<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7651.59">
<TITLE>Fw: [Dataloss] time to name names (was Re: MORE BNY (Mellon Corp) Tapes lost)</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Two things<BR>
<BR>
I am guessing that the data includes customers from most of the 50 states given this is a major bank so the rules get very mushy given it is controlled by the state of residency.<BR>
<BR>
Second, some states like NY, do do not have an encryption exclusion at all.<BR>
<BR>
Mitch<BR>
<BR>
----- Original Message -----<BR>
From: dataloss-bounces@attrition.org <dataloss-bounces@attrition.org><BR>
To: security curmudgeon <jericho@attrition.org><BR>
Cc: dataloss@attrition.org <dataloss@attrition.org><BR>
Sent: Fri Jun 06 17:13:39 2008<BR>
Subject: Re: [Dataloss] time to name names (was Re: MORE BNY (Mellon Corp) Tapes lost)<BR>
<BR>
<BR>
----- Original Message -----<BR>
From: "security curmudgeon" <jericho@attrition.org><BR>
To: dataloss@attrition.org<BR>
Sent: Friday, June 6, 2008 1:06:01 PM (GMT-0800) America/Los_Angeles<BR>
Subject: Re: [Dataloss] time to name names (was Re: MORE BNY (Mellon Corp) Tapes lost)<BR>
<BR>
<BR>
Taking this one step farther, what if the tape *is* encrypted using really<BR>
strong encryption and the tape is lost. Does the company have to warn<BR>
customers?<BR>
<BR>
Certainly not in California. The Breach Disclosure law (originally<BR>
SB-1386) provides a safe-harbor for encrypted data. Not sure what the<BR>
other 42 US states do, but they modeled their laws along the lines of<BR>
California's to the best of my knowledge.<BR>
<BR>
If not, will that lead to companies claiming strong encryption<BR>
regardless,....<BR>
<BR>
This is a weakness in all Breach Disclosure laws. They do not specify<BR>
the type of encryption. While I agree that lawmakers are not the most<BR>
qualified people to determine appropriate ciphers, they could have at<BR>
least pointed to NIST standards as the minimum. That would have given<BR>
us 3DES and AES encryption. Right now, we have nothing. Very short-<BR>
sighted.<BR>
<BR>
Arshad Noor<BR>
StrongAuth, Inc.<BR>
<BR>
_______________________________________________<BR>
Dataloss Mailing List (dataloss@attrition.org)<BR>
<A HREF="http://attrition.org/dataloss">http://attrition.org/dataloss</A><BR>
<BR>
Tenable Network Security offers data leakage and compliance monitoring<BR>
solutions for large and small networks. Scan your network and monitor your<BR>
traffic to find the data needing protection before it leaks out!<BR>
<A HREF="http://www.tenablesecurity.com/products/compliance.shtml">http://www.tenablesecurity.com/products/compliance.shtml</A><BR>
</FONT>
</P>
</BODY>
</HTML>