The Federal Bureau of Investigations does a poor job at notifying victims of a cyber-attack, a US government report released earlier this week concluded. . FBI notifications arrive either too late or contain insufficient information for victims to take action, a report from the Department of Justice's Office of the Inspector General (DOJ-OIG) has concluded. The report analyzed Cyber Guardian, an FBI application for storing information about tips and ongoing investigations. The system also allows agents to enter details about suspected victims, which Cyber Guardian can later notify via automated messages. The link for this article located at ZDNet is no longer available. . Alerts from the FBI often come after critical delays or lack the necessary details, hindering victims' ability to respond effectively to incidents.. FBI Breach Notifications,Cyber Attack Response,Cybersecurity Analysis. . Brittany Day
A bill introduced yesterday by Sen. Bob Bennett (R-Utah) and Sen. Tom Carper (D-Del.) both of whom serve on the Senate Banking Committee, joins a growing list of data security measures now pending before Congress. The proposed Data Security Act of 2006 seeks to create a national data protection and breach notification standard. . "This bill would require all financial institutions, retailers and government agencies to maintain strong internal safety protections for the data they hold," Carper said in a statement. It would also require them to "quickly investigate" security breaches and to notify law enforcement, regulators and customers when there is a real risk of harm, he said. The proposed bill would expand the reach of current laws that require only financial institutions to protect the security and confidentiality of customer information, Bennett said in a separate statement. The link for this article located at ComputerWorld is no longer available. . New bill proposed to reinforce cybersecurity measures within banks and public sector organizations.. Data Protection Act, Security Standards, Breach Notification. . Benjamin D. Thomas
New York has joined the growing list of U.S. states requiring that companies notify their customers whenever private information has been compromised. On Wednesday, the state's Information Security Breach and Notification Act went into effect, according to a spokeswoman for the state's attorney general, Eliot Spitzer. The law, which is similar to California's SB-1386 notification law, requires businesses and state agencies to inform New York residents "whose unencrpyted personal information may have been acquired by an unauthorized person," according to the text of the legislation. . New York's Notification Act is one of a growing number of legislative and regulatory efforts that are forcing executives to pay more attention to security, said Dan Aiken, the compliance director with New York's Hospital for Special Surgery "Now, like in California, if your information is compromised, or if you have reason to believe it may have been compromised, you have to report it," he said, speaking at the Infosecurity conference in New York Wednesday. "There's a real risk to brand name, to your public reputation." The link for this article located at InfoWorld is no longer available. . California's Disclosure Law enhances the requirement for companies to inform users regarding breached data.. Breach Notification, New York Law, Security Compliance, Privacy Regulations. . Benjamin D. Thomas
On July 1, 2003, Senate bill 1386 becomes Civil Code 1798.82. In a nutshell, the law states that any person or company doing business in the state of California is responsible for notifying California residents of security breaches to their non-encrypted . . . . On July 1, 2003, Senate bill 1386 becomes Civil Code 1798.82. In a nutshell, the law states that any person or company doing business in the state of California is responsible for notifying California residents of security breaches to their non-encrypted information. It is important to note that the actual breach does not need to occur in the state of California for the law to apply. As long as a company is doing business in the state, "doing business" defined as: having a registered agent in the state of California, having a physical office, contracting to do business with vendors in the state (parts manufacturers, suppliers), or having retail outlets in the state, they are liable to notify their California customers. However, if you are strictly a mail order business, with no ties to California except your online customers, this law may not apply to you at all. Most corporations are going to take the path of least exposure, i.e., letters mailed to affected customers. Interestingly, there is no language in this law governing what the notification has to say, and whether or not it has to be easily understood by the customer. Even more compelling, this law applies worldwide, to any company doing business in the state, regardless of what they sell and whether or not they know that such a law exists. The link for this article located at HelpNetSecurity is no longer available. . Assembly Bill 2247 requires companies in California to inform customers about data breaches. Do you have a plan in place?. Breach Notification Law, Data Protection Requirements, California Compliance. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.