Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

FTC Increases Targeting of Companies Lacking Cyber Protection

Client Alert
May 13, 2024

Here is how businesses can develop cyber strategies to mitigate breaches and financial risk.

The Federal Trade Commission (FTC) recently released a comprehensive cybersecurity report outlining key findings and recommendations based on emerging threats, trends in data breaches, and strategies for businesses to enhance their cybersecurity posture observed over the last year. The FTC strives to protect consumer privacy and respond to the evolving ways that companies use consumer data such as in the development of artificial intelligence models and misuse of health data. 

Importantly, the report emphasized the need for proactive measures to mitigate risks and highlighted the FTC’s initiative in targeting companies that fail to implement reasonable data security measures to protect consumer data. 

Here are some key strategies for businesses: 

  1. Risk Assessment and Management: Conduct regular risk assessments (at least annually) to identify potential vulnerabilities and prioritize them based on their potential impact on the business. Develop and implement a risk management plan to address these vulnerabilities effectively.
  2. Cyber Security Policies and Procedures:  Implement basic cybersecurity policies to protect its assets, data, and operations from cyber threats.
  3. Employee Training and Awareness: Educate employees about cybersecurity best practices, such as recognizing phishing emails, using strong passwords, and reporting suspicious activity. Regular training exercises help reinforce awareness.
  4. Access Control and Privilege Management: Implement strong access controls to limit user privileges and restrict access to sensitive data and systems. Use multi-factor authentication (MFA) where possible to add an extra layer of security.
  5. Data Encryption: Encrypt sensitive data to protect it from unauthorized access. 
  6. Patching: Keep software and systems up to date with the latest security patches to address known vulnerabilities. Establish a patch management process to ensure timely deployment of patches across the organization.
  7. Network Security: Deploy firewalls, intrusion detection/prevention systems, and other network security measures to monitor and protect against unauthorized access and malicious activity. Segment networks to limit the spread of potential breaches.
  8. Incident Response Plan: Develop a comprehensive incident response plan that outlines procedures for detecting, containing, and mitigating cybersecurity incidents. Test the plan regularly through tabletop exercises and simulations.
  9. Vendor Risk Management: Assess the security practices of third-party vendors and service providers to ensure they meet your organization's security standards. Include contractual clauses that outline security requirements and responsibilities.
  10. 10. Cyber Insurance: Consider obtaining cyber insurance to mitigate financial risks associated with cybersecurity incidents, such as data breaches or business interruptions.

By adopting a proactive approach to cybersecurity and implementing these strategies, businesses can enhance their cybersecurity posture and better protect themselves against evolving threats and complying with ever increasing legal obligations.  

BMD assists companies design and implement a strategy to achieve technical and organizational controls to bolster cybersecurity and data protection.  

If you have any questions regarding this topic and how to protect your company's data, please contact BMD Member Brandon Pauley at btpauley@bmdllc.com.

Cybersecurityfederal trade commissionBrandon PauleyConsumer PrivacyArtificial Intelligence
Client Alert

Ramping Up – A Quick Guide to Pressing COVID-19 Employment Law Issues

November 19, 2020As the country continues to grapple with a global pandemic that now seems to be never-ending, businesses everywhere are waking up to realize that the calming of the COVID-19 employment issues over the summer has come to an end. As cases rise exponentially in all 50 states as we head into the winter months, the number of employment issues related to COVID-19 will also increase dramatically. For these reasons, it is important that we return to the employment law basics that were covered this prior spring, while highlighting the many lessons we have learned along the way. As COVID-19 matters and concerns continue to hinder the working environment of every business, it is important that you reference this review to guide you through these tough issues and questions.Client Alert

Your Workplace Under Biden

November 9, 2020This is my favorite recurring post – Predictions of How a New Administration Will Affect Your Workplace. Four years ago, we accurately called the emasculation of the 2016 proposed FLSA Overtime Rules (the salary exemption threshold was set at $35,568 in 2019, rather than $47,476 as proposed), we forecasted a conservative shift of the NLRB and its results (a roll-back of employee rights, social media policy evaluations, and joint employer rules), and we nailed the likelihood of multiple conservative appointments to the United States Supreme Court and its long-term effects (although I completely failed to predict that my ND classmate Amy Coney Barrett would fill the final vacancy during the Trump administration). This time, the L+E Practice of BMD has decided to make it a group effort at predicting what will happen, what probably happen, and what might happen under President Biden. As always, please save this in your important files and pull it out four (or eight) years from now to judge our accuracy.Client Alert

HHS Provider Relief Funds Reporting Requirements: Important Updates Every Provider Should Know

November 4, 2020HHS continues to revise its reporting requirements for the use of the Provider Relief Funds. Providers with more than $10,000 in Provider Relief Fund payments must report on the use of the funds through December 31, 2020. The reporting window will begin on January 15, 2021 and providers must complete reporting obligations for FY 2020 by February 15, 2021 through a portal designed by HHS. However, providers that have unexpended funds as of December 31, 2020, will have an additional 6 months to use the remaining funds through June 30, 2021. These providers must submit a second and final report no later than July 31, 2021.Client Alert

Should I Apply for Phase 3 Funds? Important Considerations Every Provider Should Know

November 2, 2020On October 1, 2020, the Department of Health and Human Services (“HHS”) announced an additional $20 billion in new funding for providers through a Phase 3 distribution. Importantly, providers that previously received HHS Provider Relief Funds or already received payments of approximately 2% of annual revenue from patient care are eligible to apply. Eligible providers have until November 6, 2020 to apply for these Phase 3 Funds. However, the question from providers continues to be: Should I Apply for Phase 3 Funds?Client Alert

CISA Ransomware Practices

October 29, 2020On October 28, 2020, the United States Cybersecurity and Infrastructure Security Agency (CISA) issued an alert warning of imminent threats to US hospitals and healthcare providers. The specific threat involves RYUK Ransomware attacks. RYUK is a novel ransomware that goes undetected by commercial anti-virus/malware detection programs. Once deployed, RYUK encrypts all data and disables systems. In short, it cripples all functionality down to phone systems and automated doors. Healthcare providers should alert their employees to remain hyper-vigilant and report any suspicious activity seen in email or on networks. It has been reported healthcare providers in New York, Pennsylvania and Oregon have been targeted in the last 48 hours. If your organization encounters issues, BMD can assist in mobilizing a response team and has contacts with forensic IT firms that are familiar with RYUK. It is advisable to engage professionals with experience dealing with this specific threat.
Older posts
Newer posts