Ohio Data Protection Act

In 2018, Ohio enacted the its Data Protection Act under which companies can get safe harbor from tort claims by compiling with one of below cyber security programs:

1. The NIST Cybersecurity Framework.

2. NIST Special Publication 800-171, or 800-53 and 800-53a.

3. The FedRAMP Security Assessment Framework.

4. The CIS (Center for Internet Security) Controls.

5. ISO 27000 Security Management Standards

Businesses that have sites on which financial transactions can be made, must also comply with Payment Card Industry’s Data Security Standards (PCI-DSS). A safe harbor affirmative defense is also available to businesses that meet the security requirements of HIPAA, and the Gramm -Leach-Bliley Act.

Stop Internet Explorer From Running Javascript

A potential security flaw in Windows is the ability of Internet Explorer to run Java scripts. A .dll file located in the system folder on the C drive enables IE to run Java:

. . . you can disable the ability of IE to run Java scripts in the Registry Editor under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Change the value for 140D at this location to 3. This will cause the execution of the scripts to be disabled by default.

Types of Hacking

Here's a quick rundown of hacking techniques to help you understand what may be going on when a computer system is hacked.

1. CODE INJECTION - this method involves using external inputs to run commands. SQL script can be used in a web form to get access to restricted areas of a web site. User input should be filtered for SQL queries.

2. CROSS SITE SCRIPTING (XSS) - with this technique a hacker may place javascript inside a link , designed to take personal information.

3. DENIAL OF SERVICE (DoS) - this widely known approach simply involves flooding a site with traffic so its servers crash. Note that most often DoS attacks will make use of computers that are unaware they are being used for the attack.

4. CROSS-SITE REQUEST FORGERY (XSRF) - this hack involves running malicious commands from a source that the victim trusts. Html image tags in an email message may have links which will be activated even if they are not clicked.

5. DNS SPOOFING - with this technique bad Domain Name System data will be used to redirect data to the hacker's computer - domain names get translated into the wrong IP addresses.

6. SOCIAL ENGINEERING - you have probably been phished by someone pretending to a be friend or co-worker. Be on the lookout for 'vishing' (using the phone system); 'phishing' (typically done through emails); 'smishing' (using SMS texts); spear phishing (customized email messages targeting an individual or small groups); water holing (a trap on a trusted web site); and baiting (placing malware on USB drives or discs which are left where people may pick them up).