article thumbnail

FTC Seeks Comment on Proposed Changes to its GLBA Safeguards and Privacy Rules

Data Matters

Of particular note, the Safeguards Rule NPRM proposes to align the FTC’s requirements with those of the New York Department of Financial Services (“NYDFS”), as found in its cybersecurity regulations, and the National Association of Insurance Commissioners (“NAIC”), as found in its insurance data security model law.

Privacy 68
article thumbnail

Cybersecurity Standards for the Insurance Sector – A New Patchwork Quilt in the US?

HL Chronicle of Data Protection

For example, the New York Department of Financial Services (‘NYDFS’) in March 2017 issued its Cybersecurity Regulation (23 NYCRR 500) (‘the NYDFS Cybersecurity Regulation’), a groundbreaking and far-reaching regulatory regime focused on financial institutions licensed in New York, including insurance companies.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

FTC Seeks Comment on Proposed Changes to GLBA Implementing Rules

HL Chronicle of Data Protection

The proposed Rule will also require multi-factor authentication for any individual accessing customer information, but, unlike the NYDFS which imposed a similar requirement in the Cybersecurity Regulation, the FTC declined to endorse text messages as a permitted second factor.

Privacy 40
article thumbnail

Ten Years Later, New Clues in the Target Breach

Krebs on Security

That story about the Flashback author was possible because a source had obtained a Web browser authentication cookie for a founding member of a Russian cybercrime forum called BlackSEO. According to leaked ChronoPay emails from 2010, this domain was registered and paid for by ChronoPay. ru under the handle “ r-fac1.”

article thumbnail

Nation-state actors target critical sectors by exploiting the CVE-2021-40539 flaw

Security Affairs

.” Experts also detailed the KdcSponge credential stealer, which hooks into the Windows LSASS API from within the LSASS process to steal credentials from inbound attempts to authenticate via the Kerberos service (“KDC Service”). The APT group has been active since 2010, targeted organizations worldwide, including U.S.

article thumbnail

MY TAKE: Identity ‘access’ and ‘governance’ tech converge to meet data protection challenges

The Last Watchdog

Not long afterwards, in about the 2010 time frame, IAM vendors first arrived on the scene, including Optimal IdM, Centrify, Okta and CyberArk, followed by many others. The IAM vendors took single sign-on to the next level, adding multi-factor authentication and other functionalities.

Access 169
article thumbnail

Zero Trust: Can It Be Implemented Outside the Cloud?

eSecurity Planet

The concept of zero trust has been around since 2010, when Forrester Research analyst John Kindervag created the zero trust security model. The only exception, it seems, has been cloud service providers, who boast an enviable record when it comes to cybersecurity, thanks to rigorous security practices like Google’s continuous patching.

Cloud 107