CRS Report - Data Security & Breach Notification Legislation: Selected Legal Issues

Thanks to our friends at the Federation of American Scientists, the recently issued Congressional Research Service (CRS) report entitled Data Security and Breach Notification Legislation: Selected Legal Issues has been made available.

https://www.fas.org/sgp/crs/misc/R44326.pdf  (21 Pages)

This is a focused report providing a review of the following:

• Proposed Legislation introduced in the 114th Congress on Data Security and Breach Notification
• Discussion about State Data Breach Laws (very brief)
• Legal Analysis of:
• Preemption of State Laws, Regulations, and Claims should Federal Law(s) be Passed in this Area
• Agency Enforcement of Data Security and Breach Notification Requirements

Some interesting takeaways from this report:

1) 47 US States, the District of Columbia, and three US territories (Guam, Puerto Rico, US Virgin Islands) have enacted data security laws.

2) Alabama, New Mexico, and South Dakota have not enacted breach notification laws.

3) Massachusetts has issued regulations requiring persons who own or license personal information about a Massachusetts resident to "...develop, implement, and maintain a comprehensive information security program..." (201 Mass. Code Regs. 17.03(1))  Such a program must be in writing and contain administrative, technical and physical safeguards appropriate to the size and type of business, available resources, and amount of stored data.  Businesses must also conduct an annual review of security measures.

4) (Excerpt on Federal Preemption of State Data Security Laws - Page 15 )

5) (Excerpt on Agency Enforcement - Page 19)

Overall, this is an interesting read on the implications of possible Federal legislation in the domain of data breach laws primarily addressed by US state laws.

###

Rule #1 -- Protect the Data

In today's Utility Intelligence email newsletter there is an article by Mr. Russel Van Tuyl entitled "Cybersecurity rule #1: Know your network."

His article for energy/utility executives notes that the new NIST cybersecurity framework and even the Department of Energy  Electricity Subsector Cybersecurity Capability Maturity Model (ES-C2M2) can be used to argue that the first thing you need to know is your network so you can better defend it.

I will not argue that knowing your network architecture is important; however, what I will argue is that the first and foremost thing you need to know is where your data is and where your control systems are and how they are protected.

Knowing a network architecture will not help prevent a breach when your CEO loses a USB drive with critical corporate information.  Also, knowing your network presumes that your "perimeter" will protect you.  

Sadly, the perimeter and "castle and moat" methods of cyber security defense are not the most effective in protecting systems and data in today's "perimeterless" networks.

Cheers!