On Friday, August 14, 2020, the California Office of Administrative Law (OAL) approved the California Office of the Attorney General’s (OAG) final CCPA regulations and filed them with the California Secretary of State (SOS). The regulations were immediately effective. Notably, the final text of the regulations submitted to the SOS was modified from the one filed with the OAL. The OAG published an Addendum to the Final Statement of Reasons setting forth the changes. Many of the changes are stylistic and grammatical. However, some of the changes are substantive and will impact compliance efforts. The most notable changes are discussed below.
Whether you are a small enterprise, a large corporation, or something in between, phishing is one of the most damaging and vicious threats that you have to prepare for. It is so serious that security analysts predict it will be their topmost concern. As per Verizon 2019 DBIR, phishing has emerged as the leading cause of data breaches across companies, and there is a worrying rise in the number of phishing attacks. This is all the more reason for companies to step up their security to identify how to prevent phishing.
Wells Fargo & Company announced the appointment of six new Corporate Risk leaders as part of its enhanced Risk model to further strengthen the independent oversight of all risk-taking activities and a more comprehensive view of risk across the company.
With a Private CA (or “Private PKI”) solution, you can brand the certificates for your servers, devices, and users. Since the purpose of this CA is to serve your organization only, it will provide a tighter control when its Public Key Infrastructure (PKI) is used for internal user authentication. For this reason, Private PKI is immensely popular for deployment in enterprise IT, as well as cloud-native DevOps and Internet of Things (IoT) environments.
Risk Based Security released their 2020 Mid Year Data Breach QuickView Report, revealing that although the number of publicly reported data breaches stands at its lowest in five years, the number of records exposed is more than four times higher than any previously reported time period.
Contact tracing for COVID-19 is critical to returning our nation to some semblance of normalcy, but we are far from a consensus on what effective, secure, cost-feasible and scalable contact tracing looks like. There are several documented, meaningful automated contact tracing efforts across the globe - not to mention more than 150 apps and initiatives in various stages of development. Getting contact tracing off the ground in the US is fraught with obstacles that are formidable, but not insurmountable. Among the thorniest is data privacy: if we can’t convince citizens that it’s safe and non-invasive to share information about who they’ve been in touch with, contact tracing will fail.
Over the past few months, millions of workers have turned their homes into their new, remote office, including state government employees, which brought a host of risks through use of unsecured Wi-Fi and poor access controls. This shift toward home as well as the underlying panic brought on by COVID-19 altered hackers’ focus and targets aimed at the remote worker. Chief Information Security Officers (CISO) preparing their companies for this change require time, training for employees and the right technology, as well as increased cooperation between the security teams and IT/network operations groups.
In her “Top Breaches of 2019”, a security journalist asked if last year would “…be the worst on record?” It looks like 2020 could surpass last year’s breaches, but it’s not entirely due to consequences of the global pandemic. For sure, unprecedented levels of remote working has emboldened hackers to exploit new vulnerabilities, but there’s one very insidious risk that shows up year after year: the silent and unwitting exposure of sensitive data that no one notices… until it’s too late.
