- While the Department of Labor (DOL) hasn’t issued formal guidance on the responsibilities of retirement plan sponsors to protect against cybersecurity threats, there are commonsensical protections plan sponsors can put in place nonetheless, according to Employee Retirement Income Security Act (ERISA) attorneys.
- Any party that could be impacted by a cybersecurity breach must have an incident response plan.
- Should a breach actually occur, the plan sponsor “needs to find out which participants were impacted, which data elements were compromised, when the breach occurred and what steps have or will be taken to mitigate the impact of the breach.
- The sponsor should determine if any of the company’s insurance policies cover cybersecurity breaches, and, if so, the next step is notifying these insurers that a breach has occurred.
- Sponsors need to invest in cybersecurity protections and nurture a culture of privacy and security—from the mailroom to the boardroom. They need to hire qualified IT [information technology] staff, use the most up-to-date security software, train employees to recognize the telltale signs of phishing and other suspicious behavior, have a robust cyber-incident insurance policy in place and use secure methods to transmit sensitive information and data. Finally, they need to vet and continuously monitor their vendors.
- Lee Barney | March 22, 2021
- In early 2020, the "Verizon Data Breach Investigations Report" noted that the second-most common cause of data breaches behind hacking was errors such as misconfigurations.
- Big breaches due to customer misconfiguration errors (like the CapitalOne breach in 2019) get plenty of attention in the press, keeping IT security executives up at night.
- Learning how to better secure cloud usage is a work in progress. Understanding in theory how the shared responsibility model works flies out the door in practice when a systems engineer or developer accidentally configures an AWS S3 bucket so that it is open to public access.
- IT security teams responsible for securing their organization's cloud usage should also advocate for more and better training of those who will ultimately create those cloud workloads or accounts to ensure they understand how to avoid potentially costly misconfiguration mistakes.
- Paula Musich | March 22, 2021
- Energy giant Shell has disclosed a data breach after attackers compromised the company's secure file-sharing system powered by Accellion's File Transfer Appliance (FTA).
- According to the company, some of the data accessed during the attack belongs to stakeholders and Shell subsidiaries.
- Cyber security and personal data privacy are important for Shell and we work continuously to improve our information risk management practices. We will continue to monitor our IT systems and improve our security. We regret the concern and inconvenience this may cause affected parties. — Shell
- While the attackers' identity was not disclosed in Shell's statement, a joint statement published by Accellion and Mandiant last month shed more light on the attacks, linking them to the FIN11 cybercrime group.
- The Clop ransomware gang has also been using an Accellion FTA zero-day vulnerability (disclosed in mid-December 2020) to compromise and steal data from multiple companies.
- Sergiu Gatlan | March 22, 2021
- The order, issued by the military, advises Tesla owners to park their cars outside of military property.
- The ban, relayed to residents of military housing and others this week, was triggered by concerns that the world’s biggest maker of electric vehicles is collecting sensitive data via the cars’ in-built cameras in a way the Chinese government can’t see or control.
- Tesla, like many other automakers including General Motors, uses several small cameras, mainly located on the outside of the vehicle, to help guide parking, autopilot and self-driving functions. Most Tesla models also have an interior camera mounted above the rear view mirror that can be used to detect whether a driver is looking at the road, looking down at their lap, wearing sunglasses, or looking at something else entirely.
- Elon Musk, appearing on Saturday at the China Development Forum, a conference organised by a unit of the country’s State Council, in a session titled: The Next Disruptive Innovation?, said the carmaker would be “shut down everywhere” if it used the technology in its cars for spying.
| March 22, 2021