3 ms·
Thank you. Understanding enough encryption to know how to protect your company data would take about 1 day of learning, every CEO should know this, no excuses.
by malux85 9y ago
Thank you. Understanding enough encryption to know how to protect your company data would take about 1 day of learning, every CEO should know this, no excuses.
I dont expect them to be able to debate cipher strengths or argue key length, but I do expect them to know about Machine-To-Machine communication, Data at rest, One-way encryption and what it takes to be HIPAA compliant etc, it's their job to know this, and it's NOT HARD. I makes me mad too.
- jnwatson 9y agoEquifax doesn't store medical data, so HIPAA doesn't apply. Here's the thing: short of some California disclosure laws, it isn't clear that Equifax broke any laws, or even any contracts. They don't have any particular duty to protect the data they have about you, other than protecting their own IP. Equifax is a clearing house for information that people say about you. Look, if I follow you around, reporting all your movements, write it down, and then my notes about you get posted on the internet, what law did I break? (Equifax used to report "his marital troubles, jobs, school history, childhood, sex life, and political activities", so it isn't that far of a stretch). Given that perspective, it makes sense that they would protect the data as much as any data vendor would. Certainly they didn't predict the PR backlash such a failure would cause and should have factored that in.
- Silhouette 9y agoThey don't have any particular duty to protect the data they have about you, other than protecting their own IP. They certainly do in much of the civilised world. The US is almost as far behind the norm in the modern world when it comes to privacy safeguards as it is in its banking and financial infrastructure.
- astura 9y agoThe FCRA gives them the duty to protect their information from unauthorized disclosure.