Category: Daxtech

What Your Business Needs to Know About Protecting Customer Data

Key Points:

• The Federal Trade Commission (FTC) sets standards for safeguarding customer information.
• The Safeguards Rule took effect in 2003 but was amended in 2021 after public comment to ensure the rule keeps pace with the current technology.
• The revised rule offers in-depth guidance for businesses — reflecting the core data security principles that all organizations under FTC’s jurisdiction must implement.
• The FTC Safeguards Rule applies to a specific class of financial institutions, such as mortgage companies, creditors, mortgage brokers, and debt collectors.
• The safeguard rules don’t apply to banks, federal credit unions, and loans and savings institutions.

Financial institutions under the jurisdiction of the FTC Safeguards Rule must implement new security controls to protect customer’s financial information. The rule took effect in 2003 but was amended in 2021 after public comment to ensure the rule keeps pace with current technology.

After revision, FTC imposed a deadline of December 9, 2022, with a penalty of $45,000 for violating the rule. The regulations may be news for non-banking financial institutions that are first-time subject to the FTC Safeguards Rule.

FTC Safeguards Rule At Its Core

The FTC Safeguards Rule outlines data security guidelines for financial institutions under its jurisdiction to protect customers’ information and ensure organizations keep pace with current technology.

The rule is part of the more significant 1999 Financial Modernization Act, which first required financial institutions to document how they handle sensitive customer information. After almost two decades, it’s safe to say the technology and data security rules have become ancient.

Following public comment, the FTC updated the Safeguard Rule in 2021 to offer better guidance for organizations. The affected financial organizations have to go over the updates of the FTC Safeguards Rule to ensure they remain compliant with the outlined expectation before the December 9, 2022, deadline.

Who Must Comply with The FTC Safeguards Rule

According to FTC, the rule applies to all financial institutions under FTC’s jurisdiction. The official FTC site defines a financial institution as any organization that engages in activities that are financial in nature or are incidental to such financial activities.

Some financial institutions that FTC gives as examples include:

• Mortgage companies
• Mortgage brokers
• Creditors
• Debt collectors
• Retailers that issue store credit cards
• Property appraisers
• Career counselors who work with clients in the finance industry
• Automobile dealership
• Businesses that print and sell checks to customers
• Organizations that regularly wire money to and from consumers
• Check cashing businesses
• Accountants and income tax return preparers
• Investment advisory company and credit counseling service
• Colleges and universities accepting Title IV funds

The FTC safeguards rule doesn’t apply to banks, federal credit unions, and savings and loan institutions.

What The FTC Safeguards Rule Require Organization to Do

FTC Safeguards requires organizations under its jurisdiction to comply with several requirements. The regulator outlines three elements for every information security program of financial institutions. Your security program must:

• Ensure the security and confidentiality of customer data
• Protect customer data against threats and hazards
• Prevent unauthorized access

The FTC Safeguards Rule outlines nine requirements for compliant security infrastructure. For an organization to be compliant, it must:

1. Assign a qualified individual to implement and supervise your organization’s information security program.
2. Execute a risk assessment to identify any vulnerability that can compromise the security and confidentiality of customer data.
3. Design and implement security controls to mitigate the risk identified through your risk assessment. The controls include access control, encrypting customer data in transit or at rest, implementing multifactor authentication, and secure data disposal.
4. Regularly monitor and test the efficacy of your security controls.
5. Train your staff to eliminate human weaknesses in your security programs.
6. Monitor your service providers to ensure they’re up to the task and meet your company’s security standards.
7. Keep your information security program current because the threat landscape is constantly evolving.
8. Create a written incident response plan.
9. Your qualified individual to report to your Board of Directors

What’s New With the FTC Safeguards Rule

The new amendments have many new requirements, including:

• Policies
• Reports
• Documentation
• Technical and training requirements

The technical requirements call for cybersecurity solutions that are FTC-compliant. Your organization needs to implement a security program with the following:

• Multi-Factor Authentication (MFA):  The new FTC Safeguards Rule requires your organization to implement multifactor authentication for any individual accessing any information in your system. Your security system should provide users with more than one piece of evidence to verify their identity. MFA makes it harder for unauthorized people to access customers’ sensitive data.

• Penetration Testing and Vulnerability Assessments: FTC requires your security practices to include continuous monitoring, periodic penetration testing, and vulnerability assessments. The test checks for vulnerabilities in your system before hackers can exploit them. More importantly, the assessments test your cyber-defense capability and responsiveness.

• Monitor and Log User Activity & Access: Another requirement you must meet is implementing policies, controls, and procedures to monitor and log the activity of authorized users. Your organization should be able to detect unauthorized access to prevent the wrong use or tampering of customers’ data.

• Encryption: The Amended Rule requires your information security system to encrypt all customer data at rest and in transit. While data encryption is operationally difficult and costly, FTC has noted several low-cost and free encryption solutions for data in transit.

What is Monitoring & Activity Logging for FTC Safeguards Rule?

FTC says that you must implement a security solution that monitors when authorized users are accessing customer information on your system and detects any unauthorized or suspicious access to customer data.

One way to implement the requirement is to adopt a solution that collects, centralizes, and automatically analyzes your log data for users’ activities. The solution should detect unauthorized access, alert you in real-time, provide the next steps to respond, and allow easy access to historical log reports of user activity for investigations and audits.

The FTC Safeguards Mean Well For Your Business

Financial institutions under FTC should get into compliance the quickest way possible. While the new FTC Safeguards Rule demands a lot from your organization to be compliant, it’s for a good reason. The spike in security threats is concerning, and for every stakeholder in your organization, you need to do your part in managing risks.

How Safe is Microsoft Teams? Understanding the New Vulnerability Vectra Uncovered

Key Points in This Article

• Cybersecurity researchers at Vectra recently unearthed a new vulnerability in Microsoft Teams that may allow cyber criminals the means to cause considerable harm.
• The vulnerability requires cybercriminals to already have a certain level of access to your network or device.
• Rather than asking what you should do about Teams in light of this vulnerability, you should take every possible precaution and measure to keep your access credentials secure.

It’s a foregone conclusion these days that no matter what software application significant players like Microsoft roll out or security updates they provide, a new vulnerability will invariably be discovered. After all, a veritable army of hackers, cybercriminals, and even nation-state actors work continuously to identify these vulnerabilities for their own purposes. And these threat actors often think in creative ways that corporations are designed to, allowing them to find weaknesses that even experienced cybersecurity professionals overlook.

Understanding Software Application Vulnerabilities

When a software vulnerability is found in an application at a company like Microsoft, Apple, or Google, it quickly makes headlines in not just industry publications but also mainstream media. However, those working in cybersecurity know that such vulnerabilities are pretty common and that not all vulnerabilities pose the same level of risk. Nevertheless, those outside the field often quickly question whether widely used software is safe or whether it should be quickly discarded in favor of a new, unidentified, yet presumed safer measure.

Microsoft Teams recently made some headlines when cybersecurity researchers at Vectra unearthed a new vulnerability in the application. And because of the headlines, it’s likely some business leaders may have found themselves asking their CIOs and IT directors whether Teams was still safe to use.

When such headlines occur, influential IT professionals likely have taken the time to understand the nature of this vulnerability and assess the risks it may pose before making recommendations or taking action. Doing so can help save them from acting precipitously by spending time and money moving to a competing software without determining if a simple patch or other safety measures might eliminate the risk.

So what is the nature of the vulnerability? How much of a risk does it pose? And is Microsoft Teams still safe for businesses like yours to use?

The Microsoft Teams’ Vulnerability Vectra Uncovered

Vectra researchers realized that the Teams holds user authentication tokens in plain text on their desktop devices. When you install and use the Microsoft Teams client on Windows, Mac, or Linux, those credentials can be found on your device even when Teams is closed. A hacker or cybercriminal who has access to your system could use these credentials to access Teams, Outlook, and SharePoint, among other applications, modify files, steal data, and compromise your security.

Moreover, these credentials allow a hacker to take any action you might through the Team interface, bypassing the need for multi-factor authentication. For example, a cybercriminal who accesses the account of a C-suite leader through this Teams’ vulnerability could hijack their Outlook account and steal proprietary information from the business leader’s email account or SharePoint document library.

Cybercriminals could also use their newfound access credentials to send phishing emails to employees throughout the organization. These phishing efforts, coming from the email account of a company leader, could be designed to encourage employees to take actions that further compromise network security, such as downloading malware or ransomware. These are just two possibilities. An enterprising cybercriminal could easily cripple a business or organization in many other ways.

Vectra initially discovered this vulnerability after one of its customers noted that Teams users cannot remove deactivated accounts through the Teams UT when their user account is disabled. Vectra began investigating and learned that Teams’ storage of user credentials was not secure. The company shared its discovery of the vulnerability with Microsoft in August 2022. Perhaps surprising to some, Microsoft did not immediately set about patching this exploit. They confirmed that it could pose a threat and indicated they would address it in a future Teams update.

What Relative Risk Does This Vulnerability Pose?

This response may seem to downplay the possible risk and strike some as cavalier. But while this vulnerability allows cybercriminals with only read access to your system to gain your Teams credentials, the truth is if a cybercriminal gains access to an employee’s account, there are many other ways they can leverage that access at the expense of the business or organization. And it remains incumbent on employees in every department (not just IT) to ensure that authentication credentials don’t fall into the wrong hands.

Businesses and organizations must provide their employees with regular, practical, and current cybersecurity awareness training to ensure that all employees do their part to protect their employers. Employees must understand how to identify and report suspicious activity they encounter, take steps to secure their devices, and avoid downloading applications that could house malware and viruses. They must understand and follow their employer’s cyber security policies without fail to keep their account credentials out of the hands of third parties.

CIOs and IT professionals must develop, maintain, and refine strong cybersecurity policies that cover the entirety of the organization. And they must ensure that all areas comply and that no shortcuts are taken. That means eliminating legacy practices like granting certain users local admin privileges to cut down on help desk requests. It also means continuously testing existing measures to pinpoint vulnerabilities before third parties. A single exploit left unidentified and unaddressed can prove catastrophic. One recent study holds that the average cyberattack costs a company $200,000, which can be enough to put a small business out of business.

So, while Microsoft’s response may seem to downplay the risk, businesses and organizations most at risk from this vulnerability are those with poor fundamental cybersecurity measures in place already. And while business and IT leaders should be aware of this vulnerability, it does not make Microsoft Teams more unsafe to use. Those who are concerned about it should take every available measure to protect their network and device access credentials from falling into the wrong hands before giving any thought to switching platforms. Because no matter which platform you select, if a cybercriminal obtains usernames and passwords, everything is vulnerable.