Weekly Security News for the Week Ending March 20, 2020
Senate Kicks the Can Down The Road Again With FISA Renewal
Last week it looked like Congress was going to renew the parts of the Foreign Intelligence Surveillance Act that DID EXPIRE last weekend. But Congress being Congress, they didn’t. On Monday the Senate agreed to kick the can down the road for 77 days. Now the House has to agree. In the meantime, I am not sure what the NSA is doing about those expired provisions and they only plan to kick the can down the road on two of the three expired provisions. In fairness, Trump wants to reign in the Intelligence Community since he doesn’t trust them and never has. This could work to the advantage of the privacy advocates. Source: Reuters
Covid-19 Web Site President Said Google Would Bring Online Monday is Online But Not Like he Said
Google/Alphabet subsidiary Verily launched its Project Baseline Coronavirus website, but it is not national, it only covers two counties in the San Francisco Bay area. It was supposed to allow people to make appointments to get tested, but the few slots that were available filled up instantly. Only people living in those two counties are even allowed to use the site.
Google says that they are working on a nationwide INFORMATION ONLY site and it will be released sometime in the future. Source: Bleeping Computer
Open Source Vulnerabilities Surge in 2019
Some people say that open source software is more secure.
Reality is a little different than that.
In 2019 DISCLOSED open source vulnerabilities surged from 4,000 to 6,000 last year. The good news is that the open source community is good about fixing the vulnerabilities once they are found. 85% of the vulnerabilities have a fix once they are responsibly disclosed.
Bottom line, make sure that you have an effective open source software patching program to keep your company safe. Source: Help Net Security
U.S. Census Figures Coronavirus Will Be Over in Two Weeks
The Census, that every 10 year event, was supposed to start this week. But there is kind of an issue. I think there is some kind of virus going around. Part of how the Census works is that Census workers go around collecting information from people. Given the current situation, (a) Census workers are probably not going to be willing to risk their health for a few bucks, (b) people that they visit are likely not going to let them in the door or (c) some other less than nice thing might happen.
So what did the geniuses at the Census bureau decide to do? They decided that they are going to send out Census workers in 13 days on April 1st. WHAT, EXACTLY, DO THEY EXPECT TO BE DIFFERENT IN 13 DAYS?
Ya gotta wonder about those folks in Washington. Source: Reuters
OCR Lifts Penalties For Telehealth Use During Covid-19
Its all hands on deck. HIPAA has a number of provisions that allow a healthcare provider to bypass certain HIPAA rules. A pandemic is not one of those options. Of course since the Feds make the rules, they can change them. In light of the current situation, HHS says that they will not penalize Covered Entities for using telehealth providers who are not fully HIPAA compliant. They are not saying using those providers is legal; they are just saying, given the circumstances, they are not going to go after providers who do so. This will allow providers to use apps like Facetime or Google Chat to diagnose patients instead making them come into the office and potentially infect dozens of other people. It seems like a reasonable trade off. Source: HealthIT Security
by 