Category Archives: News

Security and privacy laws, regulations, and compliance: The complete guide

Read Time:2 Minute, 9 Second

This directory includes laws, regulations and industry guidelines with significant security and privacy impact and requirements. Each entry includes a link to the full text of the law or regulation as well as information about what and who is covered.

CSO updates this directory, originally published on January 28, 2021, frequently as new laws and regulations are put in place.

Click on a link to skip to information and resources on that law:

Broadly applicable laws and regulations

Sarbanes-Oxley Act (SOX)
Payment Card Industry Data Security Standard (PCI DSS)
Payment Service Directive, revised (PSD2)
Gramm-Leach-Bliley Act (GLBA)
Customs-Trade Partnership Against Terrorism (C-TPAT)
Free and Secure Trade Program (FAST)
Children’s Online Privacy Protection Act (COPPA)
Fair and Accurate Credit Transaction Act (FACTA), including Red Flags Rule
Federal Rules of Civil Procedure (FRCP)

Industry-specific guidelines and requirements

Federal Information Security Management Act (FISMA)
North American Electric Reliability Corp. (NERC) standards
Title 21 of the Code of Federal Regulations (21 CFR Part 11) Electronic Records
Health Insurance Portability and Accountability Act (HIPAA)
The Health Information Technology for Economic and Clinical Health Act (HITECH)
Patient Safety and Quality Improvement Act (PSQIA, Patient Safety Rule)
H.R. 2868: The Chemical Facility Anti-Terrorism Standards Regulation

US state laws

California Consumer Privacy Act (CCPA)
California Privacy Rights Act (CPRA)
Colorado Privacy Act
Connecticut Data Privacy Act (CTDPA)
Maine Act to Protect the Privacy of Online Consumer Information
Maryland Personal Information Protection Act – Security Breach Notification Requirements – Modifications (House Bill 1154)
Massachusetts 201 CMR 17 (aka Mass Data Protection Law)
Massachusetts Bill H.4806 — An Act relative to consumer protection from security breaches
Nevada Personal Information Data Privacy Encryption Law NRS 603A
New Jersey — An ACT concerning disclosure of breaches of security and amending P.L.2005, c.226 (S. 51)
New York State Department of Financial Services, Cybersecurity Requirements for Financial Services Companies (23 NYCRR 500)
New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act
Oregon Consumer Information Protection Act (OCIPA) SB 684
Texas – An Act relating to the privacy of personal identifying information and the creation of the Texas Privacy Protection Advisory Council
Utah Consumer Privacy Act
Virginia — Consumer Data Protection Act (CDPA)
Washington – An Act Relating to breach of security systems protecting personal information (SHB 1071)

International laws

Personal Information Protection and Electronic Documents Act (PIPED Act, or PIPEDA) — Canada
Personal Information Protection Law (PIPL) — China
Law on the Protection of Personal Data Held by Private Parties — Mexico
General Data Protection Regulation (GDPR)

Broadly applicable laws and regulations

To read this article in full, please click here

Read More

Why You Need to Get a Family Technology Agreement Happening

Read Time:7 Minute, 29 Second

There were multiple times during my digital parenting journey when I would have loved to put my head in the sand. Pretend that life was easy and that my kids weren’t going to grow up and want devices and to join social media. But I didn’t. I couldn’t. With four kids who had technology running through their veins, I had no choice but to embrace it. 

It’s All About Phones 

While many kids will first experience the internet from a family laptop or via their parent’s phone at a coffee shop (we’ve all done it), it’s when they get these devices into their hot little hands unsupervised a few years down the track that the real show starts. And that’s usually when they get access to a phone. Research from our eSafety Office shows that just under half of Aussie kids between 6 and 13 use a smartphone with about 1/3 owning their own device 

And while we can all wax lyrical about the good old days when we used payphones and how great it would be if our kids didn’t have smartphones, we need to keep it real. Technology is not going anywhere so the best thing we can to accept it’s here, educates our kids about how to use it safely and introduce boundaries and rules to ensure they are as safe as possible.  

So, without further ado, let me introduce you to the concept of a family technology contract – a great way to manage your kids and their tech use. 

What Is a Family Technology Contract?  

I like to think of a tech agreement as a clear outline of your expectations of your kids’ digital behavior – any behavior that occurs while using a device should be included in the agreement and yes, include TV here too! Now, before we progress, I have to share one key tip – don’t even think of putting together an agreement like this when tensions are high, or a heated argument is still in place – it will never work. Only talk about this or start working on it when you are in a calm and serene headspace.  

The most important thing is to have an agreement that is suitable for your kids’ ages and maturity and one that works for your family’s schedule. There’s no point making your 5-year-old sign an agreement that limits their time on Instagram when they’re probably quite happy visiting only the online sites that you have ‘bookmarked’ for them. And if your kids have a super busy schedule then you might want to include a rule that means there is no ‘leisure screen time’ (eg TV/movie viewing) till all homework is complete.  

How Old Do My Kids Need To Be? 

While it’s entirely based on your kids’ interests and tech usage, I think 3 is a good age to start with a basic agreement. That’s when they start understanding rules. And how old is too old for a tech contract, I hear you ask? Well, I acknowledge that introducing new rules and boundaries when your kids are well into their teens may be difficult however if things feel out of control and you are concerned about their mental health and less than ideal digital habits then it may also be exactly what you all need! 

What Should An Agreement Include? 

Keeping an agreement age-appropriate and relevant is essential. You may also want to keep it simple and focus on a few key things, such as: 

Be kind online always 
Never share passwords with your friends 
Always tell an adult if you see anything that upsets or scares you 

But it can include so much more. Here are some items you may choose to include in your own personalized version. Think of this list as a shopping list. Simply, pick & choose what works for the ages of your kids and your family’s structure. 

Time Limits/Device Usage 

I will ask permission before I use my device (younger children). 
I can use the internet/my devices/TV for __ hours a day after school. 
I can’t use my devices past __ pm in the evening. 
When I am not using my device, I will place it ___________.  
I will place my device in the family charging zone overnight. (This could be on the kitchen bench in a study, whatever works for your family) 

Responsibility 

I understand that any internet-enabled device (eg smartphone and laptop) can give me access to many things that may not be suitable for my age. I will use my devices safely and avoid clicking on any appropriate sites. (You could choose to list sites your kids can’t visit however this maybe, in fact, give them ideas! You choose what works best). 
I understand that it is my responsibility to protect my personal information and not share it freely online. This includes my name, family details, school, telephone numbers, and address. 
I will keep my password private and not share it with anyone outside my family. 
I understand that not everything is as it seems online and that being safe (and savvy) online means thinking critically and questioning whether it is true. 
I will not use a credit card online without permission from my parents. 
I will close down pop-up or banner ads and not click on them. 

Safety 

I will not share my location while using my devices.  
I will allow my parents to adjust the privacy settings on this device and monitor my activity. I understand that this is for my own safety. If older: I will ensure privacy settings are always on and set to the highest level for every social media platform I use. 
If anyone pressures me or makes me feel uncomfortable, I will stop talking to them and tell a family member or trusted adult.  
I understand that people are not always who they say they are online. 
I will not talk to anyone online who I don’t know in real life. 
I will not meet up with anyone I first met online without permission from my parents. 

Online Behaviour 

Being kind and respectful online is essential.  
I will only talk to people I know in real life when I am online (ideally, we’d want all our kids to agree to this but in reality, older teens won’t cop this. So, this is more suitable for younger kids) 
I will not be hurtful or mean to others on social media. This includes messaging, commenting, posting, liking, and sharing mean or hateful content.  
If I feel like I am being harassed or bullied online, I will tell a trusted adult.  
I will ask permission before I share pictures or videos of my friends. 
I will not share any content that is too revealing. This includes posting or sending inappropriate photos or messages. 

Smartphone Usage 

I will ensure my mobile phone stays in its protective case at all times. If it or the screen protector cracks or breaks, I will tell my parents.  
I will not use my phone when at school unless ___________________________. 
These places are no-phone zones:  

Our family does not use our phones during dinner. 
I will shut off my phone at __ pm and it will not be turned back on until ___ am. (You could also add here – after breakfast and/or until I am ready for school. 
I will get permission from my parents before I download any apps on my smartphone – this includes games. 

Gaming 

I can play games that are rated: _____. (Ratings on games range from G, PG, M, MA15+ to R here in Australia). Please do your research here and work out what’s suitable for your kids. Check out the Australian Classification Board’s latest ratings for games to help make your decision. 
Video games that I am not allowed to play at my home, or anyone else’s home include: (list what games are off-limits) 
I will ensure my privacy settings are set to the highest level. 
I will not talk to people I don’t know in real life while gaming. 

Consequences 

I understand that access to my devices is a privilege and breaking this agreement will lead to the following consequences: (list what you feel is appropriate) 

Formalizing The Agreement 

I would have all parties sign and date the agreement: both parents and kids. You may choose to keep a copy on the fridge? Again, whatever works for your situation. 

So, if you are feeling like this digital parenting thing is getting the better of you, please consider introducing an agreement. For decades, parenting experts have written about the virtues of establishing clear boundaries for our kids and in my opinion, a tailored family tech agreement absolutely does that! 

Good luck!! 

Alex x  

The post Why You Need to Get a Family Technology Agreement Happening appeared first on McAfee Blog.

Read More

HYAS brings security threat detection, response to production networks

Read Time:38 Second

Bringing threat detection and response capabilities to production networks, cybersecurity company HYAS Infosec is set to release a new, specifically targeted security solution dubbed HYAS Confront.

Aiming to address security issues on cloud-based production networks — which the company defines as the infrastructure behind businesses’ outward-facing, revenue-driving applications — the software is designed to continuously monitor traffic to uncover anomalies and enhance risk mitigation.

“HYAS is focused on providing our clients and customers with the solutions that they require for true business resiliency, continuity, and risk management,” says HYAS CEO David Ratner.  HYAS Confront “has already been proven in live deployments” among some customers, Ratner says, and will be available in general availability to customers in June.

To read this article in full, please click here

Read More

The Justice Department Will No Longer Charge Security Researchers with Criminal Hacking

Read Time:1 Minute, 36 Second

Following a recent Supreme Court ruling, the Justice Department will no longer prosecute “good faith” security researchers with cybercrimes:

The policy for the first time directs that good-faith security research should not be charged. Good faith security research means accessing a computer solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability, where such activity is carried out in a manner designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices, machines, or online services to which the accessed computer belongs, or those who use such devices, machines, or online services.

[…]

The new policy states explicitly the longstanding practice that “the department’s goals for CFAA enforcement are to promote privacy and cybersecurity by upholding the legal right of individuals, network owners, operators, and other persons to ensure the confidentiality, integrity, and availability of information stored in their information systems.” Accordingly, the policy clarifies that hypothetical CFAA violations that have concerned some courts and commentators are not to be charged. Embellishing an online dating profile contrary to the terms of service of the dating website; creating fictional accounts on hiring, housing, or rental websites; using a pseudonym on a social networking site that prohibits them; checking sports scores at work; paying bills at work; or violating an access restriction contained in a term of service are not themselves sufficient to warrant federal criminal charges. The policy focuses the department’s resources on cases where a defendant is either not authorized at all to access a computer or was authorized to access one part of a computer—such as one email account—and, despite knowing about that restriction, accessed a part of the computer to which his authorized access did not extend, such as other users’ emails.

News article.

Read More