Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
New Legislation Builds on California Data Breach Law
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/28/2019 | 9:19:24 PM
Re: RIGHT - Pass a law, that will fix it
100% agree with your post. Also, enjoyed the disclaimer. :)
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/27/2019 | 2:08:53 PM
Re: RIGHT - Pass a law, that will fix it
This law was passed late last year. It does not go into effect until 2020 (absent an amendment delaying its effective date).

Companies have time -- big or small.

That said, someone earnestly trying their best is going to fare better than someone who just screwed up big time and doesn't seem to care.

 

(Disclaimer: This comment/post is provided for informational, educational and/or entertainment purposes only. Neither this nor other posts here constitute legal advice or the creation, implication or confirmation of an attorney-client relationship. For actual legal advice, personally consult with an attorney licensed to practice in your jurisdiction.)
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/27/2019 | 11:12:15 AM
Re: RIGHT - Pass a law, that will fix it
@Joe, definitely understandable. The upstarts are just starting to gain footing, if they are lucky enough. Not sure if there already is but for scenarios like an upstart would you think it wise to delay enforcement of those regulations as long as their is a valid corporate roadmap towards implementing them?

Or would you see it as, regardless of corporate titan or company upstart a company is a company and they all have to follow the same rules?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/27/2019 | 11:07:44 AM
Re: Systemic Change
Apologies, I should have specified. When I stated encrypt your data it should be scoped encryption. It is folly to try to encrypt all data. Specifcally you should encrypt sensitive data. But to ensure that you scope is accurate it needs to be segmented. 

I 100% concur that encrypting all data is implausible.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/26/2019 | 10:37:23 PM
Re: RIGHT - Pass a law, that will fix it
@Ryan: Moreover, as my home-state governor Charlie Baker put it when keynoting ThingWorx a few years back, big mega-corporations secretly love regulations (to some extent) because they're the only ones that can afford to keep up with them -- while scrappy upstarts are driven out of business.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/26/2019 | 10:35:16 PM
Re: Systemic Change
It remains to be seen, though, if federal data-breach notification laws will come into play -- and preempt preexisting state laws on that front.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 11:01:34 AM
Re: Systemic Change
A law that wholesale forbids any but the strictest security practices could undermine the Business Judgement Rule. That makes sense. That is why having the balance becomes more important. There business that may them secure and provide services, I say Google is one of them as long as you do not consider privacy a major issue.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 10:58:40 AM
Re: Systemic Change
Moreover, as much as I like security, it can't be forgotten that security and accessibility are at constant odds with each other It actually makes sense when you consider CIA. Keeping the balance between confidentiality, integrity and availability what makes security.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 10:56:38 AM
Re: Biometrics
I'd anticipate that biometric-data clause getting fought tooth and naiL Yes, it makes sense. As we are using it more and more (such as FaceID) there will be more regulations around it.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
2/26/2019 | 10:54:33 AM
Re: Systemic Change
"Oh, we are sorry we lost your data but we did tell you quicker then we use to" Yes, I hear you. That would be just not convincing and not helpful at all.
Page 1 / 2   >   >>


Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-24376
PUBLISHED: 2021-06-21
The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory w...
CVE-2021-24377
PUBLISHED: 2021-06-21
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on t...
CVE-2021-24378
PUBLISHED: 2021-06-21
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute w...
CVE-2021-24379
PUBLISHED: 2021-06-21
The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some...
CVE-2021-24383
PUBLISHED: 2021-06-21
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue