>> Now that we've talked about who has to be noticed,
under what circumstances,
and how they're supposed to be notified,
we're going to talk about the content
of that notice to the individuals.
This section of the law provides that regardless of
however the company decides to notify the individual,
whether that be the individual notification
and/or that mass media notification,
that the notices all have to include
to the extent possible, number 1,
a description of the categories of
sensitive personally identifiable information that was
>> or is reasonably believed to have been accessed
>> or acquired by an unauthorized person.
>> What this is going to include is any of
those PII data elements,
such as first name and last name,
your untruncated social security number,
usernames, passwords, email addresses,
any data that the organization knows or
believes to have been stolen
>> has to be included in that notice.
>> The second element that has to be
included in the notice is a toll-free number that, 1,
an individual can use to contact the business entity
or the agent of the business, and then 2,
where the individual can learn what types of
PII the business entity maintain
>> about that individual.
>> That not only includes the information that
the organization believes was lost,
but all information that
the organization contains about that person.
Then the last portion is
the toll-free contact telephone numbers,
addresses of the major credit reporting agencies,
and the commission.
There's also additional content
>> that should be included.
>> Notwithstanding Section 109,
a state may require that a notice under
Section A shall also include information
regarding protection and assistance
provided by that state.
Again, it's very important for incident responders,
and those that are sending out these notices to
not only be aware of the federal law,
but to also be aware of applicable state laws.
The state law can't be any
less severe or less strict than the federal law,
but they may pose additional information
that organizations will have to follow and abide by.
Again, it's very important to seek that legal counsel.
Moving on from the content of a notice to individuals,
organizations are also required to
notify the credit reporting agencies.
The law specifically states,
where a business entity is required
to provide notification to
more than 5,000 individuals
>> under that previous section,
>> the business entity shall also notify
all consumer-reporting agencies that compile and
maintain files of the consumers on a nationwide basis.
Then it goes to define the section that talks
about the agencies themselves.
Of the timing of distribution of the notices,
such notice shall be given to
consumer credit reporting agencies without
unreasonable delay if it will not
delay notice to the affected individuals prior to
the distribution of the notices
to the affected individuals.
Again, the law is very specific
what is required to do by businesses under this act.
Any time more than 5,000 individuals are affected,
business must notify credit reporting agencies.
A lot of words there,
but just to summarize that very succinctly.
How come some organizations do not report
information to federal law enforcement and/or US-CERT?
Some agencies do not do this because in some incidents,
senior management has the discretion in
reporting or seeking outside assistance.
Secondly, and probably more prevalent,
is that reporting cyber incidents
can lead to a loss or reputation,
and thus they pose
a potential loss in customers or revenue.
Thirdly, many organizations may consider
cyber incidents as an acceptable business loss
or simply choose to ignore the risk.
Now, hopefully, a business has actually conducted
a risk assessment as far as this is concerned,
and they are willing to accept certain types of risk,
and that may be okay, as
long as they've taken that into consideration.
However, simply ignoring the risk
>> or not even evaluating it
>> is not necessarily good due diligence.
>> We talked about how Target profit fell
nearly 50 percent in
its fourth quarter of 2013 after their breach
and declined by more than a third for all of 2013.
That may actually affect a lot of
businesses and how they, essentially,
don't want this information to come
out and reported to
the public and to law enforcement agencies.
Then next, Target agreed to pay
$10 million in a proposed settlement of
a class-action lawsuit related to
a huge 2013 data breach.
Some companies, regardless of what the law says,
they may not actually do what is required
>> and provide that information to their customers,
>> to the federal government as it's supposed to,
and to the credit reporting agencies.
Those are some important considerations
to take into effect.
Obviously, if your organization falls
below the threshold stated in those notices,
it doesn't necessarily have to
notify its customers that there was a breach.
That being said, it may be a token of goodwill.
It may show that the organization
is serious about protecting customer data.
But on the flip side of that,
it may also expose
the organization to the ire of their customers,
and it could result in a loss of
profit or confidence in the business.
Those are some very important
considerations to keep in mind.
It's probably going to be beyond the scope of
the incident responder and will
be made up at the very high levels,
the sea levels of the corporation,
and with that legal counsel.
Again, it's important to be cognizant of the law.
Again, I understand a lot of
these decisions will be
not made by the incident responder.
But again, it's very important that
you have that understanding so you
can act appropriately or at
least know when to seek legal guidance.
Moving beyond notification
to individuals about their data being breached,
there's also the required notification,
law enforcement, and for other purposes.
The first part is that any business entity shall
notify an entity designated by the Secretary
of Homeland Security to receive reports and
information about information security incidents,
threats, and vulnerabilities,
and such agency shall promptly notify and
provide that same information
to the United States Secret Service,
the Federal Bureau of Investigation,
and the commission for
civil law enforcement purposes
and shall make it available as
appropriate to other federal agencies
for law enforcement and national security,
or computer security purposes.
If number 1,
the number of individuals whose sensitive,
personally identifiable information was
or is reasonably believed to have
been accessed or acquired
by unauthorized persons exceeds 5,000.
Again, that's that notification standard.
If you're above 5,000,
you're notifying the individuals affected,
and you're also providing that notification to
the entity designated by the Secretary of DHS.
Number 2, the security breach
involves a database, network,
or integrated database or other data system containing
the sensitive PII of more
than 500,000 individuals nationwide.
That's very specific,
and it's often misunderstood.
Regardless of the size of how much data is stolen,
if someone gets access to a database that
has those more than 500,000 individuals,
law enforcement must be
notified that someone has done that.
Number 3, the security breach
involves databases owned by the federal government.
I was actually one of the individuals hacked by OPM.
OPM had to notify the federal government that,
"Hey, I was hacked,"
regardless of the size of the breach.
Again, it doesn't matter if it's
one person or if it's 5,000 people.
If the government owns that database,
they have to notify
the designated person appointed by DHS.
Then number 4,
the security breach involves primarily sensitive,
personally identifiable information of
individuals known to the business entity to be
employees and contractors of
the Federal Government involved
in national security or law enforcement.
Again, if your database
contains PII of those individuals,
you're required to notify
the person designated by DHS of that breach.