(July 12, 2023) – Consider This

SEC Needs Another Second. On June 6, 2023, the U.S. Securities and Exchange Commission (SEC) received feedback from industry stakeholders regarding its proposed cybersecurity rules, delaying provision of the final rules until October 2023. Certain banking groups criticized the rules for being too complicated and creating potential enforcement and litigation traps. Wall Street reform groups lauded the rules.

Bipartisan Bill Aimed To Help Hospitals On Life Support. On June 14, 2023, the Senate Homeland Security and Governmental Affairs Committee approved legislation to assist rural hospitals in contending with cybersecurity personal shortages.

Reduce The Attack Surface, And That's An Order. On June 15, 2023, the Cybersecurity and Infrastructure Security Agency issued an order revealing that federal agencies will have 14 days to respond to any reports from CISA about misconfigured or Internet-exposed networking equipment. The directive applies to any networking devices — such as firewalls, routers, and load balancers — that allow remote authentication or administration.

NYDFS, Take Two. On June 28, 2023, the New York State Department of Financial Services (NYDFS) published its proposed second amendment to the existing cybersecurity requirements for banks, insurance companies, and other financial services institutions. Among other proposed changes, the amendment will impose new (1) obligations on "Class A" companies, (2) notification requirements, (3) governance obligations, and (4) enforcement provisions. The comment period for this second amendment closes in August 2023.

Zero Vulnerability

Barracuda Hits a Sour Patch. Barracuda advises customers to replace – and not simply patch – the compromised Email Security Gateway appliances.

Move It MOVEit. The Clop Ransomware Group began exploiting the critical SQL injection vulnerability in MOVEit Transfer on May 27 and in some cases has taken data within minutes of deploying the web shells.

As The World Turns

Airbnb For Email? To help reduce the time and cost of creating email accounts for large spam campaigns, cybercriminals are now paying individuals to rent access to their email accounts.

Numbers Don't Lie. Obvious news item of the day: Cybercrime is up. According to the FBI Internet Crime Report, cyber losses in 2002 reached $10.3 billion.

Ransomware Costs Rise. The second obvious news item of the day: The average cost of a ransomware attack increased.

Open RDP Honeypot Stings Would-Be Threat Actors. GoSecure researchers created a honeypot to attract threat actors. The research revealed over 37,000 daily attacks and nearly 3.5 million login attempts.

USA! USA! According to Abnormal Security, between June 2022 and May 2023, European organizations experienced a higher volume and frequency of BEC attacks compared to those in the U.S.

Did You Know?

You can subscribe to or visit Vulnerability Bulletins for Cybersecurity and Infrastructure Security Agency to obtain a weekly summary of new vulnerabilities.

Privacy Corner

CCPA Enforcement Delayed. Despite the scheduled implementation of the California Privacy Rights Act (CPRA) regulations on July 1, 2023, a tentative ruling by the Superior Court for the County of Sacramento on June 29, 2023 has temporarily prevented the California Privacy Protection Agency (CPPA) from enforcing the CCPA regulations for one year after their enactment.

Now In Effect:

Colorado Privacy Act. On July 7, 2021, Governor Polis signed Senate Bill 21-190: Protect Personal Data Privacy establishing the Colorado Privacy Act (CPA). The proposed draft rules for the CPA were published by the Secretary of State on Oct. 10, 2022, and the final rules were filed with the Secretary of State on March 15, 2023. The CPA is a part of the State of Colorado's Consumer Protection Act and went into effect on July 1, 2023. The Attorney General's Office and District Attorneys have sole enforcement power under the CPA. Each violation of the CPA is a deceptive trade practice that can result in a civil penalty of $20,000.

Connecticut Data Privacy Act. On May 10, 2022, Governor Ned Lamont signed Senate Bill 6: An Act Concerning Personal Data Privacy and Online Monitoring (also known as The Connecticut Data Privacy Act or CTDPA). The CTDPA took effect on July 1, 2023. The Attorney General has exclusive authority to enforce violations of CTDPA. Entities or individuals that violate the CTDPA may face civil penalties up to $5,000 per violation. In addition to civil penalties, the Attorney General can also seek injunctive relief, restitution, and/or disgorgement.

US finalizes EU-US Data Privacy Framework Requirements, Awaits EU Adequacy Decision. U.S. Secretary of Commerce Gina Raimondo issued the following statement regarding the European Union-U.S. Data Privacy Framework: "Today, the United States has fulfilled its commitments for implementing the EU-U.S. Data Privacy Framework (EU-U.S. DPF) announced by President Joe Biden and European Commission President Ursula von der Leyen in March 2022. This represents the culmination of months of significant collaboration between the United States and the EU and reflects our shared commitment to facilitating data flows between our respective jurisdictions while protecting individual rights and personal data.

Keep An Eye Out For:

Delaware Personal Data Privacy Act (DPDPA). On June 30, the Delaware General Assembly approved a comprehensive privacy bill, HB 154. This bill applies to businesses that manage or handle personal data from over 35,000 consumers or generate 20% of their revenue by selling the data of more than 10,000 consumers. Nonprofit organizations are not exempted under this bill, and it includes a 60-day cure provision that will expire on December 31, 2025. Subject to the governor's approval, HB 154 will come into effect on January 1, 2025.

Utah Consumer Privacy Act. On March 24, 2022, Gov. Spencer Cox, R-Utah, signed the Utah Consumer Privacy Act (UCPA) into law. The law goes into effect on Dec. 31, 2023. The scope of the UCPA is more narrow compared to other state privacy laws due to the annual revenue threshold requirement of $25,000,000.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.