PwC Issues 2015 Cybercrime Survey Results

“It’s been a watershed year for cybercrime,” explains PricewaterhouseCoopers LLC in its 2015 report analyzing data from 500 executives across US businesses, law enforcement and government agencies.  The survey and report, co-sponsored by PwC, CSO, Carnagie Mellon University and the United States Secret Service, provides a comprehensive analysis of trends in cybercrime and cyberthreats, as well as security spending and overall manage of these growing business risks. This year, a record 79 percent of respondents detected a security incident during the past 12 months, with…
Continue reading...

Military Retaliation in the Age of Cyber Warfare

The Obama administration has concluded that the recent Chinese cyberattack on the Office of Personnel Management rises above the level of traditional espionage, and that retaliation is the most suitable response to the theft of 20 million American’s personal information. Exactly what the retaliation may entail and when it will come, however, are open questions. Over the past year, United States government and military computer systems have been compromised by what many believe are foreign governments, including Russian attacks on the White House, State
Continue reading...

DHS – “Privacy Problems with CISA”

The Senate is expected to begin debate this week on S.754, the Cybersecurity Information Sharing Act (CISA) and at least one government agency is raising privacy and civil liberties concerns with respect to this legislation. Specifically, the Department of Homeland Security (DHS) is concerned that the desire to share information in real time could prevent it from scrubbing the data to erase personal identifiable information or other private information contained in the data. The primary purpose of CISA is to encourage the sharing of cyber…
Continue reading...

Federal Cyber Legislation – Hurry Up and Wait

Despite the increasing number of data breaches, legislation to address this issue at the Federal level is at a standstill (or close to it). As has been noted in a variety of venues, currently, there is no comprehensive federal law to deal with data breaches. The federal law that does exist is centered on privacy issues for specific industries, e.g., Health Information Portability and Accountability Act (HIPAA) for health information and the Gramm-Leach Bliley Act (GLB) for financial information. While most states and the…
Continue reading...

Millions Exposed in Multiple Heath Data Breaches

This summer, millions of medical patients have learned that their personal information, including names, addresses, birthdates, Social Security numbers, Medicare or health plan ID numbers, and some medical information (conditions, medications, procedures and test results) may have been exposed as a result of two separate security breaches. California’s UCLA Health announced on July 21, 2015 that their information system has been attacked, possibly beginning in November 2014, and that the unencrypted medical information of over 4.5 million patients may have been accessed.  This latest breach…
Continue reading...

New Federal Cybersecurity Legislation and Regulations Proposed in Washington DC

This week, new legislation and regulations have been proposed to address cybersecurity concerns in new automobiles and the nation’s Bulk Electric System. On Tuesday, Senators Edward J. Markey (MA) and Richard Blumenthal (CT) introduced new legislation to address the hacking risks associated with “connected vehicles.”  The Security and Privacy in Your Car Act of 2015 would mandate that sensitive software systems be isolated and additional safeguards be added “to protect consumers from security and privacy threats to their motor vehicles”.  The legislation followed a 2014…
Continue reading...

Two GAO Reports Detail Deficiencies and Improvements in Thwarting Cyber Crimes

The Government Accountability Office (GAO) recently issued two reports on battling cyber threats that are useful for both private and public entities. The first report, issued July 2, 2015, was entitled Cybersecurity: Bank and Other Depository Regulators Need Better Data Analytics and Depository Institutions Want More Usable Threat Information. In that report, the GAO noted that while, “[d]epository institutions obtain cyber threat information from multiple sources, including federal entities such as the Department of the Treasury (Treasury)[,] [r]epresentatives from more than 50 financial institutions…
Continue reading...

Sometimes Newer Isn’t Always Better: U.S. Navy is Paying Millions to Keep XP

In March 2014, Microsoft announced that it was phasing out support for its Windows XP operating system, including the continued release of patches protecting against hackers and other intrusions. Although the Windows XP platform, originally released  August 24, 2001, has been replaced by updated versions, the United States Navy agreed to pay Microsoft $9 million annually for continued support of the XP program, which runs many of the Navy’s critical systems, including the Space and Navy Warfare Systems Command.  While only 10 percent of government…
Continue reading...

Congress and the Internet of Things

Despite the trend toward the Internet of Things, some institutions are taking a slow and cautious approach given the possible security vulnerabilities. This includes the U.S. Congress. The Internet of Things usually refers to machine to machine communication.  For example, consider the Microsoft band that monitors heart rate, steps, calories, burned, etc. (which, incidentally, the co-chair of the Congressional Internet of Things Caucus wears). Recent breaches into government computers including the massive data breach at the Office of Personnel Management (“OPM”) clearly demonstrate…
Continue reading...

Can A SAFETY Act Designated Product Provide Cyber-Attack Liability Protection?

“So if you use FireEye’s product you basically are prevented from being sued in the criminal justice system of America, which can save a lot of money.” According to CEO Dave DeWalt’s recent comments, it sounds like the U.S. Government stamped FireEye with a seal of approval — a ringing endorsement that’s worth a closer look.  FireEye, Inc. was issued “Certification” under the SAFETY Act for its Multi-Vector Execution (MVX) Engine and Cloud Platform.  It isn’t the only SAFETY Act approved technology; DHS’s website…
Continue reading...