Cybersecurity

Lessons from 2017 Enforcement Actions and Guidance

Regulators including the FTC, the Department of Health and Human Services Office of Civil Rights (OCR) — the agency responsible for enforcing the HIPAA rules for protected health information (PHI) — and state attorneys general have issued guidance and announced a number of settlements in data security cases that are instructive about measures that organizations can take to reduce the potential for a data breach or, if a breach does occur, provide appropriate notice.

The security industry all too often sells the next shiny object touted as the Holy Grail of security that protects against all cyber threats. And the following year, the next best thing hits the market and becomes the grail until proven fallible.

In the wake of suits filed against Equifax by consumers, businesses and governmental units, courts will have to grapple with the question of what remedies are appropriate. These issues are not unique to the Equifax incident, but the scope of the breach will undoubtedly lead to more debate than ever before.

Money is a powerful motivator, but it alone wasn't enough to fuel the ransomware epidemic. After all, the first documented ransomware infection was in 1989, but it remained relatively unknown until its resurgence over the past five years. So what changed? In short, bitcoin.

“There's really no such thing as the cloud, there are only other people's computers.” This may have been true at first; but it is now worth some investigation if the present threat environment today demands a secure cloud.

With expectations for an always-on law firm, significant challenges within the legal industry to maintain competitiveness and perform due practice for cybersecurity and other disaster scenarios come from both clients and regulatory bodies. A comprehensive approach with an end-to-end availability strategy is imperative to mitigate the threats of downtime. And yet, this is easier said than done.

Because there are so many new digital channels for possible intellectual property infringement, knowledge of the various mechanisms available to combat the issue is vital to enabling entertainment industry owners to protect their brand.

This is not the first time that a credit reporting agency has been breached, nor is it the first time that Equifax has reported a breach. What is different with the current breach is its size and the nature of information compromised, as well as the implications of the breach in light of the increasingly complex web of cybersecurity regulations nationwide.