As all non-banking financial institutions – such as mortgage brokers, auto dealerships and others – prepare for the looming FTC Safeguards Rule deadline, we wanted to dive into three top challenges of meeting the new requirements.
The new Safeguards Rule has nine elements — many with multiple sub-points — that companies must complete to avoid getting hit with fines of $45,000 per violation.
So which of those nine will be the toughest for organizations to complete?
A risk assessment means taking a look at every possible threat within your environment — both internal and external — and evaluating the potential risk. This written assessment will vary greatly for each organization as it evaluates the security, confidentiality, and integrity of customer information.
What makes this so difficult?
Required Skill Set. The personnel doing the risk assessment must have the right skill set to not only identify the possible threats but also determine the criteria for evaluating those risks. However, smaller organizations likely won’t have an in-house staff member with these skills, let alone the bandwidth to perform a full assessment.
It’s A Long Process. Just to start a risk assessment you have to complete a full data and systems inventory (its own FTC Safeguards checkbox). Then you’ll need to develop criteria, analyze the risk of each system, and then create the assessment itself.
Download Blumira’s Free Threat Assessment >
According to a recent Stanford study, 88% of data breaches are caused by human error. It’s easy to see why the FTC added security awareness training to the Safeguard Rule. There are two components to this requirement: 1. Ongoing training for all employees and 2. Specialized security training for those running the security program to ensure they stay updated on the latest security trends.
What makes this so difficult?
It involves everyone and is ongoing. Like most things, the more people that have to be involved, the harder it is to do. The FTC also requires “regular refreshers,” which makes this an ongoing process.
It’s very vague. How much training is needed — not just for the general staff, but also for the designated security staff? Do they need certifications or just advanced training? Is there an hours requirement? The FTC doesn’t specify
Collecting and monitoring system logs is one of the most effective ways to detect and stop suspicious activity. Because of that, the FTC now requires companies to have a system in place to collect logs such as a security information and event management (SIEM) platform, as well as written policies and procedures to support it. Monitoring log activity will help detect unauthorized access or use of, or tampering with, customer information.
What makes this so difficult?
Logs are everywhere. Most likely every software and system you’re using is producing security logs. But who’s looking at them? What story do they tell? It can be difficult to prioritize which logs are most important to ingest — especially if your SIEM vendor charges based on log ingestion.
Great, you’ve identified a threat. Now what? While the focus of the FTC Safeguard Rule is around logging and detection, the real benefit comes from taking action on the detection. But that’s all for nothing if you don’t have the internal (or external) knowledge to know how to actually mitigate the threat.
Blumira is a cloud-based SIEM that’s built for small teams by doing a lot of the heavy lifting, but with the extra staffing costs.
Pros:
Cons. While our pricing model is simpler and tends to me more affordable than other solutions, it’s not free. Oh wait — it is. Our base tier provides logging with detection and response for M365.
Interested in learning more about how Blumira can help you meet the new FTC Safeguards Rule? We help check the boxes with more than just logging, including your incident response plan, customer information access controls, data encryption, and pen-testing and vulnerability assessments.