Is your small business compliant with Data Security Regulations?

 Develop a WISP that helps you be compliant with Massachusetts’s data security regulations

At Compliance+ Security, we help small businesses safeguard their customers', employees', and contractors' Personal Identifiable data. The most helpful safeguard is to comply with the law and to protect data by developing a Written Information Security Program (WISP). A WISP is a document that details an organization’s security controls, processes, and policies, and must be tailor-made to fit business’s needs and to comply with the law.

You value your data, and so does a hacker

A common misconception that my clients have is that breaches only happen to big businesses. There are notable examples from Equifax, Yahoo!, LinkedIn, Facebook, and others where a single data breach compromised millions of individual’s data at once. But the data reveal a different story. The data show[2] that the vast majority of data breaches affect smaller population of 1-10 individuals at a time. Every business, large and small, is a target for hackers and malicious actors to acquire personal data. Even though attention is paid to the big breaches, there are hundreds of little breaches that happen every day.

Reality of numbers

In 2021 so far,* there have been 2,188 reported data breaches in Massachusetts, affecting over 1 million residents. At this rate, by the end of the year, there could be as many as 1.5 million Massachusetts residents that have had their information compromised, just in this year alone.

Massachusetts’s data security regulations have teeth

Massachusetts has made significant efforts to protect residents from data breaches. These efforts include passing Chapter 93H and pursuant regulations published by the Office of Consumer Affairs and Business Regulation (OCABR)[4]. These regulations apply "to all persons that own or license personal information about a resident of the Commonwealth." Personal information includes: (a) Social Security number; (b) driver's license number or state-issued identification card number; or (c) financial account number, or credit or debit card number [5]

Chapter 93H authorizes the Attorney General to bring action which can include Court-ordered relief such as injunctions, consumer restitution, and civil penalties.[6] Civil penalties can be up to $5,000 for each violation, plus the cost of investigation and litigation. In some cases, the damages could be trebled. 

The landmark case of Commonwealth v. Equifax, Inc., No. 1784CV03009BLS2, 2018 WL 3013918 (Mass. Super. Apr. 3, 2018) demonstrates just how deep the teeth can be in this law. In that case, the Attorney General alleged that Equifax "knew or should have known about the data breach by July 29, 2017; and that Equifax waited to provide the required notice until September 7, 2017"[7]. After their motion to dismiss was denied, Equifax settled with the Attorney General for $18.2 million[8].

Don’t be the next Equifax. Equifax could have avoided the whole litigation if they implemented safeguards for their data, reported the breach and followed the rules set forth in Chapter 93H. The good news is that Chapter 93H and supporting rules allow companies to implement safeguards that are appropriate to the size, scope, and type of business, and the amount of resources available. The bad news is that businesses of all sizes need to provide 18 months of credit monitoring to all residents affected by a breach. Assuming a cost of approximately $15 to $25 per affected resident, providing credit monitoring alone adds up quickly for a small business.

Reach out to us to learn more. We offer free consultations to help you develop a WISP that is tailored to your business needs, be compliant with the law, and safeguard your customer’s data. 

FOOTNOTES:

*As of September 8, 2021, Data Breach Notification Report

[2] https://www.mass.gov/lists/data-breach-notification-reports

[3] General Laws Chapter 93H

[4] MA Data Security Regulations - 201 CMR 17.0

[5] 201 CMR 17.02. 

[6] MGL c. 93H, Section 6; MGL c. 93A, Section 4

[7] Commonwealth v. Equifax, Inc., No. 1784CV03009BLS2, 2018 WL 3013918, at *3 (Mass. Super. Apr. 3, 2018)

The publication contains information about regulations, laws, enforcement, penalties, court cases pertaining to data security regulations, data breach notification laws, and data destruction laws. The information is not legal advice, and should not be treated as such. This publication, which may be considered advertising under the ethical rules of certain jurisdictions, should not be construed as legal advice or a legal opinion on any specific facts or circumstances. This newsletter is intended for general information purposes only, and you should consult an attorney concerning any specific legal questions you may have.

Cybersecurity: Seeking complex solutions to simple problems

I recently saw the movie: "The Boy Who Harnessed The Wind" on Netflix. It made me think, that solutions to complex or even existential problems could be very simple . For some of us who are in cyber security field we are quite the opposite. We tend to view cybersecurity strictly from technology viewpoint, ever searching for complex solutions and complex procedures for simple problems.

Take for example, migration to cloud. Before I took upon an in-depth study of cloud paltform, I was led to think of cloud as something very complex requiring very specialized skill sets. Frustrated with this mind-set, I decided to take on the study of Amazon Web Services (AWS) Solutions Architect. As I went through the course, I found that working in the cloud was more simpler than that in on-premise environments. A few clicks and you can have web servers and applications running. I remember spending days building web servers and making applications run on a bare-bone box which IT would hand me over. Perhaps that hands-on experience made it easy to understand the cloud. That hands-on experience taught the fundamentals and a tendency to seek simplicity even in most complex situation.

Many of the vulnerabilities listed on OWASP Top 10 have been there for many number of years. For example, Injection flaws or Cross Site Scripting. One possible explanation could be, rather than addressing the root cause, most security professionals and developers tend to focus on complex coding approach. I have designed the applications at user interactions level and the backend processing level, focusing primarily to eliminate the root cause. And that has worked. Once you address or eliminate the root cause, complex coding would simply be decoration that would enhance the robustness of the application.

Cybersecurity as Value Add to business

Compared to the past practices, every business has been adopting digital technology in how they do business. And now, companies have responded to the coronavirus pandemic by moving as many processes as possible to digital formats. However, the pandemic merely accelerated the ongoing movement of businesses transforming their business processes to a digital format which started decades ago. This process is a digital transformation, and as a result, new risks to the company arise. These new risks from digital transformation comes in the form of cyber risk.

To combat cyber risk, companies should bolster their cyber security efforts. Cybersecurity is fundamental to the digital transformation because it ensures that the new business processes are safe from malicious attacks. Furthermore, the expectation from customers is that new, digital business processes are done safely and securely. 

Cybersecurity begins with mindset, being mindful about your fiduciary responsibility towards your customers, their data, their information, their assets–all of which have been entrusted to you. Cybersecurity is not about tools and technology—tools and technology are means to achieve that mindset. Just as securing your physical property begins with accepting the need to secure them and using locks and security systems as tools and technology to meet those objectives.

Cybersecurity is not about technology but it is fundamental capability of the businesses to be adaptive and resilient to changing business processes and ever-changing threat landscape.

NIST Cybersecurity Framework to deliver on the value proposition

I have been studying the NIST Cybersecurity Framework and applying the framework to organizations. The goal is to help businesses incorporate cybersecurity into all aspects of their digital practices.

The framework is outcome driven and provides activities that the organization needs to perform to achieve those outcomes. Since the framework does not mandate how an organization must achieve those outcomes, it enables scalability.  A small organization with a low cybersecurity budget is able to approach the outcome in a way that is feasible for them.

Every business already has some host of security practices—for example, passwords on email accounts are ubiquitous. The key however is identifying the gaps between,  where they the company is now, current profile, and where it should be, aspirational - target profile. We work with businesses to develop a plan or a roadmap to achieve their target profile, to ensure that cybersecurity is an integral part of all business practices from workflow, external and internal communications and that there is a corporate culture of acceptance of cybersecurity as a value-add business proposition.

All organizations have gaps in their cybersecurity practices. The goal is to identify those gaps by creating and comparing the current profiles with target profiles and to work iteratively to narrow those gaps.

Awareness Education - employees tend to be the weakest link

The threat landscape has evolved over time. In the past,  hackers and criminals were looking for vulnerabilities in the systems–networks vulnerabilities. Hackers penetrated the system by attacking the systems. Now, they prey on people and thereby gain access to the systems. People are easier to target. Hackers first introduce malware in the system through phishing emails and gain control over the organization’s assets and then through ransomware, blackmail or extort payments. Therefore, people are the weakest link falling easy prey to phishing, spear phishing, social engineering. Awareness education drives a culture of employees becoming deterrent to cyber-attacks and thereby making organizations, cyber resilient.

Cyber Security Awareness Training

ebusinessmantra is excited to announce a new security awareness training service for our clients. Engaging employee security awareness training is an effective way to protect your organization from threats like phishing. 

Our new security awareness training solution will teach your employees how to detect and avoid malicious content through attention-grabbing training modules and realistic simulations. We have over 2000 training resources in different lengths, styles and languages to inspire a culture of security at your organization.

As your service provider, we’ll handle all aspects of employee training — including implementation, management and reporting. This helps you: 

• Prevent data breaches and other security incidents.
• Meet and track security awareness compliance requirements.
• Save time and money with automated course delivery, management, and reporting.

Using the Right Tool: Web Application Scanner vs. Web Application Firewall

Web application or vulnerability scanner scans a website or web application to determine vulnerability in the application as snapshot in time. If the application is not altered and the scanner is not updated, you would get the same results every time the scan is run. In other words, a scanner’s nature is to be static in that it does not react to changing dynamics that is typical in live envrionment. From that viewpoint, scanners tend to be a good assessment tool for testing during development and pre-production or pre-release of an application.

It is important to note that scanning of production sites should be avoided at all cost, not only from the viewpoint of performance degradation but also as a potential to corrupt live database. This is an important distinction which I will refer back when comparing with web application firewall.

Commercial scanners such as Acunetix bring with it lot of additional out-of-the-box features and functionalities. They also provide tools for advanced testing and penetration testing. Thus, scanners fall under the realm of testing and would better utilized during the testing and development phases of a project.

Web Application Firewalls (WAF), on the other hand, provide real time, live monitoring of the application. They monitor every request coming to the web server, while the application is in the production environment. It guards the application by auditing against the security rules and configurations set manually and learnt by itself. Furthermore, WAF, such as one from Imperva, can block, alert, and apply virtual patch while the development team works on the real fix. This makes them extremely powerful in protecting live web application and live data. Contrast this with web application scanner which is not intended for production site and cannot provide protection in real time.

If the attack vector changes, the same application which was tested secure using scanner can be vulnerable to new forms of attacks. I have read many articles where the author has shown examples of websites that were hacked in spite of scanners finding them invulnerable. Again, remember, the intended time of the scanner use should be during development and testing - because of its snapshot nature. In the production environment, the dynamics are different, from configurations to network management to ever changing attack vectors.

Is are web application scanners necessary if the web application firewalls can provide the ultimate safety net?

Absolutely yes, in fact they are needed more so. First, scanning during development and testing ensures that the application is robust. A robust application is more secure with web application firewall to enhance security than a weak or vulnerable application. If web application firewall was icing, you want it on the cake not the soup.

Therefore organizations must include both the web application scanners and web application firewall.

ebusinessmantra offers web application or vulnerability scanners from Acunetix and web application firewall from Imperva. In addition, we have the right solutions and products for small to mid- size businesses.

Can site audit replace need for secure coding practices?

A web application developmental company, rather than employing data validation and sanitization, chooses to audit an eCommerce site for PCI compliance and agrees to remediate vulnerabilities found during the audit. Is this a clever way of doing the bare minimum and at the same time deflecting the liability to the auditing company?

Data validation is like diet and exercise, general and non-targeted whereas an audit is like tests, specific and targeted. The former is preventive whereas latter is diagnostic.

Like everything else in life, you can live with one, both, or none, depending on your risk tolerance. For developmental? organizations, which contract to build web application for their customers, secure coding adds to the cost of the project, in terms of training, hiring developers experienced in secure coding, and added time.

Of course, there is another consideration - standard coding practices - whether written in the contract or not, there is an understanding that a serious organization and matured developers would be expected to follow standard coding practices. But here's the caveat: who defines the standards? The same organization who is trying to duck their responsibilities defines their corporate coding standards by excluding secure coding practices. This is important when writing contracts - web site owners must include standards as an addendum to the contract.

Reliance on web development organization to implement secure coding is a false sense of security. Rather than stating general requirements in the contract to adhere to standards, specifics must be included. For example, value of each variable received from another system or user must first be validated to check for expected length and non-numeric or numeric or alpha-numeric, as the case may be.

Wait a minute, are web site owners expected to know what secure coding is in order to demand secure coding? The answer is yes when dealing with development organizations which have no scruples. Unfortunately not many businesses are security savvy and very rarely would have someone on staff who is technically skilled in web application security. Before hiring a contractor for web site development, a security consultant needs to be hired. It is just like having an architect on-board before hiring a building contractor.

Web Application Security

Web Application Security should be key consideration for any business who owns a web site, even if the web site is intended for presenting brochure like information.

Web Application Security

View more documents from ebusinessmantra.

Web Application Scanners - Open source vs. commercial scanners

There is this ongoing debate within the web application security community relative to selection of web application scanners. With some good commercial scanners in the market and promising open source scanners, it is quite confusing for many developers and IT professionals to select one. If price alone was the consideration, it would be an easy choice, but what makes it harder is which product does the intended job. I have seen that in selecting one product, there is a tendency to feel like you are missing out on what the other product offers. It is like buying a car: regardless of how hard you negotiate to get the best deal, you always feel that the salesman got away with the better deal.

Let me begin with my thoughts on open source scanners. Two names that are frequently mentioned are WebScarab (OWASP) and Burp Suite (PortSwigger). Those who have worked with these products for some time firmly stand by them. To learn more about the products, I downloaded both them; of course, the free offer was not too bad, either. After few attempts, I quickly learnt that there is a steep learning curve associated with both of these products. Lack of a good set of documentation made it rather challenging to learn their usage and appreciate their effectiveness. As is the case with all open source products, support is provided by community in open forum. That may be of concern if your inquiry involves disclosing confidential information. Furthermore, if your questions are time sensitive, you can expect to be disappointed waiting for an answer.


Turning to commercial products, the one I have used extensively is Acunetix Web Vulnerability Scanner (http://www.ebusinessmantra.com/buywebsecurityscanner.aspx). Right "out of the box", the product is easy to install, comes with detailed documentation, and support from the vendor. That's a big check plus for commercial products. Literally within few minutes after download, I had a list of vulnerabilities in the application I tested. I certainly cannot say that for the open source products. What value do you put to your time? Do you have time to learn use of open source products by yourself, especially in face of deadlines? Can you afford to remain vulnerable while you figure out how to use them? Can you afford to remain vulnerable while you wait for someone to answer your question? These are the questions you have to ask yourself.


Also of note: all products, open source and commercial, come with their faults in that they all report false positives and false negatives. So, the results of each application, open source or commercial, have to be evaluated for its correctness. Some may ask, why spend money if the outcome is not assuring? As we saw earlier, it is the time you save to get to the outcome, not just the outcome. The other advantage of a commercial product is that one product contains features that tests for various parameters whereas open source products are typically test for specific vulnerabilities. With open source you have to have multiple products to tests for a variety of parameters, for example, having a product for port scanning and another for scanning, file checks, directory checks, perhaps Google Hacking Database (GHDB), and so on. Now for the learning curve associated with each product, I think I would prefer commercial product and that should be true for all who are serious about vulnerabilities in their application.


Lastly, updates and bug fixes - how often are updates, fixes, and patches issued for open source products compared to commercial products? My first hand experience with Acunetix is that updates are issued at least once every two weeks. Can we say the same for WebScarab and Burp Suite?

So factors to consider when comparing open source and commercial scanner are:
• time to learn effective use of the product,
• features,
• customer support,
• product maintenance
• and one factor to ponder: can you wait to remain vulnerable while considering the other factors?

Now don't get me wrong that open source scanners don't have its place, so next time, I will talk about when and where an open source products can be effective.

Document Management

Is managing paper in your office driving up your overhead expenses? Are you spending too much time processing, searching, storing, retrieving documents, invoices, forms, statements, memo?

Document Management solutions does not mean scanning documents to PDF format and saving it on a CD. An effective document management solutions leads to transactional data management where documents in any format and information on any media are captured, validated, and stored for archival and retrieval. Append workflow and associated business rules to your document management solution information management that can be compliant to applicable laws.

Whether you have a paper flow problem, a home-grown document system or just want to increase your efficiency, we have solutions that can help your business.

Learn More

Web Application Security

Businesses cannot afford to compromise business data. Customer information, Product and Service data, all form the core of any business. If a business process credit card on their web site then they are required to be PCI-compliant.

A web site can be used as a condiut to access data and compromise company's vital resources. Businesses must prevent that from happening, ebusinessmantra has solutions that can help your business.

Learn More