Blog

The Wizard of Oz was right: “Pay no attention to the man behind the curtain.” That’s because according to an FTC settlement, computer company Lenovo should have been paying attention to the “man in the middle.” In this case, the “man in the middle” was preloaded ad-injecting software that put consumers’ personal information at risk from harmful man-in-the-middle attacks. When people first browsed a shopping site with their new Lenovo computers...

Ask a business person where their office is located and the likely answer is “everywhere.” They’re working from home, staying in the loop while traveling, and catching up on email between sales calls. For productivity’s sake, many companies give their employees – and perhaps clients or service providers – remote access to their networks. Are you taking steps to ensure those outside entryways into your systems are sensibly defended? If your...

The Hart Scott Rodino (HSR) Act and Rules require that parties to certain mergers and acquisitions submit premerger notification filings and wait before consummating the transaction. Parties must often balance the HSR filing requirement with a number of other regulatory requirements, as well as any conditions to closing. When planning an acquisition or merger, practitioners should pay attention to the specific timing parameters in the HSR Act, 15...

If you or your clients are in the tax preparation field, there are three letters you should focus on. OK, I-R-S may be the first thing on your mind. But as the FTC’s proposed settlement with TaxSlayer suggests, don’t forget those other important letters: G-L-B. Under the Gramm-Leach-Bliley Act, “financial institutions” – more on what that means in a moment – must comply with the Privacy Rule and the Safeguards Rule. The Privacy Rule requires...

Who’s coming in and what’s going out? Businesses that want to stick with security build commonsense monitoring into their brick-and-mortar operations. Whether it’s a key card reader at the door or a burglar alarm activated at night, careful companies keep an eye on entrances and exits. Your computer systems deserve the same kind of watchful attention, which is why Start with Security advises you to segment your network and monitor who’s trying to...

According to the “Mad Men” stereotype, you could spot an old-school advertising agency executive by the tailored wardrobe and expense account lunch. A lot has changed in the ad game, but two truths remain: 1) More than 50 years of FTC cases establish that ad agencies may be liable for their role in deceptive campaigns; and 2) Companies that may not describe themselves as “ad agencies” may still be held responsible for illegal acts or practices...

You’ve heard about Newton’s laws regarding bodies at rest and bodies in motion. A 21st century corollary is to protect sensitive information when it’s at rest on your network and implement effective safeguards when it’s in motion – for example, when a customer transfers confidential data from their computer to your system. Careful companies take the advice of Start with Security by storing sensitive personal information securely and protecting it...

How much information does Uber have about its riders and drivers? A lot. The FTC just announced a settlement addressing charges that the company falsely claimed to closely monitor internal access to consumers’ personal information on an ongoing basis. The FTC also alleges that Uber failed to live up to its promise to provide reasonable security for consumer data. Uber collects and maintains sensitive information about its riders – for example...

To make it harder for hackers to bluff their way onto a computer network, careful companies follow the advice of Start with Security and require strong authentication practices. We’ve considered FTC settlements, closed investigations, and the questions we get from businesses about implementing good authentication “hygiene.” Here are some tips on using effective authentication procedures to help safeguard your network. Insist on long, complex, and...

You’ve conducted an information “census” to identify and locate the confidential data in your company’s possession. Then you determined what you need to hold on to for business purposes. What’s the next step? According to Start with Security, it’s time to put limits in place to control access to data sensibly. It’s not a novel concept. You have a lock on the door to prevent after-hours access to your business and people can’t just stroll onto...