Issue 5  March 28th 2021

EU Data Transfer Requirements and U.S. Intelligence Laws: Understanding Schrems II and Its Impact on the EU-U.S. Privacy Shield

On July 16, 2020, in a decision referred to as Schrems II, the Court of Justice of the European Union (CJEU) invalidated the EU-U.S. Privacy Shield (Privacy Shield). Privacy Shield is a framework developed by the European Union (EU) and the United States to facilitate cross-border transfers of personal data for commercial purposes. Privacy Shield requires companies and organizations that participate in the program to abide by various data protection requirements and, in return, assures the participants that the transfer is compliant with EU law. The CJEU, however, found Privacy Shield inadequate in part because it does not restrain U.S. intelligence authorities’ data collection activities. According to the CJEU, U.S. law allows intelligence agencies to collect and use the personal data transferred under the Privacy Shield framework in a manner that is inconsistent with rights guaranteed under EU law. The CJEU focused on Section 702 of the Foreign Intelligence Surveillance Act, Executive Order 12333, and Presidential Policy Directive 28, which govern how the U.S. government may conduct surveillance of non-U.S. persons located outside of the United States.

Continue reading click here.

congress.gov  

Phishing Attacks that Defeat 2FA Every Time

Protected with 2FA? Think Again.

Two-factor authentication (2FA) is certainly a best practice for corporate security, but cybercriminals are also quite good at defeating it, often without a user’s knowledge. However 2FA is not a panacea and just like cyber awareness training, it is just one part of a total protection program. Assessing the risk of bypassing 2FA is an important part of any risk assessment, so we thought it would be helpful to review some of the threats we repeatedly encounter that defeat 2FA or multi-factor authentication (MFA).

Continue reading click here.

securityboulevard.com  

Oil giant Shell discloses data breach linked to Accellion FTA vulnerability

Shell has disclosed a data breach involving stakeholders that exposed personal information records.

The oil and gas company said an unknown threat actor managed to gain access to "various files" during the time of intrusion which included personal data and information "from Shell companies and some of their stakeholders."

Shell has not disclosed how many individuals are involved in the security incident beyond saying that impacted parties have been contacted, alongside law enforcement agencies and regulators.

The firm added that it does not appear core IT systems have been compromised, as the route of access was isolated from the rest of Shell's central infrastructure.

However, the data breach has been connected to Accellion's File Transfer Appliance (FTA), enterprise software used to transfer large files -- and a solution linked to a string of security incidents in December 2020 and January 2021.

Continue reading click here.

zdnet.com