Archives: New + Now

Subscribe to New + Now RSS Feed

Fall-Out from Blackbaud Ransomware Attack

As a follow-up to last week’s post on the importance of due diligence regarding high-risk vendors’ security practices, Blackbaud, a global company providing financial and fundraising technology to not-for-profit entities, notified its customers late last week that it was the victim of a ransomware attack in mid-May. Blackbaud offers a number of products to its … Continue Reading

Benefit Vendors’ Security Practices

Most employers use vendors to assist with managing various employee benefits, including payroll, health and dental benefits, pharmacy, cost-reduction strategies, retirement, analysis and wellness programs. When using these vendors, the personal information of employees is provided to the vendor in data dumps. Usually that means that the vendors receive employees’ names, addresses, dates of birth, … Continue Reading

Amazon Offers a “Quickstart Package” for Compliance with DOD’s CMMC

Amazon has announced that it has developed and is offering a “CMMC Quickstart Package” to help contractors comply with the Department of Defense’s (DOD) Cybersecurity Maturity Model Certification (CMMC) required for contractors to enter into contracts with DOD. According to an Amazon spokesman, Amazon Web Services (AWS) will be releasing a responsibility guide that “lists … Continue Reading

CCPA Enforcement Looms

We have previously alerted our readers about the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. CCPA is one of the strictest consumer privacy laws in the U.S. and is broadly applicable [view related posts]. Although CCPA went into effect on January 1, 2020, enforcement by the California Attorney General … Continue Reading

Think Twice Before Marketing with Robocalls

Sales and marketing professionals in companies are usually energetic, vivacious and creative. That’s what makes them so good at their jobs. But it’s also these excitable folks who can get companies in trouble when it comes to the Do Not Call List and the Truth in Caller ID Act. In addition to the Telephone Consumer … Continue Reading

DHS Warns Windows 10 Users of Exploit Code

The Department of Homeland Security (DHS) cybersecurity advisory arm issued a warning on its website that “[M]alicious cyber actors are targeting unpatched systems” with a new exploit code that on unpatched systems could spread to millions of computers. The exploit code, called SMBGhost, attacks a security vulnerability in the server message block (SMB) that Microsoft … Continue Reading

Have Questions About CMMC? Don’t We All

I had the pleasure of participating as a panelist this week for companies primarily involved in the maritime industry, and one of the topics discussed was the Department of Defense’s (DOD) Cybersecurity Maturity Model Certification Program (CMMC). The discussion generated questions that I thought merited sharing. Simply put, the DOD’s CMMC Program was designed to … Continue Reading

Financial Services Information Sharing Group Warns of Increased Phishing Attacks

The Financial Services Information Sharing and Analysis Center (FS-ISAC) has warned that financial services firms, and in particular smaller ones, are being attacked at an increased rate during the coronavirus pandemic. According to FS-ISAC, phishing attacks against financial services firms increased by one-third in the first quarter of 2020. In that time period, FS-ISAC identified … Continue Reading

Small Business Administration Loan Portal Compromised

Following the devastating impact of the coronavirus on small businesses, many small businesses applied for a disaster loan through the Small Business Administration (SBA) for relief. Small businesses that qualify for the disaster loan program, which is different than the Paycheck Protection Program offered by the SBA, can apply for the loan by uploading the … Continue Reading

Privacy, Security and Data Loss Prevention

I always enjoy hosting and participating in the CISO Executive Network meetings. The meetings offer Chief Information Security Officers (CISOs) the opportunity to discuss together ways they can improve security in their organizations, get ideas from each other on strategies and products, and vent with colleagues about particular issues and complaints. It gives me great … Continue Reading

Interpol Issues Alert on Increased Risk of Ransomware Attacks Against COVID-19 Medical Organizations

Interpol has issued an alert to global law enforcement agencies about the increased risk of ransomware attacks on hospitals, health care providers and other organizations on the front line of response to the COVID-19 pandemic. The Purple Notice, issued to all 194 member countries, notified them that Interpol’s Cybercrime Threat Response team has detected a … Continue Reading

Working from Home During the Pandemic? Turn Alexa and Siri Off!

The transition from work-from-the-office to work-from-home has been rapid during the pandemic. All of a sudden, millions of workers are working from home, while data security personnel were not able to plan and operationalize the transition in an optimal way. Many security measures are being put in place now as everyone settles into the new … Continue Reading

Ransomware—to Pay or Not to Pay and Should We Get a Bitcoin Wallet Just in Case?

There’s nothing worse than paying criminals. And paying a ransom for data is just that—paying criminals for a criminal act. All you get out of the payment is access to your data. It doesn’t fix the vulnerability or the root problem. Let the record reflect that the FBI does not recommend paying ransoms to cyber … Continue Reading

Changing the Conversation About Sharing and Using Health Information

Some app developers know more about our health than our doctors do. Take, for instance, FitBit, which is attached to our wrist and measuring in real time our temperature, our heart rate, our steps and whether we have had enough exercise for our age in a day. Some people sleep with their phones on their … Continue Reading

States and Municipalities on High Alert for Iranian Originated Cyber-Attacks

The Department of Homeland Security (DHS) is warning critical infrastructure operators to be on high alert for Iranian backed cyber-attacks because of the vulnerability of state and municipal computer systems, they are at high risk for attack from Iranian-based hackers. We have seen states and municipalities get hammered with ransomware in the past year. Now … Continue Reading

CCPA Recap for the New Year

After much anticipation and trepidation, the California Consumer Privacy Act (CCPA) went into effect on January 1, 2020. Many companies are understandably still grappling with the details of the law, the amendments, and the proposed regulations and how to comply with them. If you have not determined whether the CCPA applies to your company, and … Continue Reading

Biometric Suit Not Preempted by Workers’ Compensation Statute

An Illinois employee of Power Solutions International Inc. (Power Solutions) filed suit against his employer alleging violations of the Illinois Biometric Information Privacy Act (BIPA) when Power Solutions collected his fingerprints through a timekeeping system without providing consent to do so. Under BIPA, companies, including employers, are required to provide notice and consent to employees … Continue Reading

To Extend or Not to Extend Consumer Rights to All

Microsoft announced this week that it would extend the consumer rights currently given to California consumers through the California Consumer Privacy Act to all consumers—no matter where they reside. I applaud this move (especially because I don’t reside in CA). But why should my personal information be protected differently than those who live in California? … Continue Reading
LexBlog