GDPR (the General Data Protection Regulation) goes into effect today, May 25. You’ve probably been receiving a stream of notifications from numerous companies announcing updated privacy policies or asking you to re-confirm your subscriptions to their email lists in light of the new regulations. The regulation, adopted in 2016 in the EU and now going into effect, is intended to protect private party’s data and give EU citizens increased control over how their data is collected, used and stored. It’s important to recognize that the regulation does not apply only to businesses in EU member states, but to any organization who processes the personal data of EU citizens.
The Federal Financial Institutions Examination Council (FFIEC) provides cybersecurity standards and auditing for financial institutions and regulatory bodies including: The Board of Governors of the Federal Reserve System (FRB), the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), the Office of the Comptroller of the Currency (OCC), and the Consumer Financial Protection Bureau (CFPB).
While credit and debit cards are extremely convenient, they've also opened up a whole new world of fraud. This makes the systems that retailers use to process these payments seem like great targets for hackers, and organizations from every corner of the globe are scrambling to secure themselves against these threats.
One big solution to this has been the Payment Card Industry Data Security Standard. The PCI DSS is a regulatory code that tells companies how they can better defend themselves against attacks levied to steal card data. It's an important tool in the fight against fraud and should be strictly followed.
Do you know what the HIPAA Security Rule is? What about the Privacy Rule? If you're a health provider, it's paramount you understand what both of these regulations are, otherwise you could end up like a number of health companies - in a financial mess.
"It's paramount that you understand what HIPAA's Security and Privacy Rules are, respectively."
Take St. Elizabeth's Medical Center in Brighton, Massachusetts, which broke HIPAA's Security Rule by violating regulations regarding electronic Protected Health Information, according to Elizabeth Snell of Health Security.
A data security plan is an organization's framework for employing security tools to make sure digital information is accurate, reliable, and available when those with authorized access need it—and not those without authorized access, such as malicious hackers. There are a few basic steps involved in assembling a quality data security plan:
In recent years, two-factor authentication has rapidly become a standard best practice for securing accounts. One of the most common ways to implement this is through SMS messages sent to a cell phone. For example, if you enable two-factor authentication for a Google account, when you try to log in with your password from a new computer or other device, Google will send a text to your cell phone with a code you’ll need to enter on the login screen to verify that along with having the correct password, you also have physical access to the associated cell phone for the account. That sounds good. But, recently, flaws in the SMS system have been uncovered that render this method of two-factor authentication inadvisable. In fact, the National Institute of Standards and Technology (NIST) will recommend against its use as a two-factor method.
Credit unions face major challenges when protecting financial data in today’s threat landscape. In addition to protecting consumer data and financial records, IT security teams must also deal with compliance mandates for FFIEC and a patchwork of federal, state, and other industry regulations. With so many regulations and areas to consider, the task of securing a network from breaches and vulnerabilities while meeting compliance requirements can seem overwhelming. That task has become even more onerous with the National Credit Union Administration (NCUA) buckling down even further on FFIEC compliance to ensure that credit unions are as secure as possible, given how many data breaches are still happening in the financial services industry today.
If your organization is subject to PCI DSS 3.2 compliance, you’re likely aware of the looming deadline mandating the migration away from the use of SSL and TLS v1.0 to a “secure” version of TLS, as defined by NIST (currently v1.1. or higher). The PCI Security Standards Council previously released a bulletin on the migration to help explain the reasons for the change and what steps are necessary. While the PCI Security Standards Council has extended the deadlines for compliance, there are very real reasons not to wait to make the move.
Banks, credit unions, and other financial institutions face major challenges when protecting financial data in today’s threat landscape. In addition to protecting consumer data and financial records, IT security teams also deal with auditing mandates for GLBA, FFIEC, SOX, PCI, and a patchwork of federal, state, and other industry regulations. In 2014, the Federal Financial Institutions Examination Council announced a new effort focusing on cyber security, including an audit of an organization’s ability to manage cyber security and mitigate cyber risk. The task of monitoring thousands of network and system events can seem overwhelming. EiQ’s SOCVue® hybrid SaaS security services help overcome these challenges by providing the right people, process, and technology in order to deliver increased security visibility and guidance to effectively reduce cyber risks and meet compliance requirements.
A recent post by Ulf Mattsson, CTO at Compliance Engineering, cited several key takeaways from the 2016 RSA Conference. Specifically, three of these takeaways echo the challenges that many of EiQ’s current customers faced prior to partnering with us:
- Increasing regulatory compliance requirements
- Shortage of IT security skills
- Rising security costs