National Data Breach Law Advances 51
Trailrunner7 writes "Two separate bills that would require organizations to notify consumers when their personal information has been compromised have made their way out of committee in the Senate, a critical step toward the creation of a national data-breach notification bill. But the Data Breach Notification Act, S.139, exempts federal agencies and other organizations subject to the bill from disclosing a breach if the data involved in the breach was encrypted. This is a clause that has caused some controversy, as some experts say that simply encrypting data does not render it useless. Also, S.139 would grant an exemption for data that 'was rendered indecipherable through the use of best practices or methods, such as redaction, access controls, or other such mechanisms, that are widely accepted as an effective industry practice, or an effective industry standard.' That is a very broad exemption that could become a sticking point as the bill moves along. The terms 'access controls' and 'other such mechanisms' encompass a huge number of technologies."
MPAA/RIAA would say... (Score:2)
Re: (Score:2)
Easier solution (and you'll never lose the decryption key):
Just say all your data is encrypted via DOUBLE ROT13.
Toothless (Score:3, Interesting)
The law would be able to benefit us and punish corporate greed and misbehavior when it comes to data protection but thanks to the corporate interests in the pockets of our lawmakers this law has been made ineffective. The law probably doesn't even specify what punishment would be affected and if it does it's probably so small that most corporations would rather pay it than implementing the technology it requires to satisfy the law. It would probably be even harder to find punishments or personal liability of the corporate officers that make decisions around the compliance with the words. And as it advances through several other levels of lawmakers (house, president, back to congress, rewriting, ...) it will probably become even more bland.
If the law were to affect us, simple peasants and benefit corporate interests when breached, you could bet on it that long prison sentences and fines would be involved with it as is the case with the DMCA, ACTA and general 'intellectual property' laws.
To Summarize Parent: (Score:2, Insightful)
Corporate interests? (Score:4, Insightful)
Dude, if you own stock, you ARE the corporation...
Oh, this will be easy... (Score:4, Insightful)
"I'm sorry, but we cannot disclose such an event because the data was indeed encrypted... in our new and highly-advanced ROT-0 encryption algorithm."
Re: (Score:2)
"Everyone knows our competitors' ROT-0 encryption is easy to break. It's got a 0 in it so it must be useless garbage. If you want heavy-duty encryption at an affordable cost, use our SIX-round ROT-13 encryption system that's guaranteed to keep your data safe or your money back(*). Call now and we'll upgrade you to our professional heavy-duty first-class TWELVE ROUND ROT-13 system for only $5 more! That's double the rounds, so it's got to be better, right?"
[in 2-point
Re: (Score:2)
And for a limit
Re: (Score:2)
Bah. You people with your ROT-13's and your ROT-26's. I use ROT-676. Yes, that's ROT 26 SQUARED. And I'm finishing up plans to upgrade to ROT-26-To-The-26th-Power. Let's see you crack that!
Re: (Score:2)
You are missing the point (Score:1, Interesting)
The intention isn't to make everything 100% secure at first. That just wouldn't be feasible. The way I see it, this might be very efficient in improving the overall situation over time.
You can get yourself exempt from a lot of the responsibility by implementing encryption? What kind of a manager would not do their best to achieve that? There needs to be some significant carrot like that to encourage the managers to really want it.
And as you are going to implement some practices regarding them anyways, you c
Re: (Score:2)
The intention isn't to make everything 100% secure at first.
The intent of the law isn't to improve security at all. The law is supposed to force companies to notify the people that might be affected when a data breach occurs, so that the people whose data was lost can take appropriate action, such as contacting their credit card company that their card number has been stolen. No security system is perfect, so there needs to be a requirement that people are notified when their data is stolen, no matter how much security was in place.
Re: (Score:1)
Sure there is. It's made up of three words that anyone in the corporate working world can understand.
"Corporate Death Penalty"
Re: (Score:2)
Don't make me drug you and beat you with a wrench!
Access Controls (Score:3, Interesting)
Sounds like they're saying that putting a BIOS password on a laptop means they don't have to tell anyone the next time they lose 500 million social security records, huh? Or heck, if BIOS passwords are too difficult, it could always just have user accounts. Those count as "access controls", too.
Combined with the idea of the government managing our health care, I'm not terribly encouraged by the idea.
Re: (Score:2)
Considering that the theft of credit card information that happened to TJ Maxx and other stores was done while the data was protected by Access Control Lists, I'm not sure this bill is worth the paper it is printed on. Does my Windows Logon constitute reasonable and industry-standard Access Control? Does it count if my keyphrase to my encrypted volume is "password", "god" or "John"?
The point of industry-standard security in most cases is just to make sure no one can just drive-by and clean everything out. I
Re: (Score:2)
Combined with the idea of the government managing our health care, I'm not terribly encouraged by the idea.
You mean other than private companies, whose sole reason of existence is to make as much money off you while giving you as little as possible? Either legal or trough bribery. Who literally will throw you out of the hospital with broken ribs, to die on the street. (Yes, I've seen that happen.) And who are in no way related to your actual health?
Yeah, I really hope you can keep those companies. Then I don't have to strangle you with my bare hands for being such an unbelievable retard, but can just let the HMO
Why industry standards? (Score:5, Interesting)
rendered indecipherable through the use of best practices or methods, such as redaction, access controls, or other such mechanisms, that are widely accepted as an effective industry practice, or an effective industry standard
Doesn't ISO (International Organization for Standardization) have... standards for these kinds of things?
Industry standards are the corporate version of "all the other kids are doing it".
And seriously, I don't think self-regulation (aka industry standards) is going to cut it for data security.
Re: (Score:2, Insightful)
Especially when security is a measure of current technology. Encryption levels that today render data "undecipherable" will not remain constant over time. Look at how many techniques have been rendered useless over time. Even high bit level means little because of possible flaws in technique, not even mention the possibility of simply storing data and waiting for quantum computing to become commercial.
Protecting the megacorps (Score:3, Interesting)
That's what this does: "S.139 would grant an exemption for data that 'was rendered indecipherable through the use of best practices or methods, such as redaction, access controls, or other such mechanisms." It's akin to the Audit the Fed bill was rendered harmless by allowing the federal reserve to black-out names of persons/organizations that received money. It's meaningless.
I honestly don't understand Congresscritters who sell-out like this. Is keeping their job so important that they'd bend to the will of their corporate donaters and ignore their basic "don't be evil" morals?
Re: (Score:2)
I honestly don't understand Congresscritters who sell-out like this. Is keeping their job so important that they'd bend to the will of their corporate donaters and ignore their basic "don't be evil" morals?
Congresscritters have "don't be evil" morals?
I thought you pretty much to have "be evil" morals to get to Congress.
Re: (Score:2)
Re: (Score:2)
The exemption should totally ignore the idea of what is considered best practices, and just ask: can the information be used? If it can, then notification should be required. If the information is safe, then don't worry too much.
It sounds like they're trying to codify a reasonable approximation of "is there anything to worry about", and maybe got it slightly wrong. Or maybe not, depending on what "effective" here means... although I don't think there are any access controls other than encryption that are effective against someone yanking the drive and reading it with a different system.
wow.... (Score:1)
Access Controls? (Score:3, Interesting)
S.139 would grant an exemption for data that 'was rendered indecipherable through the use of best practices or methods, such as redaction, access controls, or other such mechanisms, that are widely accepted as an effective industry practice, or an effective industry standard.
In essence, this means the only companies required to report a data breach are the ones that keep their information in a publicly facing database with no authentication.
"widely accepted"?? (Score:2)
that are widely accepted as an effective industry practice
Windows is "widely accepted as an effective industry practice"; that doesn't make it so. Most people are not very good at security and will "accept" stupid practices.
Redaction Reaction Recitation (Score:3, Informative)
I am not sure the proposed law does much if redaction is all it takes to get a pass. From Law.com:
Read more... [law.com]
Re: (Score:2)
Good idea, wrong language (Score:4, Interesting)
"Also, S.139 would grant an exemption for data that 'was rendered indecipherable through the use of best practices or methods, such as redaction, access controls, or other such mechanisms, that are widely accepted as an effective industry practice, or an effective industry standard.'"
I think that the whole purpose of this is to cover things like storing passwords, etc., as hashed data. That's something I tried to get into Virginia's data breach law (and will probably give it a shot again this year), but try explaining the concept of "cryptographic hashes" to legislators who are mostly lawyers. Three guys on the subcommittee got it (engineers and tech guys), but it was WAY over everybody else's heads.
And it's not just the legislators. the LexisNexis lobbyist went ballistic over the idea until she talked to somebody in her IT department, because she didn't understand what was going on.
I understand what this language is supposed to do, but it's just poorly crafted.
Well I feel perfectly safe now! (Score:1)
I for one welcome our ROT13 encoding overlords.
Encryption doesn't mean the data is secure (Score:5, Informative)
Encryption is not a cure all for security needs. It is merely a tool, similar to locks on the door, guards with M16s, and CCTV cameras. Poorly implemented, it could mean little to a clued attacker, and businesses need to realize that the clued attackers are far more common that they think.
One example: Say someone uses the hardware encryption on a tape drive. Tape drives can have encryption set in multiple ways. It can be manually set for all tapes, or the backup application can manage keys and set the encryption pet tape. If an organization is slipshod about the way they use the encryption and use one key for all tapes, and have that key information written on the proverbial slip of paper on the monitor, then an attacker can grab the tapes, perhaps grab a tape drive or buy one, and decrypt the info to their hearts content. Compare this to an organization which uses more stringent backup procedures so that even if a tape is stolen by an insider, it won't be decodable.
Another example: BitLocker. If implemented right, BitLocker is solid against most known threats (avenues like rubber hoses and RAM scanning via IEEE1394 are different). However, if someone installs BitLocker and then disables all key protectors, to a competant attacker, the BitLocker protection is dealt with. Same with people using BitLocker on machines without TPMs using USB flash drives, and not making sure the flash drive is stored securely.
There are various implementions of encryption. ECB is a bad version (because an attacker can figure out what a block matches to). A good implementation might use multiple diffusers and an algorithm like XTS so an attacker can't compare sector 55 with sector 157 and determine if the contents are similar. So, even though a program might use AES, if salts and other crypto concepts are not used, it severely weakens security.
Finally, TrueCrypt. If someone thinks that TrueCrypt fixes all their security issues and doesn't concern themselves with attacks over the wire, an attacker can either slap a keylogger on a machine, or just read the volume decryption keys from memory, then at a later date grab the disks if there is too much data to fetch from remote. If TrueCrypt is used with proper protection against network attacks (firewall, etc.) then it provides excellent protection.
I am concerned that a law exempting breaches from being disclosed would only work in the blackhat's favor. In theory, someone could rot13 the data on the drive, or AES it with an all zero key to make the security that comes with encryption meaningless.
Re: (Score:1)
Law is best if it is technology wordiness agnostic. If it is tied to a specific vendor or method as soon as its law that vendor goes casters up or method is cracked. Then the law has to be changed by due process.
It would be best to point the Law to a having a working "policy" document such as something in the NIST 800 series. Each company or government agency could then determine and publish the exact level of security they want but no less than a minimum. Not everything should be .mil hard encryption but d
Re: (Score:2)
Key escrow is a bad concept in general. Even for a medium sized business, it takes some planning headaches, especially if people factor in having access by multiple employees in case one of them dies, goes rogue, or just quits and refuses to divulge the keys.
The biggest problem with key escrow is the "all eggs in one basket" issue. The more keys stored in a certain location, the more high value the target becomes. After a certain threshold with a large amount of corporate keys stored, it becomes economic
Access Controls != No Access (Score:2)
"Sure, Ryan and his boys can make it hack-proof. But that don't mean we ain't gonna hack it."
Root cause analysis (Score:4, Informative)
30+ years of experience suggest limits on secrets (Score:1, Informative)
A few years ago, at one of the last National Information Security Systems Conference meetings, one of the speakers noted that for 30+ years, people had been trying to make multilevel secure databases, with lots of very clever methods tried.
All these efforts failed.
It was found that you could keep all those secrets securely, but performance in retrieving any of them went off a cliff. If you wanted good performance, there were always open channels.
The relevance is that Nature may be trying to tell us here tha
If encryption is "best practice" ... (Score:2)
Why is the default for filesystems to be unencrypted?
Why is the default for email unencrypted?
In fact, in any current OS, Windows/Linux/OSX, I have to go out of my way to add encryption to either my data or my email. And if I do encrypt my email, I will just get blank stares from the recipients, because their client will not have a clue.
DMCA set this up for failure! (Score:1)
There should be no exemptions (Score:1)
The company should be allowed to explain what type of encryption the data was protected with when informing customers of the breach
But should not be relieved of the notification. Mere data encryption does not assure the info has not been exposed and won't be, based on the breach.
Now if we could just get two of these laws (Score:2)
... our National Data wouldn't be walking around without pants.