New Cybersecurity Rules To Impact Baton Rouge Businesses
Key Points:
- The risk of cyber attacks affecting every business remains high with the adoption of remote work, increased reliance in e-commerce, and encouraged internet use for business.
- The government has left private businesses to deal with cyber incidents independently for several decades.
- However, the recent spike in cyber attacks has rippled across society and borders, forcing governments to consider new laws and regulations.
- While many governments struggle to define the technology to control, the US has a whole suite of regulations and enforcement to ward off cybercriminals.
- Your business needs to understand the regulations the government is considering, ascertain the uncertainties, review potential impact, and prepare to act.
Cyber attacks have rippled across society and borders, catching the government’s attention. Initially, governments left businesses to deal with cyber incidents. However, the increased reliance on the internet, the world shifting to remote work, and Russia’s invasion of Ukraine have caused a surge in cyber attacks. This has prompted governments to consider new laws and regulations to protect users.
While many governments worldwide struggle to define what business technology to regulate, the US legislature focuses on cybersecurity concerns in several ways.
Why The Government Has Hard Time Controlling Cybersecurity
Several governments focus on privacy rather than cybersecurity. For instance, the government requires businesses to report cyber-attack incidents to appropriate authorities if attackers steal private information such as names and credit card information.
However, if the attack does not entail the theft of private data, no business is obligated to report it. As a result, it’s complicated for the government to tabulate the number of cyber attacks and the different forms they take.
Research shows that only 25% of cyber incidents are reported — a discouraging statistic that hinders the government’s ability to measure and manage incidents of cyber attacks.
What Cyber Incidents Businesses Should Report
The US Congress, Securities and Exchange Commission (SEC), the White House, and other regulatory bodies are considering new laws requiring businesses to report cyber incidents.
The government appears to focus more on critical industries such as:
- Healthcare
- Energy
- Financial services
- Communication
While filing a report on cyber attacks appears to be reasonable, the existing laws are unclear on what counts as a cyber incident, although it may include the following:
- An incident that could have led to a data breach but didn’t lead to an actual breach
- An attacker trying to log into your system but couldn’t because of a wrong password
- A phishing email
- A cybercriminal looking for a vulnerability to exploit in your system
However, the official definition of a cyber incident suggests an action that imminently jeopardizes a system.
Such a definition creates a lot of ambiguity and uncertainty. For instance, when an attacker tries to log into your system but is denied access, a company may not perceive that as an imminent threat. The ambiguity requires organizations and regulators to find a balance.
On the other hand, an overly broad definition might mean that a large company would have to report thousands of incidents per day, even when most attempts are spam emails. Reporting all such incidents presents a challenge for companies to generate reports for each incident and for agencies to process and make sense of the deluge report.
What Your Company Can Do Now
As the government considers new resolutions to deal with cybersecurity, your business can take several measures to ensure you stay on the right track by executing the following:
1. Ensure Your Procedures are Up to the Task
Your company should quickly identify its tech solutions and review its current policies and procedures to ensure you remain compliant with new regulations. You may need to revise your business operations and streamline them with the government’s new regulations.
You must ensure your procedures protect your IT system, network, data, and applications from intrusion, attacks, and other cyber threats.
The inherent challenge is that attack vectors change. A single weak point in your procedure can undo what appears to be a well-designed strategy. Your business faces a constantly evolving security threat, requiring you to upgrade your procedures to stay safe regularly.
IT professionals who stay current with emerging threats can help secure your systems.
2. Update Your Ransomware Policies Regularly
The government is formulating new regulations around ransomware. Initially, the law guided businesses in reporting incidents of ransomware attacks and how to pay a ransom. However, the new regulations may forbid ransom payments.
It’s essential that your business reviews its ransomware policies. Soon, you’ll have to change your approach because the government will update the laws regulating ransomware.
Consider reviewing the following:
- The minimal infrastructure you need to run the business
- How your staff should communicate in case an email is compromised by ransomware
- Selecting potential first responders such as legal counsel, forensic IT specialists, a crisis communication firm, and a consultant to negotiate a ransom
- Circumstances that necessitate ransom payout
- Monitoring after a ransomware attack
- A review of your IT security
- Litigation and enforcement procedures
3. Prepare For Software Bill of Material
For years, many businesses didn’t know they had the log4j — malicious software that recorded all activities in a computer system because it came bundled with other software.
The government proposes that organizations maintain a detailed and up-to-date Software Bill of Material (SBOM) to prevent earlier mistakes. An SBOM can help businesses quickly and accurately know all the software they embed in their complex computer system.
While the SBOM is critical in other functions, the law might require your business to change how you develop the software.
Essential Solutions Can Help Your Business Review the Proposed Regulations
Your business needs a specialist or a group of experts to help you review the proposed laws and how they’ll impact your organization. The new regulations are rarely technical information you can leave to your cybersecurity team.
The government’s proposed regulations have organization-wide implications that will likely impact your company’s procedures and policies. Since the new regulations are still malleable, Essential Solutions can help your organization actively influence the direction the regulations take. Contact us today to help implement and enforce the government’s new cybersecurity laws.
