Digital Padlock on Circuit Background - Web Security Concept

California adopted the first data breach notification law in the nation in 2002, and has consistently worked to ensure that its law remains at the forefront of data security laws in the United States.  California burnished this reputation on September 13, 2016, when Governor Jerry Brown signed AB 2828, sponsored by Legislator Ed Chau.  This law amends California’s data breach notification law, Civil Code Section 1798.82, by making significant changes to the reporting requirements for businesses who hold personal information that has been compromised.

Prior to the adoption of AB 2828, California, like most other states, did not require businesses to disclose breaches where “encrypted” information is breached.  AB 2828 will, effective January 1, 2017, require businesses to disclose breaches when encrypted information has been acquired in an unauthorized breach if the encrypted data is leaked together with the encryption key or security credential that “could render that personal information readable or useable.”

Encryption Safe Harbor

The exception for encrypted personal data has been part of California law since its adoption; however, it had a potentially significant flaw:  even if the key to encrypted data was disclosed, making it readable by hackers and other bad players, the business was not obligated to issue a notice to affected individuals.  In other words, even when encrypted information was, in fact, readable, a business was not required to report a breach.  The result was that some individuals whose personal information was disclosed never received notice and could not take steps to protect their financial information or identity.

The Electronic Frontier Foundation, in support of AB 2828, said that “AB 2828 would fill an important gap in California’s current data breach notification law.  A thief might steal an encrypted laptop, along with a note carelessly taped to the device stating the decryption password.  Or a thief might remotely steal encrypted data, and later use social engineering to acquire the security credentials. In these and many other circumstances, wrongdoers will acquire both encrypted personal information and the power to decrypt that information.  In such circumstances, people should be notified that they are at risk of wrongdoers misusing their personal information.”

When AB 2828 becomes effective, that data that has been converted into code so as to be readable only by those who have the encryption key to decode it will be subject to the broad terms of California’s disclosure law.  While AB 2828 patches a potential flaw in the law – encrypted data is no longer protected if one holds the key – it also creates a challenge for many businesses. Continue reading

I’m attending the Arthur J. Gallagher Risk Management Roundtable on September 12 and 13 at the Intercontinental Hotel  in New Orleans, where Alex Ricardo of Beazley and I will be speaking on Cybersecurity in the Hospitality Industry tomorrow morning.  I’ll be leading a discussion of the unique privacy and security issues facing hotels, managers and owners, the legal issues facing hotels, director and officer concerns, and the importance of preparing for the inevitable breach.

Cybersecurity is one of the biggest issues facing hotels – barely a day goes by without the report of another hotel chain being targeted, and for good reason; hotels have many of the openings that hackers look for, including multiple systems, wide access to WiFi (with limited or no security), valuable data, large numbers of employees and vendors with access to hotel systems, and customers that, unwittingly, can aid in carrying out a breach.

If you are interested in a copy of my presentation, you can reach me at rbraun@jmbm.com.

 

3679571-business-peopleParalysis is one of the biggest obstacles to achieving a cybersecure environment.  Companies are often unable to take the steps necessary to bring security to an enterprise. It’s not only common; it’s entirely understandable.

Achieving cybersecurity appears to be an overwhelming task. Every day brings another headline announcing a data breach, or reports on the enormous cost of data breaches – one has to wonder if implementing a cybersecurity regime would even achieve its goal. Companies are challenged by the complexity of their systems and the seemingly impenetrable jargon used to describe them.  Funding a cybersecurity program is a challenge – as one CEO put it, “I gave my team an unlimited budget, and they exceeded it.”  Spending valuable time and scarce resources on security takes away from operations that ground an enterprise. Companies fear that focusing on cybersecurity can only come at the expense of their core operations.

Continue reading

Digital Padlock on Circuit Background - Web Security Concept

Spring is the season for many things, including the publication of cybersecurity surveys. In the past few months, Verizon has published its Data Breach Investigations Reports, Ponemon Institute Published its 2016 Study on How Organizations Manage Data Breach Exposures, the California Attorney General published its annual California Data Breach Report, and a variety of others have published reports describing the state of cybersecurity and privacy, and the threats individuals and businesses face in online security. While the reports each contain important facts and focus on different aspects of cybersecurity, they also have some key lessons for enterprises that focus on risk reduction:

Continue reading

Businessman drawing a circle around people icons - Marketing and consumer target groups conceptIn Michael Gold’s commentary, “Still Only Human,” published in the July 18, 2016 edition of the Los Angeles Business Journal, he writes:

“Cybercrime cost the world economy about $500 billion in 2015 and this year’s numbers will be even higher. The cost of data breaches is projected to reach $2.1 trillion globally by 2019. Worldwide spending on information security is estimated to have been $77 billion last year. In the midst of these astounding numbers, the role of the “human factor” gets lost. This is a frightening fact.”

Large companies can spend a small fortune on cyber defense. But Gold points out that cybersecurity is not just a “tech” issue – it is a “human” issue, as well. One careless or uninformed employee can click on a link that gives hackers access to sensitive personal and financial data, as well as a company’s vital intellectual property.

Continue reading

Cursor Hand On Key Background Showing Blank Copy space Click Here

Cybercrime cost the world economy about $445 billion in 2014 and the 2015 numbers will be even higher. The cost of data breaches will reach $2.1 trillion globally by 2019. Worldwide spending on information security is estimated to reach $77 billion in 2015. In the midst of these astounding numbers, the role of the “human factor” has gotten lost. This is a frightening fact. Why? Because “they will click.” A breach is just one click away – a single person can and will overcome any technological safeguard. This is an unassailable reality, but one that gets mostly lip service by companies.
Continue reading

Co-chairs of the Jeffer Mangels Cybersecurity and Privacy Group, Robert E. Braun and Michael A. Gold, discuss why companies need a cybersecurity training program. The other videos in this 4-part series include: First steps to take when there’s a data breach at your company; Cybersecurity for middle market companies; and Impact of international privacy laws on U.S. companies.

Continue reading

Co-chairs of the Jeffer Mangels Cybersecurity and Privacy Group, Robert E. Braun and Michael A. Gold, discuss Impact of international privacy laws on U.S. companies. The other videos in this 4-part series include: Why companies need a cybersecurity training program; First steps to take when there’s a data breach at your company; and Cybersecurity for middle market companies.
Continue reading

Co-chairs of the Jeffer Mangels Cybersecurity and Privacy Group, Robert E. Braun and Michael A. Gold, discuss the first steps to take when there’s a data breach at your company. The other videos in this 4-part series include: Why companies need a cybersecurity training program; Cybersecurity for middle market companies; and Impact of international privacy laws on U.S. companies.
Continue reading

Co-chairs of the Jeffer Mangels Cybersecurity and Privacy Group, Robert E. Braun and Michael A. Gold, discuss cybersecurity for middle market companies. The other videos in this 4-part series include: Why companies need a cybersecurity training program; First steps to take when there’s a data breach at your company; and Impact of international privacy laws on U.S. companies.

Continue reading