Data Protection: Key Takeaways for Consumers and Businesses After the Facebook and Cambridge Analytica Scandal

Scot GanowBy Scot Ganow on Posted in Data Breach, Privacy Policy

In a local news interview, I was recently asked to comment on the Facebook-Cambridge Analytica story involving the unauthorized use of Facebook user profile information by Cambridge Analytica for profiling and targeting purposes. The focus of the interview was what consumers can do to better protect themselves. However, there are learning opportunities for businesses too. Here are some quick points to consider for both parties.

Consumers

  1. Your choices matter most. I beat this drum pretty heavily, but it is
… Read More

Data security: The bad guys are stepping up their game. Are you?

Jocelyn ConeyBy Jocelyn Coney on Posted in Cyber Security, Phishing attack

Earlier this year, there was a report on a new spear-phishing attack seeking to steal people’s sensitive data.  The spear-phishing email message, apparently drafted to look like it came from FedEx, included a link that took the recipient of the email to a Google Docs page and then used a script to download malware to the employee’s computer. What was notable about this spear-phishing attempt was that the email “bait” actually included employee sensitive data, such as his or her … Read More

What’s in a notice? Privacy notices under the GDPR

Cara JohnsonBy Cara Johnson on Posted in data privacy, Privacy Policy

U.S. privacy law is based on the principles of notice and consent – for instance, under FTC and state consumer protection laws, consumers given fair notice and the opportunity to consent generally cannot complain about the use of their data.

But as we have noted in prior posts, the E.U.’s General Data Protection Regulation (“GDPR”), which will become effective May 25 of this year, is more comprehensive than any U.S. privacy law in most respects. It treats personal data (defined … Read More

The Enemy Within: Why Employees Top the List of Security Risks Each Year (and what you can do to make sure yours don’t)

Scot GanowBy Scot Ganow on Posted in Cyber Security

Every year, the culprit that tops the list of information security risk is the same one from the previous year, and the year before that: your employees. Sure, hackers and technical failures get a lot of attention, but time and again it is the low-tech failures of employees that lead to security incidents and data breaches. To be clear, it is rarely the disgruntled employee, but more often the apathetic or unaware employee that clicks the phishing link or lets … Read More

GSA is Updating its Cybersecurity and Incident Reporting Requirements

William C. WagnerBy William C. Wagner on Posted in GSA

Beginning in April 2018, the General Services Administration (GSA) will publish for 60 days of public comment updates to its cybersecurity requirements for eventual integration into the GSA Acquisition Regulation (GSAR). [GSAR Case 2016-G511, Information and Information Systems Security, 83 Fed. Reg. 1941 (Jan. 12, 2018).] Then, beginning in August 2018, the GSA will publish for 60 days of public comments updates to its cyber incident reporting requirements for GSA contractors. [GSAR Case 2016-515, Cyber Incident Reporting, 83 F.R. 1941 … Read More

NIST SP 800-171 Resources for Government Contractors

William C. WagnerBy William C. Wagner on Posted in NIST Guide

There are several helpful resources for contractors looking to comply with the National Institute of Standards and Technologies Special Publication 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.” To help contractors meet the requirements, NIST recently issued NIST Handbook 162, entitled “NIST MEP Cybersecurity Self-Assessment Handbook For Assessing NIST SP 800-171 Security Requirements in Response to DFARS Cybersecurity Requirements.”  The Handbook provides a step-by-step guide to assessing a manufacturer’s information systems against the security requirements in … Read More

When can a policyholder select defense counsel in Indiana?

William C. WagnerBy William C. Wagner on Posted in Defense Counsel, Insurance

It seems like I get this question once every couple of months.

Hey Bill, my company just got sued. After paying premiums for years, I finally had to make a claim. My insurance company wrote me a “reservation of rights” letter. They offered to have one of their “panel counsel” defend my company, but then they listed 15 reasons why they don’t need to cover the lawsuit, including that there is no “covered claim,” the event was not an “occurrence” … Read More

Join us for a Data Breach Response Event in Indianapolis on Feb. 21

Taft LawBy Taft Law on Posted in Data Breach

Join Taft and Sikich for an informational session on Feb. 21 as two of our professionals share their experiences before and during a data breach and share their insights in the hopes of helping you better prepare for and survive a data breach. Register here.

Schedule:
3:30 – 4:00pm Registration & Networking
4:00 – 5:00pm Presentation
5:00 – 6:00pm Networking, drinks & hors d’oeuvres

Presenters:

Scot Ganow, Senior Counsel – Taft Stettinius & Hollister LLP
Scot is co-chair of … Read More

Data Privacy Day is January 28. Who knew, right?

Scot GanowBy Scot Ganow on Posted in data privacy

Well, if Star Wars (May 4) and doughnuts (first Friday in June) can have their own day, you would hope a day might be dedicated to reminding us all about the importance of privacy and increasing awareness of ways we can empower ourselves and our clients to better use and protect personal information. Data Privacy Day began as Data Protection Day in Europe. The day commemorates the signing of Convention 108, the first legally binding international treaty dealing with privacy … Read More

Don’t Fall for the W-2 Phishing Scam This Year!

Neal Roach Jr.By Neal Roach Jr. on Posted in Phishing attack

Income tax season is arriving, and your company will soon be issuing W-2 forms to all of its employees. Now is a good time to remind all payroll and human resources personnel that a W-2 phishing scam, which has been around for a couple of years, is likely to arise again this year.

This phishing variation is known as a “spoofing” e-mail. It will contain, for example, the actual name of the company chief executive officer. In this variation, the … Read More

LexBlog