4IT Blog

4IT has been serving the Miami area since 2003, providing IT Support such as technical helpdesk support, computer support, and consulting to small and medium-sized businesses.

The Blindside Of: Data Breaches

The Blindside Of: Data Breaches

Over the course of the last couple of years as the number of data breaches has become much more frequent, and the public awareness surrounding those breaches has heightened, many of our customers have come to appreciate our record on data breaches.  To date, none of our managed service customers have had to manage or remediate a breach, which as many of you may not be aware, can be expensive and painful.  Just how expensive and painful is the topic that I would like to address today. 

We have recently worked with a number of companies that were referred to us after a data breach, and the effort involved in locking down a poorly managed environment, isolating the extent of the breach in terms of the data that was exposed, and communicating with the parties whose data was exposed will likely be a huge business interruption, cost a lot of money, and create some very negative publicity for the breached entity.

 

For those of you that are not familiar with Florida law regarding data breaches, Florida Gov. Rick Scott signed the Florida Information Protection Act (SB 1524) into law, amending Florida’s breach notification status effective July 1, 2014.  According to Karen Booth of Law360.com, “the act replaces Florida’s current breach notification statute (Fla. Stat. § 817.5681) with a new statute (Fla. Stat. § 501.171), which, among other changes: (1) expands the definition of “personal information” triggering breach notification obligations to include an individual’s online account credentials (following California’s recent amendments, and also to include an individual’s name in connection with his or her health care or health insurance information; (2) expands the definition of “breach” from “unlawful and unauthorized acquisition” of personal information to “unauthorized access,” of such information; (3) reduces the deadline for notifying affected individuals from 45 to 30 days after discovery; (4) requires notification to the Florida attorney general regarding breaches affecting more than 500 individuals “in Florida”; (5) imposes unique requirements to provide copies of forensic reports, “policies regarding breaches,” and other documentation to the attorney general upon request; (6) requires reasonable data protection and secure disposal of personal information; and (7) retains relatively unique provisions of Florida’s current statute imposing daily monetary fines for late notice and requiring vendors to notify data owners of breaches within 10 days of discovery, while maintaining that the statute creates no private right of action.”

To adhere to these new state requirements for identifying and reporting to the affected users and the Florida AG once a breach has occurred, proactively preparing for a breach becomes almost mandatory.  What does this kind of preparation look like?

First, there are a number of IT infrastructure changes and specific software tools that should be added to the environment to assist in identifying the scope of breach.  These include enabling more extensive logging on all internet exposed devices, access permissions and authentication logging on the internal network and on any external websites where the entity might be storing PI (Personal Information) data, and identification and isolation of any PI data within the IT infrastructure.  Once these changes have been made, a separate program to collect and permanently store all of these logs is critical to being able to rapidly scan these logs to establish when the breach occurred, what data was exposed to the breach, and when the breach was closed.  If none of these can be established, then by default, the breached entity would have to presume that all data was exposed to the breach, significantly widening the impact of the breach.

Second, it is clear from the new requirement that the Florida AG can request lots of information to establish whether the breached entity was negligent.  That the Florida AG can request documentation that includes corporate policies for data breaches, forensic reports, incident response plans and reports, and other documentation should be a clear indication that the state plans on assessing how well prepared the entity was to react appropriately to the breach.

As we have assisted more referral customers in working through the difficulties of a data breach, what has become quite clear is that being able to rapidly close the breach, identify the scope of a breach, and having well documented and published corporate policies regarding breaches is imperative to reducing the liability, cost, and business interruption a breach will create.

 

For more information on IT security best practices, or to schedule an audit of your company’s IT infrastructure, call us at 305-278-7100.

 

Comments

No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Guest
Thursday, 21 September 2017
If you'd like to register, please fill in the username, password and name fields.

Mobile? Grab this Article!

Qr Code

Tag Cloud

security Tip of the Week Technology Cloud Best Practices Privacy Microsoft Business Computing Internet software Backup Hackers Hosted Solutions Productivity Business Management Managed Service Provider Malware IT Services Business Google Efficiency Windows Innovation Disaster Recovery IT Support Hardware Workplace Tips Business Continuity VoIP Computer Saving Money Miscellaneous Windows 10 Virtualization User Tips Upgrade Mobile Devices Data Mobile Device Management Server Mobile Computing Email Network Security Communication Network Save Money Microsoft Office Alert communications Quick Tips Information Technology Social Media Smartphones BYOD Going Green Mobile Office Apps Small Business Android Office Smartphone Health Operating System Browser Chrome Outsourced IT Gadgets Application Ransomware Tablet Productivity Firewall Managed IT Services Avoiding Downtime Disaster Risk Management Holiday The Internet of Things Managed IT Cybercrime WiFi Remote Computing Unified Threat Management IT Solutions Telephone Systems Spam Passwords Mobility BDR Search Best Practice Data Management Remote Monitoring History Facebook Cybersecurity Employer-Employee Relationship Budget Hard Drives Saving Time Automation Vendor Management Hacking Wireless Technology VPN Phishing Password Customer Relationship Management Hosted Solution Computers Big Data Law Enforcement Apple Phone System Recovery Proactive IT Marketing Office Tips Collaboration Humor Administration Shortcut Social Wearable Technology Current Events iPhone Maintenance PowerPoint Virus Telephony Printer USB Content Filtering Analytics Office 365 Gmail Router Bring Your Own Device User Error Lithium-ion battery Money Antivirus Data Recovery Computer Repair Laptop Business Intelligence Cloud Computing OneNote Google Drive Save Time Education Trending Net Neutrality Social Engineering Data Backup Users Tech Support Work/Life Balance Windows 8 Private Cloud Outlook Encryption Government App Cost Management Intranet Point of Sale Bandwidth IT COnsultant HaaS Printer Server Wireless Unsupported Software End of Support Travel Efficency Update Customer Service Biometrics Internet Exlporer Retail Data Storage Virtual Reality Internet of Things Social Networking Meetings Identity Theft Display Data Protection Solid State Drive Flexibility Emails Instant Messaging Augmented Reality Paperless Office HIPAA Entertainment Benefits Samsung DDoS Fax Server Wi-Fi Computer Accessories Emergency Workplace Applications Mouse Compliance Streaming Media Uninterrupted Power Supply hacker Personal Information Network Congestion online currency Two-factor Authentication Managing Stress Transportation IT Support SaaS Excel Help Desk Computer Care Battery Robot Audit Automobile Vulnerability ISP IT Technicians Books Video Games Sync Smart Technology SharePoint Document Management iOS Managed IT Service Programming Blogging Data Breach Advertising Legal Adobe Managed IT Services Mobile Device Teamwork Touchpad Computer Fan Website Managed Security Busines Continuity Networking Near Field Communication Licensing Scam Dark Web Screen Mirroring OneDrive Hard Drive Human Resources IT consulting Sports Amazon Employer Employee Relationship Running Cable Co-managed IT Worker Commute Operating Sysytem Cast Uograde Images PDF Scalability Reliable Computing Files Windows 10s Nanotechnology Data Security Ebay Safety Bloatware Text Messaging How To Chromecast Tablets Hard Disk Drive Computing Upgrades Root Cause Analysis HBO Artificial Intelligence Branding Administrator NFL best practices Training Consultant Distributed Denial of Service Wiring Colocation CrashOverride IT Management Information The Blindside Of Company Culture Black Market WIndows 7 Access Word data breach Settings Debate Touchscreen eWaste Politics Inbound Marketing Regulations WIndows Server 2008 IT Security Twitter Cleaning risk management Experience Surge Protector Value Avoid Downtime Cameras Patch Management Keyboard Television 3D Printing User Windows 10 Commerce Music Science Presentation Regulation Nokia Hiring/Firing Virtual Desktop Bluetooth Best Available Data storage Gift Giving Buisness Webinar Taxes Mobile IT solutions Microblogging Supercomputer Youtube Electronic Medical Records Professional Services Sales IT Budget Lifestyle Managed Service Provder Webinar Reputation Tutorial Storage IT service Shadow IT Windows Ink Relocation Domains