US Legislators Draft Nationwide Data Privacy Act; Acuity Confirms Their GitHub Repositories Were Breached; D-Link NAS Vulnerability Affects End-of-Life Devices; Help Us Improve NewsBites

One of the great things about the US is how our 50 states (plus territories!) serve as petri dishes of democracy. Many have created and tested their own privacy laws. Here's hoping the federal government manages to adopt the best aspects of each.

Christopher Elgee

Having a single privacy law in the U.S. would simplify implementation for all involved. The draft legislation parallels the existing goals of CCPA, GDPR and other privacy acts. The question is how it will be transformed as it works its way through congress and if states will be willing to accept what remains or continue to enact their own rules.

Lee Neely

A US Data Privacy Act is long overdue. On first blush it appears to be modeled off the European General Data Protection Regulation (GDPR) giving citizens rights over their personal data. Given its bipartisan sponsored, strengthens the likelihood it will fully be considered by the House and Senate.

Curtis Dukes

Maybe the headline should read "Acuity confirms it stored national security data on GitHub", not that the GitHub repo was breached. But it probably sounded better in the press release to call this a GitHub repo breach.

Johannes Ullrich

Not so sure storing national security information on GitHub is a wise choice without a lot of due diligence to ensure its protected. The takeaway is to really understand the (external) environment you're storing sensitive data in and verify the protection (and detection) mechanisms meet or exceed your requirements, then ensure they continue to do so.

Lee Neely

Whenever you purchase a device, you need to track its "lifetime" based on the vendors end-of-support rules. Vendors not being open about how long to expect support for should be avoided. But at one point, the only option will be to replace the device, which needs to be budgeted for.

Johannes Ullrich

We need to be as conscious of lifecycle with home devices as we are in the workplace. Yeah, they are not broken as they keep working. But they are not getting updates either. Also its easy to forget about them - like that time you allowed a connection from the internet to help some friends you never shut down? Now the really hard part is to get rid of the old one so you're not tempted to put it back online.

Lee Neely

The count makes one suspicious that these devices are visible to the public networks. Network attached storage should not be visible to the public networks.

William Hugh Murray

Although Hoya has yet to confirm a ransomware attack, it bears all the hallmarks of one. Hoyas revenue last year was just over $5.6B, so its safe to assume they have a reasonable cybersecurity budget. Hopefully, they will be forthcoming about what happened and what defenses were in place at the time of attack.

Curtis Dukes

If you're evaluating a similar move, make sure you consider the impact on your support and security services. The total cost of ownership may be higher than you think. Make sure you understand what infrastructure you're going to need to provide and how you'll achieve equivalent security and user experience. You may need a lot of training as so much experience is based on how Windows does things.

Lee Neely

Testing with mocked up or dummy data takes a bit longer to generate usable data but is really important for testing. With outsourced or cloud services you need data which doesn't matter while you make sure systems are properly secured before going live.

Lee Neely

Test data is part of the specification. It should be written before the code. It includes both the inputs and the associated expected outputs. Live data does not contain the expected outputs and is not adequate for testing. Moreover, proper separation of functions should deny developers and testers access to live data.

William Hugh Murray

This is designed to protect the host system from the browser.

Lee Neely

Browsers leak. This announcement says that the Javascript V8 engine, a component of many browsers, leaks so badly that the solution is to encapsulate it so as to contain the leakage. The objectives of the V8 engine, and of most browsers, were speed and features. Speed, features, and integrity: pick two.

William Hugh Murray

Sounds like a sensible precaution. Reducing your attack surface, by not exposing some applications to the internet, can substantially reduce the risk. Maybe this application should never have been exposed in the first place?

Johannes Ullrich

It took the third party until February this year to confirm the incident. While they subsequently deleted the DoJ data, the data were already exposed) This highlights the need to understand the capabilities of your third-party providers as well as make sure their response actions are consistent with your requirements. Propose a joint tabletop to make sure you're on the same page.

Lee Neely

Law firms and consultant organizations often maintain sensitive information on behalf of their clients. They are perhaps the weak link in the cybersecurity chain. What's disappointing though, is the timing of victim notification almost a year after the data breach.

Curtis Dukes