article thumbnail

NYDFS releases major update to Part 500 cybersecurity requirements for financial services companies

Data Protection Report

On November 1, 2023, the New York Department of Financial Services (“NYDFS”) released the finalized amendments of Part 500 of its cybersecurity regulations. c)); – monitor privileged access activity by implementing a privileged access management (“PAM”) solution, and automatically blocking commonly used passwords (500.7(c));

article thumbnail

Historic Charges: First Enforcement Action Filed by New York Department of Financial Services Under Cybersecurity Regulation

Data Matters

On July 21, 2020, the New York State Department of Financial Services (NYDFS or the Department) issued a statement of charges and notice of hearing (the Statement) against First American Title Insurance Company (First American) for violations of the Department’s Cybersecurity Requirements for Financial Services Companies, 23 N.Y.C.R.R.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

GUEST ESSAY: 7 tips for protecting investor data when it comes to alternative asset trading

The Last Watchdog

•Conduct employee training and awareness programs. Investing in comprehensive employee training and awareness programs is essential for a security-conscious environment. Enforce a culture of strong passwords, two-factor authentication and responsible data access practices to foster a security-conscious culture.

IT 189
article thumbnail

NYDFS Imposes Fine of $5 Million on Carnival for Cybersecurity Breaches

Hunton Privacy

On June 24, 2022, the New York State Department of Financial Services (“NYDFS” or the “Department”) announced it had entered into a $5 million settlement with Carnival Corp. Since Carnival was licensed by the Department to sell insurance in NY State, it was treated as a covered entity under the Cybersecurity Regulation.

article thumbnail

Avoslocker ransomware gang targets US critical infrastructure

Security Affairs

. “AvosLocker is a Ransomware as a Service (RaaS) affiliate-based group that has targeted victims across multiple critical infrastructure sectors in the United States including, but not limited to, the Financial Services, Critical Manufacturing, and Government Facilities sectors. hard drive, storage device, the cloud).

article thumbnail

MY TAKE: Why companies and consumers must collaborate to stop the plundering of IoT systems

The Last Watchdog

IoT devices help remotely control our household appliances, power plants, smart buildings, factories, airports, shipyards, trucks, trains and military. The infamous Mirai botnet self-replicated by seeking out hundreds of thousands of home routers with weak or non-existent passwords. And we’re just getting started.

IoT 279
article thumbnail

Catches of the Month: Phishing Scams for October 2023

IT Governance

EvilProxy phishing campaign targets Microsoft 365 accounts via indeed.com A phishing campaign identified by Menlo Security has been targeting senior executives in various industries – most notably banking and financial services, property management and real estate, and manufacturing – since July.

Phishing 105