Risk

9/26/2018
03:00 PM
50%
50%

SEC Slams Firm with $1M Fine for Weak Security Policies

This is the first SEC enforcement cracking down on violation of the Identity Theft Red Flags Rule, intended to protect confidential data.

The Securities and Exchange Commission (SEC) has issued a $1 million fine against a Des Moines-based organization for failing to implement sufficient security policies related to an incident that compromised personal data belonging to thousands of customers.

Voya Financial Advisors, Inc. (VFA), a broker-dealer and investment adviser, was charged with violating the Safeguards Rule and Identity Theft Red Flags Rule, both of which are intended to protect personal data and protect customers from identity theft. This marks the first time the SEC has enforced the Identity Theft Red Flags Rule with a penalty against an offending firm.

For six months in 2016, cyberattackers impersonated VFA contractors by calling the firm's support line and requesting to reset passwords. With new passwords, the actors were able to gain access to personal data of 5,600 VFA customers. The SEC found the attackers used this information to create new online user profiles and gain unauthorized access to account documents. Its order states the VFA failed to shut down attackers' access due to weaknesses in its security procedures, and it also failed to ensure the security of contractors' systems.

VFA has agreed to pay the $1 million fine and will consult an independent expert to evaluate its policies and procedures, and ensure future compliance with both rules, the SEC reports.

Read more details here.

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/28/2018 | 9:41:46 AM
Reset password
For six months in 2016, cyberattackers impersonated VFA contractors by calling the firm's support line and requesting to reset passwords. This is a common problem, social engineering. Hard to prevent from in certain situations unles a good training program.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/28/2018 | 9:37:15 AM
Re: First of many
Fines are usually laughed off. I aggee better to have a fine that hurts otherwise it will be ok for most companies, they keep paying the fines instead of implementing security measures.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/28/2018 | 9:35:33 AM
Re: First of many
only a change in the C-Suite attitude of risk will do that and have resources allocated AND IMPLEMENTED FOR AGGRESSIVE MALWARE HUNTING and security walls. That is true but to change executives mind we need to have evidence of the troubles.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/28/2018 | 9:34:15 AM
Re: First of many
But fines won't fix the problem That is true but we need to start somewhere.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/28/2018 | 9:33:21 AM
Weak Security Policies
This is good news as organizations are going to think twice when they avoid cost of security implementations.
Sportialize
50%
50%
Sportialize,
User Rank: Apprentice
9/26/2018 | 5:53:58 PM
Re: First of many
Totally true !
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/26/2018 | 3:40:47 PM
First of many
But fines won't fix the problem - only a change in the C-Suite attitude of risk will do that and have resources allocated AND IMPLEMENTED FOR AGGRESSIVE MALWARE HUNTING and security walls.  Fines are usually laughed off.  And watch the SEC be hacked soon too as they are a GOVERNMENT body probaby running S/370 IBM MAINFRAMES too.  
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8396
PUBLISHED: 2019-02-17
A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2."
CVE-2019-8397
PUBLISHED: 2019-02-17
An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_close_real in H5T.c.
CVE-2019-8398
PUBLISHED: 2019-02-17
An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_get_size in H5T.c.
CVE-2019-8400
PUBLISHED: 2019-02-17
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.
CVE-2019-7399
PUBLISHED: 2019-02-17
Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.