Chapter 6: Information Security and Data Breach Notification Laws

Question 1

Information Security assessment must be consistent with what 3 key attributes?

Answer 1

1. Confidentiality—access to data is limited to authorized parties
2. Integrity—assurance that the data is authentic and complete
3. Availability—knowledge that the data is accessible, as needed, by those who are authorized to use it

Question 2

What are Security Controls?

Answer 2

Security controls are mechanisms put in place to prevent, detect, or correct a security incident.

Question 3

What are the 3 types of Security Controls?

Answer 3

1. Physical controls—such as locks, security cameras, and fences
2. Administrative controls—such as incident response procedures and training
3. Technical controls—such as firewalls, antivirus software, and access logs

Question 4

Which state enacted the first data breach notification law?

Answer 4

California in 2003, AB 1950

Question 5

What does AB 1950 require as it relates to Information Security?

Answer 5

That companies “implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.”

Question 6

What companies are exempt from AB 1950?

Answer 6

Companies already subject to greater information security requirements such as the Gramm-Leach-Bliley Act, (GLBA) or Health Insurance Portability and Accountability Act (HIPAA)

Question 7

What constitutes reasonable security procedures and practices?

Answer 7

CSC Top 20 according to the CA AG

Question 8

Which state, arguably, has the most prescriptive security law?

Answer 8

Massachusetts, 201 CMR 17.00

Question 9

What are the 10 things the Mass security law requires?

Answer 9

1. Designate an individual who is responsible for information security
2. Anticipate risks to personal information and take appropriate steps to mitigate such risks
3. Develop security program rules
4. Impose penalties for violations of the program rules
5. Prevent access to personal information by former employees
6. Contractually obligate third-party service providers to maintain similar procedures
7. Restrict physical access to records containing personal information
8. Monitor the effectiveness of the security program
9. Review the program at least once a year and whenever business changes could impact security
10. Document responses to incidents

Question 10

What are the 8 types of Data Breach Incidents?

Answer 10

1. Unintended disclosure—sensitive information posted publicly on a website, mishandled or sent to the wrong party via email, fax or mail
2. Hacking or malware—electronic entry by an outside party, malware and spyware
3. Payment card fraud—fraud involving debit and credit cards that is not accomplished via hacking; for example, skimming devices at point-of-service terminals
4. Insider—someone with legitimate access, such as an employee or contractor, intentionally breaching information
5. Physical loss—lost, discarded or stolen nonelectronic records such as paper documents;
6. Portable device—e.g., lost, discarded or stolen laptop, PDA, smartphone, portable memory device, CD, hard drive, data tape
7. Stationary device—lost, discarded or stolen stationary electronic device such as a computer or server not designed for mobility
8. Unknown or other

Question 11

What is the first step in incident management?

Answer 11

The first step in incident management is determining whether a breach has actually occurred.

Question 12

What is the second step in incident management, if a breach has occurred?

Answer 12

The second step is containment and analysis of the incident.

Question 13

What is the third step in incident management?

Answer 13

The third step in incident management is to notify affected parties.

Question 14

What is the fourth step in incident management?

Answer 14

The fourth step is to implement effective follow-up methods, such as additional training, internal self-assessments and third-party audits where needed.

Question 15

What is the framework the Office of the President’s Office of Management and Budget (OMB) gave for a security breach plan?

Answer 15

• Designate the members who will make up a breach response team
• Identify applicable privacy compliance documentation
• Share information concerning the breach to understand the extent of the breach
• Determine what reporting is required
• Assess the risk of harm for individuals potentially affected by the breach
• Mitigate the risk of harm for individuals potentially affected by the breach
• Notify the individuals potentially affected by the breach

Question 16

What should organizations ensure that vendors are contractually required to do?

Answer 16

Provide training to their employees on identifying and reporting a breach, properly encrypt PII, report suspected or confirmed breaches; participate in the exchange of information in case of a breach, cooperate in the investigation of a breach, and make staff available to participate in the breach response team.

Question 17

What is a typical state definition of “personal information”?

Answer 17

An example is Connecticut’s which defines it as “an individual’s first name or first initial and last name in combination with any one, or more, of the following data: (1) Social Security number,44 (2) driver’s license number or state identification card number or (3) account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual’s financial account.”

Question 18

How many states have PI definitions that contain additional elements?

Answer 18

More than half

Question 19

Which states do NOT include an exception for publicly available information in their definition of PI?

Answer 19

Louisiana, Idaho, and Michigan

Question 20

What is the typical definition of a breach?

Answer 20

Unauthorized access to or acquisition of electronic files, media, databases or computerized data containing personal information, when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable. - Connecticut

When there is unauthorized acquisition of the personal information that “compromises the confidentiality, security or integrity” of the information. - California

Question 21

Who is typically notified when there is a breach?

Answer 21

State residents who are at risk because their personal information has potentially been exposed based on the level of unauthorized access or harm.

Note: Texas requires to notify not only Texas residents but also residents of states lacking a data protection notification law.

Question 22

Who is may be required to be notified when there is a breach?

Answer 22

The state AG. More that half of the state require entities who detect a breach to notify the state AG or other state agencies.

Question 23

How many states require that entities notify nationwide CRAs fo a data breach?

Answer 23

28

Question 24

Do state require third party notification?

Answer 24

Yes, all data breach state laws require third party notification.

Question 25

Which state, arguably, has the most stringent notification timing requirement?

Answer 25

Puerto Rico requires notification of the Department of Consumer Affairs within 10 days, and within 24 hours the department makes the breach public.

Question 26

What do you include in a data breach notification to a data subject?

Answer 26

Most states do not specify the contents of the notification to the data subject, but California, Hawaii, Illinois, Iowa, Maryland, Massachusetts, Michigan, Missouri, Montana, New Hampshire, New York, North Carolina, Oregon, Vermont, Virginia, Washington, West Virginia, Wisconsin and Wyoming do.

Question 27

How do you typically notify data subjects?

Answer 27

via written notification

Question 28

What are the 3 basic exceptions for providing data breach notification?

Answer 28

1. The most common exception allowed by states is for entities subject to other, more stringent data breach notification laws. This includes HIPAA-covered entities and financial institutions subject to and in compliance with the GLBA Safeguards Rule
2. Most states allow exceptions for entities that already follow breach notification procedures as part of their own information security policies as long as these are compatible with the requirements of the state law.
3. In most states, a safe harbor exists for data that was encrypted, redacted, unreadable or unusable.

Question 29

How many states have data destruction laws?

Answer 29

32