Libby Bevin

Alan Gouveia is one of our esteemed GRC Experts at Reciprocity. As an experienced governance and compliance professional, he is one of the first people our Sales team turn to when they need to close a deal with a new customer. And, thanks to his considerable experience in process development and improvement, he’s also an invaluable resource for our customers when they are looking for additional support as they navigate the complex world of governance, risk and compliance.

Alan’s Journey

A native Hawaiian, Alan got his start in the airline industry over 20 years ago, providing regulatory compliance support for Hawaiian Airlines, the largest operator of commercial flights to and from the U.S. state of Hawaii. His responsibilities ranged from customer service policies and procedures to FAA (Federal Aviation Administration) and DOT (Department of Transportation) regulations. His introduction to IT Compliance, though, wasn’t completely expected:

“I had a counterpart at the airline who handled the automation and technology, and whenever he introduced new solutions, I worked with him on compliance issues. When he left, he recommended me as his replacement – much to my surprise! – as it turned out I knew the technology and reservation systems as well as he did,” Alan says.

Time for a Change

10 years ago, Alan decided it was time for a change, so he moved to Colorado. It was while working for the City and County of Denver as their Manager of IT Governance that he learned more about, and eventually transitioned to IT security… which led to his current role at Reciprocity.

“I really enjoy what I’m doing now. I get to meet so many people, and then help them come up with solutions to their problems – even if it’s just validating what they already know,” he explains. “They consider me a trusted advisor and I appreciate that so much.

“Each new project is a little like having a child, but not having to be responsible for it for the next 18+ years,” he jokes.

The Right Role

Speaking of children, Alan and his husband have a few of those as well. Their six kids range in age from 10 – 16 years old, and keep them both very busy. They’re an incredibly active family, hiking when the weather is nice, and skiing and snowboarding in the winter. Travel also plays a big part in their lives – in fact, the entire family went to England and Ireland a couple of years ago.

“Reciprocity provided me with the first role that really fit with our lifestyle, allowing me to work remotely – even before the pandemic hit – so that I can be at home just in case the kids need anything, while my husband goes into the office,” he says. “Don’t get me wrong, I’ve worked for some really great companies. But honestly, I can’t see myself ever working anywhere else.”

The Path Forward

Reciprocity’s mission is to support companies with goals that are good for society, which includes improving customer privacy – and this is exactly what Alan does every day. Whether it’s supporting our customers, supporting Reciprocity, or supporting his family, he’s always the best man for the job!

Interested in learning more about other jobs at Reciprocity? Check out our current job openings.

This article first appeared on radicalcompliance.com June 8, 2021

The folks behind MoviePass have agreed to settle charges with the Federal Trade Commission that the business worked to subvert customers’ ability to use the film subscription service and failed to protect personal data, in a messy case that’s quite the example of poor leadership and poor privacy compliance all rolled into one.

For those who may not remember, MoviePass was one of the wackier startups of the 2010s, promising to disrupt the film industry with discounted movie tickets. Its biggest claim to fame arrived in 2017, when the company announced that for $9.95 per month, subscribers to its mobile app would be allowed to see one film per day in major cinemas throughout the United States.

If you’re thinking, “Wow, a plan that great sounds too good to be true!” — well, yes. You grasp the fundamental issue here.

MoviePass quickly went into financial distress, and implemented various retreats from its initial $9.95 promise: imposing blackout periods on specific films; paring back to only three free films per month for the $9.95 fee; and so forth. The owners, a data analytics firm named Helios & Matheson, finally pulled the plug on MoviePass in September 2019, and then filed for bankruptcy itself in January 2020. Fade to black.

The FTC, meanwhile, brought a complaint against MoviePass for the shenanigans of its senior executives Mitchell Lowe (CEO of MoviePass) and Theodore Farnsworth (CEO of Helios & Matheson while the firm operated MoviePass, now chairman of Helios). According to the FTC, Lowe and Farnsworth engaged in a variety of tactics to prevent MoviePass subscribers from using their accounts as promised by the MoviePass service agreement.

For example, as alleged in the FTC complaint, in 2018 the executives devised a “password disruption program” where MoviePass deliberately invalidated the passwords of its 75,000 most prolific users. Then the company warned those users that “we have detected suspicious activity or potential fraud” on their accounts — but when users tried to reset their passwords, MoviePass then gave them the run-around with a bogus password-reset program that never actually worked.

Needless to say, this idea alarmed other MoviePass executives. At least one, the FTC says, told Lowe, Farnsworth and other senior execs that so many warnings about suspicious activity “could insinuate there may have been a data breach.” Another said subscribers might start to chatter online about whether their personal data was really safe.

Not to worry. MoviePass had an actual data breach on its hands anyway.

MoviePass Privacy Breach

In August 2019, news broke that MoviePass had failed to secure subscribers’ personal data. After a technical analysis, MoviePass confirmed that more than 28,000 subscribers had their personal data — credit card numbers and expiration dates; names, addresses, dates of birth, and more — exposed on a publicly visible web server for four months in 2019. That server had also been accessed by users in foreign countries where MoviePass didn’t operate. (Read: hackers.)

How did that breach happen? Through the failure of MoviePass to implement basic data privacy protections, the FTC said. Personal data was left unencrypted; risk assessments weren’t performed; training wasn’t conducted; security controls weren’t used. The company even disabled a firewall in April 2019 to move its data onto a new server, which seems to be the one left exposed to anybody with an internet connection.

Anyway, here we are: the FTC announced on Monday that it had reached a settlement with Lowe, Farnsworth, and the last corporate remnants of Helios & Matheson, which is still working its way through a Chapter 7 bankruptcy filing.

The company will pay no monetary penalty because there’s no company left. Lowe and Farnsworth, meanwhile, “will be barred from misrepresenting their business and data security practices” in any future business they run; and must also implement rigorous data security programs in any future endeavors, too. (Lowe and Farnsworth themselves neither admit nor deny the allegations in the FTC complaint.)

Which, at long last, brings us to the information security practices that the FTC wants Lowe and Farnsworth to implement, should they ever be in charge of a business again. That’s worth an exploration, since the FTC has been talking up the importance of keeping customers’ personal data secure — and that posture is only going to increase in the Biden Administration, both at the FTC and in other regulatory agencies.

Standards for Good Data Stewardship

The FTC’s required information security program has eight parts. They are:

• Document the content, implementation, and maintenance of the program in writing.
• Provide that written documentation to the board at least once a year, and within 30 days of any significant security incident.
• Assign a specific, qualified employee to oversee the security program.
• Perform a security risk assessment at least once a year, or within 30 days of any significant security incident.
• Implement risk-based safeguards for data protection. And while the specific safeguards might vary from one business to the next, those safeguards should always include employee training, technical measures to monitor network access, and access controls for sensitive data.
• Test those safeguards at least once a year, and within 30 days of a significant cybersecurity incident. (The safeguards must include network penetration testing, also done at least once a year.)
• Require any third parties handling confidential data to maintain their own sufficient safeguards for any confidential information of yours that they might handle.
• Review and re-evaluate the security program at least annually.

CISOs and internal auditors could print out that list and pin it to the office bulletin board, really. (Assuming we all return to offices sometime soon.) The FTC’s requirements are an excellent summary of the fundamentals that any company should have in place for an effective privacy compliance program.

The agreement also requires an independent assessment of the information security program by a third party. Any business that Lowe and Farnsworth are involved with must fully cooperate with that independent assessor. Those covered businesses will also need to report cybersecurity incidents to the FTC within 30 days of the incident happening.

The lesson for the rest of us: implement a rigorous data security program — which, really, reads a lot like any other compliance program. Executive leadership, risk assessments, internal controls, monitoring of third parties, training, periodic review of program effectiveness. Ain’t it funny how those things keep cropping up?

Corporate cybersecurity professionals must be on constant alert to avoid the wide range of cyberattacks that can be thrown at them today: malware, ransomware, trojan horses, social engineering, and spear-phishing attacks, to name just a few. 

Among the most serious of attacks is the advanced persistent threat (APT). 

An APT is an attack that uses sophisticated methods to gain access to information systems and sensitive information. Typically this attack seems so inconspicuous that it goes undetected — and therefore remains, and continues to cause harm. for an extended period of time. 

Unlike malware, which is a common cybersecurity issue, APTs are relatively rare. They might even incorporate malware as one among numerous tactics, all part of the attackers’ pursuit of high-value or high-profile targets. 

Examples of APTs

There are, unfortunately, numerous historical examples of APTs from the last several years. Let’s take a look at a few of them now.

GhostNet

One example of an APT was a group known as GhostNet. It used spear-phishing emails containing malware to compromise government and embassy computers in more than 100 countries. The attackers were able to turn on the cameras and microphones of these computers remotely, and use them for cyber espionage. 

Stuxnet

Another group, Stuxnet, used a malware worm to attack Iran’s nuclear program through an infected USB device. 

The Stuxnet was designed to target Supervisory Control and Data Acquisition (SCADA) industrial systems to disrupt uranium centrifuges without their operators being any the wiser.

APT34

APT34, an Iranian group, targeted financial institutions, telecommunications companies, government organizations, and energy companies in the Middle East by exploiting a known Microsoft vulnerability. Through this vulnerability, the group was able to conduct cyber espionage. They were later discovered by FireEye threat intelligence researchers.

APT37

Hacker group APT37 (also known as StarCruft and Reaper) was believed to have originated in North Korea. Similar to GhostNet, this group used spear-phishing attacks to exploit a zero-day vulnerability in Adobe Flash software and use it to gain access to military systems in rival countries and could conduct cyber espionage.

How Does an APT Attack Progress?

As previously mentioned, an APT attack is a cybercrime intended to achieve ongoing access to the system and then remain undetected, so it can cause more damage over a longer period of time. This unfolds in several stages.

Step 1: Gain Initial Access to the Target Organization’s Systems

In this phase, cybercriminals will attempt to gain access to a target network, typically through an insecure endpoint or through malware.

Step 2: Maintain Access

The threat actors will embed malicious software that can create a number of backdoors. Those backdoors allow hackers to move around the IT system without alerting security teams or software. (These programs can use tactics like rewriting code to hide their presence and activity.)

Step 3: Extend Access

After access has been established and a path to facilitate movement has been created, the malware used will continue to facilitate the attack. 

At this point, the attack is working towards increased access. For example, the attackers might employ password-cracking tactics to circumvent security measures and obtain administrative privileges that will allow them free rein of the network and potentially access to additional systems. 

Step 4: Remain and Cause Harm

At this point, the hackers know they have bypassed network security, and have the ability to keep doing as much damage or stealing as much information as they can. They will also leave back doors behind them during exfiltration so they can attempt to gain access again at a later date.

Who Are the Main Targets of Advanced Persistent Threats?

APTs require a significant amount of time, effort, and sophisticated tools. For that reason, they aren’t used for your everyday cybercrime. Instead, they are targeted toward high-value, high-profile organizations such as nation-states, government entities, and enterprise corporations. 

That doesn’t mean small businesses and SMBs can take a cavalier attitude toward prevention, monitoring, and incident response planning. In fact, cyberattackers are getting smarter and using unsuspecting, smaller companies that make up the supply chain for larger companies as a means to gain access to their systems. 

In other words, your small business can be the preliminary target, so attackers can use you as the path toward larger targets. 

How Can GRC Software Mitigate the Risks of an APT?

APT attacks are only one of many risks facing organizations in a variety of industries including healthcare, IT, finance, and government. 

In the past, traditional cyber defense mechanisms like antivirus programs and firewalls might have been enough, but today’s cybercriminals have become smarter and capable of circumventing these mechanisms. 

To protect your organization in today’s threat landscape, a cybersecurity program coupled with ongoing risk management is vital. 

ZenGRC is a governance, risk management, and compliance platform that equips your security team with a single, centralized dashboard that identifies information security risk across your entire business.

Along with a risk assessment checklist, ZenGRC provides templates for compliance standards and enterprise risk management (ERM) frameworks that can help you quickly identify where your gaps are and how you can quickly fill them. 

ZenGRC is able to map your existing and future security controls across all relevant frameworks, whether they be HIPAA, CMMC, PCI, or otherwise; so you can avoid duplicate work and meet multiple requirements with a single effort.

Our user-friendly dashboards show you which risks need mitigating, how to do it while also tracking workflows, collecting and storing all your documentation in the event of a risk audit. 

To learn more about how ZenGRC can support your risk management efforts, schedule a free consultation today.