{"id":14277,"date":"2019-05-27T21:25:46","date_gmt":"2019-05-28T01:25:46","guid":{"rendered":"https:\/\/www.elteni.com\/?p=14277"},"modified":"2019-05-27T21:25:46","modified_gmt":"2019-05-28T01:25:46","slug":"cybersecurity-alert-ocie-safeguarding-customer-records-and-information-in-network-storage-use-of-third-party-security-features","status":"publish","type":"post","link":"https:\/\/www.elteni.com\/insights\/?p=14277","title":{"rendered":"Cybersecurity Alert &#8211; OCIE &#8211; Safeguarding Customer Records and Information in Network Storage \u2013 Use of Third Party Security Features"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\"><strong>Alert<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"> On May 23, 2019, the Office of Compliance Inspections and Examinations (&#8220;OCIE&#8221;) issued the alert <a rel=\"noreferrer noopener\" href=\"https:\/\/www.sec.gov\/files\/OCIE%20Risk%20Alert%20-%20Network%20Storage.pdf\" target=\"_blank\">&#8220;Safeguarding Customer Records and Information in Network Storage &#8211; Use of Third Party Security Features&#8221;<\/a>.  In this alert the OCIE &#8216;identified security risks associated with the  storage of electronic customer records and information by broker-dealers  and investment advisers in various network storage solutions, including  those leveraging cloud-based storage&#8217;.<br><br>The OCIE highlighted: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Misconfigured network storage solutions<\/li><li>Inadequate oversight of vendor-provided network storage solutions, and<\/li><li>Insufficient data classification policies and procedures<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The OCIE loosely (intentionally) defined  what a cloud-based storage solution was. To provide some clarification  of what a &#8220;cloud-based&#8221; storage solution is, so you understand your  potential exposure, we provided some examples below: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>A file storage and sharing solution like Microsoft OneDrive, Dropbox, Box, Sharefile, and similar.<\/li><li>It could also be virtual servers running in Microsoft Azure, Amazon Web Services, or Google Cloud.<\/li><li>If\n you are using a private cloud, like those provided by managed IT \nservice providers, it would be the virtual servers they host in their \ndata centers for you.<\/li><li>Backup data stored in an online solution like KeepItSafe, iDrive, Livevault, Amazon S3 Buckets or Glacier, etc.<\/li><li>Email in the cloud like Office 365, Mimecast, Intermedia, etc.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you are using one or more of these  solutions and have not performed holistic assessments of the usage, gaps  may exist that leave you exposed to both cyber and regulatory risk. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Recommendation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When using cloud-based storage solutions  data classification is a starting point for maintaining the  confidentiality and potentially the integrity and availability of data  based on the data\u2019s risk impact level, so setting the right level of  specificity matters. <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>The first step is to inventory the data so you have a clear picture of what will be stored in the cloud.<\/li><li>Risk assess and classify the data. This is where the development of your policies and procedures come into play.<\/li><li>Implement the controls in the cloud, then assess the controls to ensure they are working as intended.<\/li><li>Perform appropriate levels of monitoring and review to ensure compliance with your policies and procedures.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Elteni recommends that analysis be performed of each public-cloud solution being used to ensure: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>All of the security best practices provided by the vendor have been implemented.<\/li><li>Encryption is used where necessary. If using encryption, ensure there is a way to secure the encryption keys.<\/li><li>Two-factor or multi-factor authentication is used.<\/li><li>Proper deployment of role-based access has been configured.<\/li><li>Access is limited to only those that need it.<\/li><li>Appropriate oversight is being maintained in the form of log collection and review.<\/li><li>Thorough vendor diligence has been performed.<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Alert On May 23, 2019, the Office of Compliance Inspections and Examinations (&#8220;OCIE&#8221;) issued the alert &#8220;Safeguarding Customer Records and Information in Network Storage &#8211; Use of Third [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":14279,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,47],"tags":[40,41,42,43,37,44,45,46,48,49],"class_list":["post-14277","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber","category-ocie","tag-amazon","tag-aws","tag-azure","tag-cloud-storage","tag-compliance","tag-cyber","tag-google","tag-microsoft","tag-ocie","tag-policies"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Cybersecurity Alert - OCIE - Safeguarding Customer Records and Information in Network Storage \u2013 Use of Third Party Security Features - Insights<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.elteni.com\/insights\/?p=14277\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cybersecurity Alert - OCIE - Safeguarding Customer Records and Information in Network Storage \u2013 Use of Third Party Security Features - Insights\" \/>\n<meta property=\"og:description\" content=\"Alert On May 23, 2019, the Office of Compliance Inspections and Examinations (&#8220;OCIE&#8221;) issued the alert &#8220;Safeguarding Customer Records and Information in Network Storage &#8211; Use of Third [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.elteni.com\/insights\/?p=14277\" \/>\n<meta property=\"og:site_name\" content=\"Insights\" \/>\n<meta property=\"article:published_time\" content=\"2019-05-28T01:25:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/05\/1032-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1920\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Elteni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Elteni\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277\"},\"author\":{\"name\":\"Elteni\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\"},\"headline\":\"Cybersecurity Alert &#8211; OCIE &#8211; Safeguarding Customer Records and Information in Network Storage \u2013 Use of Third Party Security Features\",\"datePublished\":\"2019-05-28T01:25:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277\"},\"wordCount\":452,\"image\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2019\\\/05\\\/1032-scaled.jpg\",\"keywords\":[\"Amazon\",\"AWS\",\"Azure\",\"Cloud Storage\",\"Compliance\",\"Cyber\",\"Google\",\"Microsoft\",\"OCIE\",\"Policies\"],\"articleSection\":[\"Cyber\",\"OCIE\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277\",\"name\":\"Cybersecurity Alert - OCIE - Safeguarding Customer Records and Information in Network Storage \u2013 Use of Third Party Security Features - Insights\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2019\\\/05\\\/1032-scaled.jpg\",\"datePublished\":\"2019-05-28T01:25:46+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277#primaryimage\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2019\\\/05\\\/1032-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2019\\\/05\\\/1032-scaled.jpg\",\"width\":2560,\"height\":1920,\"caption\":\"Big data center, server room rack, engineering process, teamwork, computer technology, cloud storage\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=14277#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.elteni.com\\\/insights\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Alert &#8211; OCIE &#8211; Safeguarding Customer Records and Information in Network Storage \u2013 Use of Third Party Security Features\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#website\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/\",\"name\":\"Insights\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\",\"name\":\"Elteni\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"caption\":\"Elteni\"},\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?author=2\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cybersecurity Alert - OCIE - Safeguarding Customer Records and Information in Network Storage \u2013 Use of Third Party Security Features - Insights","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.elteni.com\/insights\/?p=14277","og_locale":"en_US","og_type":"article","og_title":"Cybersecurity Alert - OCIE - Safeguarding Customer Records and Information in Network Storage \u2013 Use of Third Party Security Features - Insights","og_description":"Alert On May 23, 2019, the Office of Compliance Inspections and Examinations (&#8220;OCIE&#8221;) issued the alert &#8220;Safeguarding Customer Records and Information in Network Storage &#8211; Use of Third [&hellip;]","og_url":"https:\/\/www.elteni.com\/insights\/?p=14277","og_site_name":"Insights","article_published_time":"2019-05-28T01:25:46+00:00","og_image":[{"width":2560,"height":1920,"url":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/05\/1032-scaled.jpg","type":"image\/jpeg"}],"author":"Elteni","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Elteni","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.elteni.com\/insights\/?p=14277#article","isPartOf":{"@id":"https:\/\/www.elteni.com\/insights\/?p=14277"},"author":{"name":"Elteni","@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075"},"headline":"Cybersecurity Alert &#8211; OCIE &#8211; Safeguarding Customer Records and Information in Network Storage \u2013 Use of Third Party Security Features","datePublished":"2019-05-28T01:25:46+00:00","mainEntityOfPage":{"@id":"https:\/\/www.elteni.com\/insights\/?p=14277"},"wordCount":452,"image":{"@id":"https:\/\/www.elteni.com\/insights\/?p=14277#primaryimage"},"thumbnailUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/05\/1032-scaled.jpg","keywords":["Amazon","AWS","Azure","Cloud Storage","Compliance","Cyber","Google","Microsoft","OCIE","Policies"],"articleSection":["Cyber","OCIE"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.elteni.com\/insights\/?p=14277","url":"https:\/\/www.elteni.com\/insights\/?p=14277","name":"Cybersecurity Alert - OCIE - Safeguarding Customer Records and Information in Network Storage \u2013 Use of Third Party Security Features - Insights","isPartOf":{"@id":"https:\/\/www.elteni.com\/insights\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.elteni.com\/insights\/?p=14277#primaryimage"},"image":{"@id":"https:\/\/www.elteni.com\/insights\/?p=14277#primaryimage"},"thumbnailUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/05\/1032-scaled.jpg","datePublished":"2019-05-28T01:25:46+00:00","author":{"@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075"},"breadcrumb":{"@id":"https:\/\/www.elteni.com\/insights\/?p=14277#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.elteni.com\/insights\/?p=14277"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.elteni.com\/insights\/?p=14277#primaryimage","url":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/05\/1032-scaled.jpg","contentUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2019\/05\/1032-scaled.jpg","width":2560,"height":1920,"caption":"Big data center, server room rack, engineering process, teamwork, computer technology, cloud storage"},{"@type":"BreadcrumbList","@id":"https:\/\/www.elteni.com\/insights\/?p=14277#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.elteni.com\/insights"},{"@type":"ListItem","position":2,"name":"Cybersecurity Alert &#8211; OCIE &#8211; Safeguarding Customer Records and Information in Network Storage \u2013 Use of Third Party Security Features"}]},{"@type":"WebSite","@id":"https:\/\/www.elteni.com\/insights\/#website","url":"https:\/\/www.elteni.com\/insights\/","name":"Insights","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.elteni.com\/insights\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075","name":"Elteni","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","caption":"Elteni"},"url":"https:\/\/www.elteni.com\/insights\/?author=2"}]}},"_links":{"self":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts\/14277","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14277"}],"version-history":[{"count":0,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts\/14277\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/media\/14279"}],"wp:attachment":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14277"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}