Hunton Privacy

JULY 5, 2023

Multifactor Authentication (“MFA”) : NYDFS significantly expanded the scope of the proposed MFA requirements so that they are now aligned with the MFA requirements under the FTC Safeguards Rule. The new MFA requirements, for example, would be subject to the two-year transition period.

Cybersecurity 113

Cybersecurity IT Compliance Financial Services 113

IT Governance

MARCH 17, 2020

For example, millions of employees will likely to be forced to work remotely, as the UK government prepares for a lockdown scenario. This makes the message even more dangerous – not only because more people are being targeted, but because an all-staff message looks authentic. every time you receive an unexpected email.

Phishing 114

Phishing Risk Communications Government 114

IT Governance

JUNE 13, 2019

In this blog, we explain how data protection by design and by default works, and provide examples of the steps you should take to achieve it. Examples of data protection by design. Examples of data protection by default. Here’s an example: an organisation introduces a voice recognition system to verify users.

GDPR 90

GDPR Personal data Compliance Privacy 90

Troy Hunt

JULY 8, 2019

Almost 2 years ago to the day, I wrote about Passwords Evolved: Authentication Guidance for the Modern Era. This wasn't so much an original work on my behalf as it was a consolidation of advice from the likes of NIST, the NCSC and Microsoft about how we should be doing authentication today.

Passwords 93

Passwords Authentication Data breaches IT 93

IBM Big Data Hub

FEBRUARY 23, 2024

For example, a business that collects user health data needs stronger protections than one that collects only email addresses. While the GDPR offers a few examples—using new technologies, large-scale processing of sensitive data—it does not exhaustively list every high-risk activity.

GDPR 83

GDPR Compliance Personal data Privacy 83

Armstrong Archives

AUGUST 25, 2023

For example, imagine a hospital employee accidentally shares a patient’s medical records with someone who shouldn’t have seen them. To prevent something like this from happening, it always helps to check the access logs and exercise control over who can view sensitive information like this.

Computer and Electronics 52

Computer and Electronics Insurance Compliance Risk 52

Hunton Privacy

AUGUST 9, 2017

The blog post notes that just as business owners lock doors to prevent physical access to business premises and shield company proprietary secrets from unauthorized eyes, they should exercise equal care with respect to access to sensitive customer and employee data.

IT 40

IT Security Systems administration Passwords 40

Hunton Privacy

APRIL 1, 2020

For example, the data of visitors can be deleted after 1 – 3 months if no cases of infection have become known to the employer. Retention: The data must be deleted when the original purpose for processing no longer applies.

Personal data 82

Personal data Authentication Communications Risk 82

IT Governance

NOVEMBER 28, 2023

For DDoS [distributed denial-of-service] attacks, for example, it faced over 30% of attacks, making it the second-most attacked sector. These might be tabletop exercises or red/blue team assessments , which basically test whether the organisation can actually respond to an incident, should one occur.

Risk 52

Risk Compliance Government Security 52

ForAllSecure

SEPTEMBER 7, 2022

In order to know what tool is right for you, we have put together some examples to see how both work with an example vulnerable REST API. The response will contain the token you will use for other parts of the exercise. { "auth_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NjIwNjkxNTIsImlhdCI6MTY2MjA2OTA5Miwic3ViIjoiZm9vIn0.7aB_94z7FmcGYNTaL67DW47Ht2WTBKlQ85eCbvmlBLM",

Passwords 40

Passwords Authentication IT Security 40

ForAllSecure

SEPTEMBER 7, 2022

In order to know what tool is right for you, we have put together some examples to see how both work with an example vulnerable REST API. The response will contain the token you will use for other parts of the exercise. { "auth_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NjIwNjkxNTIsImlhdCI6MTY2MjA2OTA5Miwic3ViIjoiZm9vIn0.7aB_94z7FmcGYNTaL67DW47Ht2WTBKlQ85eCbvmlBLM",

Passwords 40

Passwords Authentication IT Security 40

eSecurity Planet

OCTOBER 24, 2023

Exercise Caution with Emails The first two items on this list could be lumped together with a single warning: Don’t click. Watch File Extensions: Exercise caution with file extensions; avoid files with suspicious extensions like.exe or.bat, especially from unfamiliar sources.

Passwords 103

Passwords Encryption Authentication Phishing 103

Data Matters

OCTOBER 24, 2019

The regulations require businesses to use a two-factor verification process, at a minimum, to authenticate consumers with password-protected accounts who submit access or deletion requests. First, the business may verify consumers who using the existing authentication procedures for the account. No Reasonable Method.

Privacy 60

Privacy Sales Authentication Passwords 60

Data Protection Report

DECEMBER 5, 2018

The MPS has long been involved in data security through its multi-level protection system under the Multi-Level Protection Measures, but it has not to date exercised a great deal of power over matters of personal information protection. The draft Guideline therefore represents the MPS’s most recent major foray into this area.

Information Security 40

Information Security Security Authentication Passwords 40

Hunton Privacy

APRIL 5, 2012

The Working Party defines facial recognition as the “automatic processing of digital images which contain the faces of individuals for the purpose of identification, authentication/verification or categorization of those individuals.”. Data controllers can process digital images of non-registered users only if they have a legitimate interest.

Authentication 40

Authentication Personal data Risk Encryption 40

HL Chronicle of Data Protection

SEPTEMBER 25, 2019

AB-25 also addresses the process for authenticating consumer requests. It allows businesses to scale their authentication requirements to the sensitivity of the personal information. Businesses can require reasonable authentication tailored to the type of personal information requested. AB-874 (Edits to Personal Information).

Sales 40

Sales Communications Data breaches Compliance 40

ForAllSecure

APRIL 22, 2021

In 2013, researcher Nitesh Dhanjani found that a popular brand used simple MD5 hashes of the device's MAC addresses for authentication. Problem is, MAC addresses are not great for authentication. There's a smart IoT enabled toothbrush for example, I mean, a toothbrush is a stick with bristles. In addition to a smart coffee mug.

IoT 52

IoT Communications Security IT 52

ForAllSecure

APRIL 22, 2021

In 2013, researcher Nitesh Dhanjani found that a popular brand used simple MD5 hashes of the device's MAC addresses for authentication. Problem is, MAC addresses are not great for authentication. There's a smart IoT enabled toothbrush for example, I mean, a toothbrush is a stick with bristles. In addition to a smart coffee mug.

IoT 52

IoT Communications Security IT 52

Krebs on Security

SEPTEMBER 2, 2021

Bill said this criminal group averages between five and ten million email authentication attempts daily, and comes away with anywhere from 50,000 to 100,000 of working inbox credentials. mail server responds “OK” = successful access). Bill said these crooks have figured out a way to tap into those benefits as well.

Authentication 277

Authentication Passwords Access Search queries 277

ForAllSecure

DECEMBER 16, 2020

Example: Netgear N300 a.k.a. Web Servers on embedded systems (especially routers) are particularly interesting because they tend to control many functions besides just being a web server including device bring-up, authentication, and process management. Non-glibc C standard library. Lack of available source code or documentation.

Libraries 52

Libraries IT Authentication Access 52

ForAllSecure

DECEMBER 15, 2020

Example: Netgear N300 a.k.a. Web Servers on embedded systems (especially routers) are particularly interesting because they tend to control many functions besides just being a web server including device bring-up, authentication, and process management. Non-glibc C standard library. Lack of available source code or documentation.

Libraries 52

Libraries IT Authentication Access 52

Data Matters

OCTOBER 22, 2019

In such circumstances, however, before selling the information in question, a business must either give the consumer an opportunity to opt out or obtain a “signed attestation” from the entity that collected the personal information stating that it provided notice at the point of collection to the consumer and include an example of the notice.

Privacy 60

Privacy Sales Paper Compliance 60

ForAllSecure

NOVEMBER 24, 2020

History is filled with failed examples of homegrown encryption, some with disastrous consequences. So, remember our example with the word bird? And if you could initiate a heartbeat before authentication was complete on the site, you could smash and grab the encrypted information before anyone even knew who you were.

Encryption 52

Encryption Artificial Intelligence Marketing Security 52

ForAllSecure

NOVEMBER 24, 2020

History is filled with failed examples of homegrown encryption, some with disastrous consequences. So, remember our example with the word bird? And if you could initiate a heartbeat before authentication was complete on the site, you could smash and grab the encrypted information before anyone even knew who you were.

Encryption 52

Encryption Artificial Intelligence Marketing Security 52

ForAllSecure

JANUARY 19, 2022

For example, here’s Jerry Lewis in a scene from a 1950s film, where he’s trying to break into a Nazi German military base. But this method of authentication is flawed; either hashed or hashed and salted, usernames and passwords can still be stolen and reused. So we need passwords, but passwords just aren’t perfect.

Passwords 52

Passwords Authentication Access Data breaches 52

ForAllSecure

OCTOBER 20, 2022

For example, just listing the required properties for an endpoint's request body makes Mayhem for API massively more likely to successfully cover that endpoint: /example: post: summary: example requestBody: required: true content: application/json: schema: type: object + properties: + page: + type: integer. name: example_id.

Authentication 40

Authentication IT Security 40

CGI

SEPTEMBER 9, 2015

Best practices for building strong mobile biometric authentication. Strong authentication of mobile users is an increasingly important issue for enterprises and commercial entities. Use 3-factor (or more) authentication. For the strongest authentication, consider adding a third factor: biometrics. ravi.kumarv@cgi.com.

Authentication 40

Authentication Encryption Passwords Risk 40

ForAllSecure

NOVEMBER 24, 2020

History is filled with failed examples of homegrown encryption, some with disastrous consequences. So, remember our example with the word bird? And if you could initiate a heartbeat before authentication was complete on the site, you could smash and grab the encrypted information before anyone even knew who you were.

Encryption 52

Encryption Artificial Intelligence Marketing Security 52

The Last Watchdog

FEBRUARY 21, 2022

One example of this is isolating or quarantining systems with malware (virus or ransomware) from the remainder of the network. military exercise their plans often – it builds human muscle memory and increases comfort and resiliency in the people working through these crises. There is a reason organizations like the U.S.

Passwords 186

Passwords Cybersecurity Education Phishing 186

Security Affairs

APRIL 21, 2023

This article will provide some insights into current phishing methods cyber-criminals leverage to exploit human behavior, performance metrics useful for measuring organizational resiliency to phishing, and examples of free tools that can be leveraged to conduct internal simulated phishing exercises.

Phishing 85

Phishing Security awareness Passwords Education 85

HL Chronicle of Data Protection

JUNE 17, 2019

Hong Kong’s past reforms to the PDPO have been “event driven”, the best example being the Octopus Rewards case in 2010, which led to extensive reforms to Hong Kong’s direct marketing controls. Cathay Pacific did not encrypt database backup files used to support database migrations carried out between 2016 and 2018.

Personal data 40

Personal data Data breaches Security Compliance 40

Data Protection Report

NOVEMBER 29, 2023

In general, the proposed rules would require businesses using automated decision-making technology to provide consumers with a “pre-use notice” about the purpose of the technology’s use and consumers’ rights to opt-out of and access additional information about such use, including instructions for how to exercise these rights.

Access 62

Access Privacy Personal data Authentication 62

Positively RIM

OCTOBER 6, 2011

Writing can be an exercise in futility without readers. For example, consider Integrity. This principle assures users that records are what they say they are: authentic, original documents that have not been altered. This is posted, below. I hope you enjoy and benefit from it, and I invite your comments and responses.

Cloud 40

Cloud Records Management Metadata e-Discovery 40

Data Protection Report

MAY 3, 2022

The “dark patterns” highlighted in the Guidelines aim to influence users’ behaviour through content or visual presentation so that users make unintended and potentially harmful decisions regarding their personal data, for example, deciding to disclose more data than they otherwise planned or agreeing to limited protections of their data.

Privacy 67

Privacy IT GDPR Data collection 67

AIIM

SEPTEMBER 3, 2020

Relocating the data from a legacy system to a modern ECM system is also a relatively simple one-off exercise that should quickly pay for itself. Legacy applications running on older operating systems are often incompatible with modern security and authentication methods, and therefore more vulnerable to security breaches.

ECM 166

ECM Digital transformation Compliance Access 166

IBM Big Data Hub

AUGUST 7, 2023

Orion combines these capabilities with other blockchain properties, offering tamper evidence, provenance, data lineage, authenticity and non-repudiation, all while utilizing a standard data model and transactional APIs. Ensuring the authenticity of data is crucial in preventing potential disputes over authorship in multi-party interactions.

Blockchain 68

Blockchain Government Authentication Manufacturing 68

HL Chronicle of Data Protection

MAY 13, 2019

For example, the New York Department of Financial Services (‘NYDFS’) in March 2017 issued its Cybersecurity Regulation (23 NYCRR 500) (‘the NYDFS Cybersecurity Regulation’), a groundbreaking and far-reaching regulatory regime focused on financial institutions licensed in New York, including insurance companies.

Insurance 40

Insurance Cybersecurity Data breaches Financial Services 40