4 ms·

Here's the text of the newly signed bill: https://www.congress.gov/bill/117th-congress/house-bill/2471/text https://www.congress.gov/bill/117th-congress/house-b

Here's the text of the newly signed bill: https://www.congress.gov/bill/117th-congress/house-bill/2471/text https://www.congress.gov/bill/117th-congress/house-bill/2471... The ransomware reporting stuff is at the bottom; search for "ransom" and you'll find the section easily. Note this is amending existing law, so think of it as a legal diff. There may be important context not presented in this text.

pooper 5y ago
> Note this is amending existing law, so think of it as a legal diff. There may be important context not presented in this text. Thank you. I thought it was strange that it seemed a little vague what happens when I fail to report an incident. To me, it reads like if I fail to disclose, they can request me to disclose and give me 72 hours. I will be in contempt only after those 72 hours. So what is the incentive to report before being asked to report? What are the penalties for failure to report? Also it is not clear to me when that 72 hours starts. Who is the firm? Sometimes things take time to "bubble up" and get prioritized. I am sure there are people who have backlogs that span months. Thank you in advance for answering if you have a better understanding of the process. (:
- elliekelly 5y ago
  > Also it is not clear to me when that 72 hours starts. This is always the issue with mandatory incident reporting and, in my experience*, regulators tend to be fairly understanding. Generally the rule is the clock starts ticking "upon discovery" of the incident and there's usually a "reasonable likelihood" aspect. So even if you aren't certain a reportable incident has occurred you'd still be required to report an event you've discovered that you're reasonably sure is/may be a breach. Even that leaves lots of grey area, though. Is it "discovered" when the IT help desk worker comes across it or is it "discovered" when it comes to the attention of senior management? I think in most cases as long as it's timely(ish) reported regulators aren't going to be counting the hours and minutes. If I had an incident where a low-level employee "discovered" it and then sat on it for three days before management found out I'd probably just proactively explain the timeline/delay to the regulator when we reported it and I wouldn't expect it to be much of an issue. *I'll add the giant caveat that I've only dealt with (comparatively) low-stakes cybersecurity regulatory reporting. I suspect timeliness is much more important to DHS since the goal is national security rather than consumer privacy/preventing crime.
  - citizenpaul 5y ago
    The important thing here is all the do nothing high paying jobs this will create. Seriously. The bad thing is all the security incident response "experts" we will have to endure. Along with all the take my incident response course and such.
    - nullc 5y ago
      HELLO. I FOUND THAT YOUR WEB SERVER HAS DIRECTORY INDEX ENABLED. THIS MAY BE A MAJOR SECURITY INCIDENT.
  - sofixa 5y ago
    Regarding your point if a low-level employee sitting on it, it's all a matter of education, training, policy. When GDPR came in force, the security team at my then workplace informed every employee that any suspicion of a breach should be immediately brought to their attention so that they can help evaluate the seriousness of the suspicion. After such a policy is brought into effect, no employee will "sit" on it or they risk sanctions.

pooper 5y ago

> Note this is amending existing law, so think of it as a legal diff. There may be important context not presented in this text. Thank you. I thought it was strange that it seemed a little vague what happens when I fail to report an incident. To me, it reads like if I fail to disclose, they can request me to disclose and give me 72 hours. I will be in contempt only after those 72 hours. So what is the incentive to report before being asked to report? What are the penalties for failure to report? Also it is not clear to me when that 72 hours starts. Who is the firm? Sometimes things take time to "bubble up" and get prioritized. I am sure there are people who have backlogs that span months. Thank you in advance for answering if you have a better understanding of the process. (:

elliekelly 5y ago
> Also it is not clear to me when that 72 hours starts. This is always the issue with mandatory incident reporting and, in my experience*, regulators tend to be fairly understanding. Generally the rule is the clock starts ticking "upon discovery" of the incident and there's usually a "reasonable likelihood" aspect. So even if you aren't certain a reportable incident has occurred you'd still be required to report an event you've discovered that you're reasonably sure is/may be a breach. Even that leaves lots of grey area, though. Is it "discovered" when the IT help desk worker comes across it or is it "discovered" when it comes to the attention of senior management? I think in most cases as long as it's timely(ish) reported regulators aren't going to be counting the hours and minutes. If I had an incident where a low-level employee "discovered" it and then sat on it for three days before management found out I'd probably just proactively explain the timeline/delay to the regulator when we reported it and I wouldn't expect it to be much of an issue. *I'll add the giant caveat that I've only dealt with (comparatively) low-stakes cybersecurity regulatory reporting. I suspect timeliness is much more important to DHS since the goal is national security rather than consumer privacy/preventing crime.
- citizenpaul 5y ago
  The important thing here is all the do nothing high paying jobs this will create. Seriously. The bad thing is all the security incident response "experts" we will have to endure. Along with all the take my incident response course and such.
  - nullc 5y ago
    HELLO. I FOUND THAT YOUR WEB SERVER HAS DIRECTORY INDEX ENABLED. THIS MAY BE A MAJOR SECURITY INCIDENT.
- sofixa 5y ago
  Regarding your point if a low-level employee sitting on it, it's all a matter of education, training, policy. When GDPR came in force, the security team at my then workplace informed every employee that any suspicion of a breach should be immediately brought to their attention so that they can help evaluate the seriousness of the suspicion. After such a policy is brought into effect, no employee will "sit" on it or they risk sanctions.