3 ms·
For more crucial PII (such as SSN, health data, payment info, etc), vendors are generally required to have certifications from a third-party auditor (such as SO
by n2d4 3y ago
For more crucial PII (such as SSN, health data, payment info, etc), vendors are generally required to have certifications from a third-party auditor (such as SOC2). If the big companies fail to check that, then yes, they can be made liable.
- adrr 3y agoNo rules or laws that require it. Closest requirement would be PCI around credit cards but you need lots of volume to be required to do an audit. HIPPA just requires you to do risk analysis and implement risk management. SOX is up to the auditor, when I was CTO at a public company, they were fine with me signing at attestation of all things we had implemented. Same with banks, no explicit requirement in both glba and fdic rules. Core bank systems are so old, none of that data is even encrypted neither is network traffic. Stuff is still in cobol. Forcing function would be cyberinsurance policies that typically want to see audit results if you have multi-million dollar policy limits.
- supafastcoder 3y ago> No rules or laws that require it It will just be FTC knocking on your door…
- malfist 3y agoThe FTC will absolutely not knock on your door if you expose users's SSN to the internet.
- jacobr1 3y agoOr the SEC, because one the breach/incident is public, the share price drops and failure to have disclosed those factors prior constitutes "securities fraud." Increasingly this it the default method of corporate regulation.
- adrr 3y agoFTC will come knocking at your door even if you do pass an external audit and have Soc2/soc1/iso certification. Equifax is an example.
- stackskipton 3y agoWho will promptly slap you on the wrist, wag their finger at you and send you on your way.
- throwawaaarrgh 3y agoHIPAA requires that no entity involved leak any PHI or penalties will be applied, you absolutely have to do more than "do risk analysis/management".
- adrr 3y agohttps://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/security/laws-re...
- zelon88 3y agoThere are state laws that this runs afoul of. https://www.mass.gov/regulations/201-CMR-1700-standards-for-the-protection-of-personal-information-of-residents-of-the-commonwealth https://www.mass.gov/regulations/201-CMR-1700-standards-for-...
- adrr 3y agohttps://www.mass.gov/doc/201-cmr-17-standards-for-the-protection-of-personal-information-of-residents-of-the-commonwealth/download https://www.mass.gov/doc/201-cmr-17-standards-for-the-protec... It’s very basic. There’s no best practices clauses it’s all “reasonable” clauses. Also no requirement for an external audit.
- l33t7332273 3y agoI think the fact that this is true and well known(amongst those that could abuse it) is evidence that infosec, by and large, is overemphasized.
- deleted 3y ago[deleted]