As the Feds Drag Their Feet on Data Privacy Laws, States Press On

Unlike the GDPR, the CCPA is not a national data privacy law. It applies only to residents of California, and only when they are physically present in California. If a California resident shares their data while on vacation in Florida, the CCPA does not apply. However, the state is an economic juggernaut that exerts influence far beyond its own borders. California is home to 12% of the U.S. population and is the world’s fifth-largest economy, surpassing the United Kingdom.

Additionally, the CCPA was passed in an era where massive data breaches occur daily, and consumers are growing increasingly concerned about what data companies are collecting on them, why, and what is being done with it. Nearly three-quarters of internet-using U.S. households have data privacy and security concerns, and at least one-third have been deterred from certain online activities due to these fears. The federal government has been slow to act on data privacy, so states have taken matters into their own hands. The CCPA, along with the GDPR, prompted a flurry of new and amended state-level data privacy legislation in 2018. All 50 U.S. states, along with Washington, D.C., Puerto Rico, the U.S. Virgin Islands. and Guam, now have data breach notification laws on the books.

If a patchwork quilt of state-level laws with varying requirements sounds like a data privacy compliance nightmare, consider this: It turns out California was only getting started with the CCPA. In September, it became the first state to pass a cyber security law specifically regulating IoT devices, requiring that all manufacturers of smart devices located in California, or those who have devices manufactured on their behalf for sale in California, equip their devices with “reasonable” security features.

Consumer anger over data privacy violations and organizational hand-wringing over the logistics of complying with dozens of different state laws (in addition to the GDPR, HIPAA, PCI DSS, and other mandates) appear to have finally lit a fire under the feds’ feet. In a September 26 Congressional hearing on data privacy, every member of the Senate Commerce Committee, Democrat and Republican, agreed with six major tech and telecom companies that a federal data privacy framework is needed. NIST has launched a collaborative project to develop a voluntary privacy framework, and in a separate project, the NTIA has published a request for public comment in the Federal Register on a set of data privacy principles to inform a domestic legal and policy approach to consumer data privacy.

Complying with Today’s Data Privacy Laws – and Tomorrow’s

Good data privacy is good business. When designing and implementing data privacy protocols and procedures, organizations shouldn’t try to skate by on the minimum requirements; look to go beyond them. Best practices to follow include:

Develop and maintain clear, concise data governance, security, and privacy policies and procedures, and put them in writing. Because legislation, technology, and the cyber threat environment are in constant flux, periodically review your organization’s policies and procedures and update them as necessary.

Practice proactive cyber security principles. Most data breaches and other cyber attacks can be prevented.

Practice minimal data collection and storage. If you don’t absolutely need a piece of information about a customer or an employee, do not collect it.

Develop clear, written processes and procedures to handle customer inquiries regarding their data, such as requests to opt out of data collection or data sharing.

Build an organizational culture of security and privacy from the top down. Ensure that all employees are properly and continuously trained on data security, governance, privacy, and compliance.

Develop a comprehensive incident response plan, including a data breach notification protocol.

Don’t rely on spreadsheets or other manual processes for data security, governance, risk management, and compliance. Use a GRC automation solution such as Continuum GRC’s IT Audit Machine (ITAM).

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

While digital currencies, particularly bitcoin, are the most common and well-known application of blockchain technology, they are far from being the sole or even the most important use. Blockchain is one of the most important technological advancements of the digital age, and its full potential has barely been tapped. Among the most exciting potential uses for this technology are cyber security and compliance applications.

5 Practical Applications of Blockchain to Cyber Security and Compliance

What Is Blockchain?

At its simplest, a blockchain is a digitized, distributed public ledger. While it was originally developed to keep track of bitcoin transactions, it can be used for any sort of record-keeping, from health records to the requirements of a business contract. Each record (called a block) contains a cryptographic hash of the previous block, a timestamp, and transaction data, and the blocks are linked using cryptography.

Typically, a blockchain is managed by a peer-to-peer network that collectively adheres to a protocol for inter-node communication and the validation of new blocks. Once recorded, blockchain data is immutable. Blocks cannot be deleted, and if data is altered on a single block, those alterations must be verified with the rest of the chain. Hacking one entry in a blockchain ledger requires hacking every single transaction that precedes or follows it – and every change made to a block is appended with a digital signature or timestamp showing who did it and when. Finally, because the blockchain is distributed, it is not and cannot be controlled by a single entity, and there is no central point of access or failure.

It’s not difficult to envision the potential benefits of these features for cyber security and compliance. It would be extremely difficult to breach the data on a blockchain ledger or launch a DDoS attack against a blockchain DNS system. Because the records are immutable, data integrity is assured.

Practical applications of blockchain technology to cyber security and compliance include:

Identity Theft Prevention

Even in our digital age, reliable identity verification remains a problem. We establish we are who we say we are using one or multiple hard-copy documents or electronic records, from driver licenses to Social Security Numbers. All these records are highly prone to theft and forgery; even children are being victimized by identity theft. Using blockchain, we will be able to combine our current forms of identification into a “blockchain ID.” Instead of brandishing documents to verify their identities, people will produce a secure, immutable public key generated by a blockchain ledger. This will allow consumers to verify their identities without having to share their personal data, simplify identity authentication and make it more secure, and prevent identity theft.

Securing Healthcare Records

Just as it can secure our identities, blockchain can be used to secure our personal healthcare records and make sharing them easier and safer. Electronic health records (EHR) systems are major targets for cyber criminals, and there is still no secure, efficient way for healthcare providers to share patient data; patient records are scattered in different systems run by different facilities and providers.

EHR systems built on blockchain technology will benefit both providers and patients. Patients will have a comprehensive and secure record of their healthcare that is continually updated and can be easily and securely shared with providers. Providers will be able to access patient data more quickly, reduce medical errors caused by inaccurate or missing data, and have an easier time complying with HIPAA and other data privacy regulations.

Smart Contracts

Organizations worldwide are losing millions to business email compromise (BEC) scams. The U.S. Securities & Exchange Commission recently investigated a series of BEC attacks where hackers impersonated either a company executive or an outside vendor and convinced unwitting employees to wire money or pay invoices to accounts that the hackers controlled. In some cases, the victims had no idea they’d been tricked until the real vendor contacted them about the invoices being past due. Each organization lost at least $1 million, and two lost more than $30 million.

Smart contracts, also known as self-executing contracts, blockchain contracts, or digital contracts, will help prevent these types of BEC scams. Smart contracts are embedded with an if-this-then-that (IFTTT) code that automatically executes the contract’s terms once its conditions are met; for example, once a vendor completes work or delivers goods to a buyer, the vendor is automatically paid, and changing the payment account data would require validation from the entire chain.

Secure International Payments

Many organizations work with vendors located overseas. Currently, transferring money overseas is slow, cumbersome, expensive, and prone to error and criminal activity. A blockchain-powered payments system produces a secure, immutable ledger showing where the funds are and whose hands they are passing through, every step of the way.

Compliance Audit Trails

The immutability of blockchain records equates to a verified chain-of-trust and proof-of-process for compliance. Organizations can prove that they have secured their customers’ data and that they have followed specific business processes. Auditors and regulators can be assured of the integrity of an audit trail produced by a blockchain-powered system.

For all its promise, blockchain is not a panacea, and many of its potential applications are still theoretical or have kinks that need to be ironed out. However, it’s safe to say that the future of cyber security and compliance will be built on blockchain.