" and CEO of Seguru, says that while selective disclosure of personal information is considered by many to be a basic human right, the public's "right" to access "lawful" information is not a human right, but is being used as a defence by Google's legal team.

"Law and regulation is usually ten years behind the use of technology and in many cases not necessarily in the interest of the individual. Legal does always not mean ethical. It's also important to consider that in today's cloud-based environment, your information is no longer stored on just one hard drive, but in many across the world. This means many different laws could be applied to this data, not just those that are in place in the country in which the company is headquartered," he says.

"With GDPR kicking in this year, it will certainly be very interesting to see if the regulations coming into force will help or have a detrimental effect on our privacy."

While it is for the courts to decide if an individual's right to be forgotten is supreme and not subject to the public interest, what is more pertinent is whether today's companies are equipped enough to honour such requests, considering that a landmark data protection law that expressly allows such requests to be made, is less than three months away.

"If companies can't identify where their data resides in order to remove it from their sites, they risk the enormous fines that come as part of the GDPR deal. Google of course have the might to take on contentious ones like this, smaller companies will struggle and be forced to remove data even if they don't agree," says Jes Breslaw, director of strategy for EMEA at Delphix.

"The proliferation of data means that copies of personal data are scattered across an organisation. In order to remain in line with the right to be forgotten and GDPR, companies need to know where this data is stored in the first place.

"In reality, 90 percent of a company's data sits in test, reporting, analytics and backup systems, which makes it incredibly hard to track and trace. Therefore, it's more important than ever that companies have the right technology in place to help them identify and remove sensitive data," he adds.

Breslaw adds that there are technologies available that enable firms to create a comprehensive library of data sources using which they can pinpoint exact locations of certain data, whether on-premises or in the cloud. By using such technologies, companies will be able to honour "right to be forgotten" requests in a timely manner and thereby avoid huge fines under the GDPR.
This article originally appeared on SC Media UK

# data[].attributes.attachment_link.title
Google gets sued for denying "right to be forgotten" request | SC Media

# data[].attributes.attachment_link.description
A businessman, whose "right to be forgotten" request was denied by Google to "defend the public's right to access lawful information", has filed a lawsuit in the high court in a bid to make Google remove online references to his criminal past.