Massachusetts’ Department of Revenue is not doing enough to protect the sensitive information of taxpayers. 

A recent report on the cybersecurity protocols of the Department of Revenue (DOR), compiled by auditor of the commonwealth Suzanne Bump, found that the DOR had no system in place to assess and document third-party vendor risks.

Furthermore, the audit found that the DOR had no documented and tested incident response procedures and had not established an information technology strategy committee. 

The department previously had a security review board, but the board has not been active since early 2017.

“Without a committee or board charged with governing DOR’s IT environment, responsibility for IT governance and risk is not clear. This can result in information security risks and investments not being aligned with business needs,” states the report.

“Without documented and tested incident response procedures, there is a higher-than-acceptable risk that DOR may not be able to respond properly to information security incidents, which may result in delayed identification of an incident, additional loss of data, or negative public opinion.”

The audit revealed that the DOR had failed to come up with an interdepartmental service agreement with the Executive Office of Technology Services and Security (EOTSS) that defined and documented updated roles and responsibilities despite having three years in which to do so.

The report states: “DOR management officials told us that they had been trying for three years to negotiate an ISA with EOTSS. They mentioned organizational and managerial changes at EOTSS as a cause of the delay.”

No instances in which sensitive data had been compromised were discovered, but Bump’s office found that the DOR “was not prepared to respond to or mitigate cyber-attacks it or its vendors face” and “did not have procedures in place to guide its response to IT security incidents.”

“The whole infrastructure for data security was missing at the Department of Revenue,” Bump said in an interview that aired Sunday morning on Boston TV show On the Record.

The report, which was published on December 13, covered the DOR’s IT and security-related activities from July 2016 through December 31, 2018.

New research into litigation trends has identified cybersecurity as a major new source of legal disputes in the United States.

The 2019 Litigation Trends Annual Survey conducted by global law firm Norton Rose Fulbright questioned corporate counsel about dispute-related issues and concerns.

Of the 287 lawyers polled, 44 percent said that they foresee cybersecurity and data protection as a new source of disputes during the next few years.

The results of the 2017 and 2018 editions of the Litigation Trends Annual Survey saw cybersecurity and data protection concerns coming to the forefront as a key challenge in dispute management. However, the trend saw a marked rise this year, with respondents reporting an increase in the number of disputes triggered by data privacy issues.

From 2018 to 2019, the number of in-house counsel who rated cybersecurity and data privacy as the most important litigation issue they faced doubled. More than half of those surveyed (52 percent) feel more exposed than previously to such disputes.

Respondents to Norton Rose Fulbright’s survey said that their concern over cybersecurity stemmed from the volume of threats, the creativity of threat actors, and the sensitivity of the data content. Counsel were also worried about some jurisdictions’ enactment of stringent data privacy laws.

Rapid growth in the size of the organization was also a key factor. One respondent quoted in the research wrote: “We’re growing at such a fast rate, in terms of the number of companies and the volume of work in the insurance industries, we have a large number of consumer-facing data points, so our consumer data retention is probably tripling yearly.”

Companies in 2019 whose in-house counsel took part in the survey spent $1.5m on average on disputes and employed 2.5 disputes lawyers per $1bn of revenue.

Researchers found that more than 80 percent of companies conduct third-party and/or in-house assessments of cybersecurity and data protection risks, and such assessments are helpful in reducing these types of risks.

Other findings of the research are that counsel predict a rise in litigation caused by an anticipated economic downturn. Thirty-five percent of corporate counsel—8 percent more than in 2018—expect disputes to increase in the next year. Nearly two-thirds of corporate lawyers said economic downturns lead to an increase in litigation cases.

Introduced in 2004, the Norton Rose Fulbright’s Litigation Trends Annual Survey is the longest-running survey of corporate counsel on litigation issues and trends.

Honda has become the latest big-name brand to expose the personal information of countless customers because of a cloud misconfiguration.

The carmaker’s North America business leaked around 26,000 unique customer records thanks to an unsecured Elasticsearch cluster, according to security researcher, Bob Diachenko.

He found 976 million records in total in the exposed database, including one million containing info about Honda owners and their vehicles — including names, contact details and vehicle information.

Although he was unable to confirm the volume of exposed records, Honda put the figure at just shy of 30,000.

“We are basing this number on a detailed review of the databases on this server, eliminating duplicate information and eliminating the data that does not contain consumer PII,” it said in a statement sent to Diachenko. “We can also say with certainty that there was no financial, credit card or password information exposed on this database.”

On the plus side, the company acted promptly to resolve the security issue, shutting the server on December 13, just a day after it was informed. However, it claimed the misconfiguration happened on October 21 and the database was first indexed by search engine BinaryEdge on December 4, leaving plenty of time for hackers to potentially scan for and find the trove.

Diachenko warned that it could be used to craft convincing follow-on phishing emails.

“The security issue you identified could have potentially allowed outside parties to access some of our customers’ personal information. We quickly investigated this issue, determined the specific breach in protocol, and took immediate steps to address the vulnerability,” the statement continued.

“Honda is continuing to perform due diligence, and if it is determined that data was compromised, we will take appropriate actions in accordance with relevant laws and regulations.”

The incident comes just months after Honda leaked 40GB of data on its internal security systems, via another unsecured Elasticsearch server.

A former IT administrator at Palo Alto Networks and four others have been charged with insider trading, in a three-year conspiracy said to have netted them over $7 million in profits.

According to a complaint filed by the SEC, Janardhan Nellore used his IT credentials and work contacts to access confidential information about his former employer’s financial performance and quarterly earnings.

He then allegedly traded Palo Alto Networks shares based on that information, and tipped off four friends: Sivannarayana Barama, Ganapathi Kunadharaju, Saber Hussain, and Prasad Malempati.

To cover up the scam, he is alleged to have told the group to use the code word “baby” to refer to the technology company’s stock. It’s also claimed that some of the group kicked back profits to Nellore in small sums to avoid scrutiny.

Nellore is said to have bought one-way tickets to India for himself and his family following an interview with the FBI, and was arrested at the airport. Reports suggest the group made over $7 million from insider trading activity that ran from 2015 to 2018.

“As alleged in our complaint, Nellore and his friends exploited Nellore’s access to valuable earnings information and attempted to hide their misconduct using code words and carefully tailored cash withdrawals,” said Erin Schneider, director of the SEC’s San Francisco Regional Office. “This case highlights our use of enhanced data analysis tools to spot suspicious trading patterns and identify the traders behind them.”  

Nellore and Barama are also the subject of criminal charges issued by the US Attorney’s Office for the Northern District of California.

Insider trading is increasingly facilitated by unauthorized IT access to digital information. In January this year, two Ukrainian nationals were charged with hacking the SEC’s Electronic Data Gathering, Analysis and Retrieval (EDGAR) system, which stores documents related to company disclosures including test filings made before announcements go public.

They then allegedly sold this information to insider traders, making over $4 million in the process.

The FBI has issued a warning to holiday travelers not to use public Wi-Fi on the road this Christmas because of cybersecurity concerns.

As internet users cross countries and continents to be with friends and family over the holiday period, the Feds argued that Wi-Fi hotspots should be avoided.

“Don’t allow your phone, computer, tablet, or other devices to auto-connect to a free wireless network while you are away from home. This is an open invitation for bad actors to access your device. They then can load malware, steal your passwords and PINs, or even take remote control of your contacts and camera,” it said in a “Tech Tuesday” post this week.

“If you do need to connect to a public hotspot — such as at an airport or hotel — make sure to confirm the name of the network and the exact login procedures. Your goal is to avoid accidentally connecting to a fraudster’s Wi-Fi that they are trying to make look legit.”

If using a public hotspot is unavoidable, the FBI urged users not to log-in to any sensitive accounts like their online banking. Where possible, the Bureau advised individuals to use their smartphones as a private hotspot for other devices.

Although these best practices have long been promoted by the information security community, users, including business travelers, continue to expose themselves to unnecessary risks by using public Wi-Fi without adequate security.

A 2018 study from iPass revealed that 81% of global IT leaders had recorded staff Wi-Fi-related security incidents over the previous year.

VPNs are seen as the best way to ensure traffic and web browsing sessions are protected from Wi-Fi snoopers. However, UK IT leaders were least confident (38%) that their mobile workers are using a VPN every time they go online.

The FBI warning comes just weeks after LA County’s district attorney issued a public security notice warning people not to use public USB charging points for fear of so-called “juice jacking” malware attacks.