{"id":19649,"date":"2025-03-03T12:06:02","date_gmt":"2025-03-03T17:06:02","guid":{"rendered":"https:\/\/www.elteni.com\/?p=19649"},"modified":"2025-03-03T12:06:02","modified_gmt":"2025-03-03T17:06:02","slug":"2025-march-newsletter","status":"publish","type":"post","link":"https:\/\/www.elteni.com\/insights\/?p=19649","title":{"rendered":"2025 March Newsletter"},"content":{"rendered":"

ELTENI’S CYBER SCOOP<\/h1>\n

Latest News<\/h3>\n

In this newsletter, we focus on the SEC creation of the Cyber and Emerging Technologies Unit (CETU), challenges identifying materiality of cyber incidents and the continued focus on cybersecurity disclosures.<\/p>\n

REGULATORY CORNER<\/h1>\n

SEC Commissioners on the Hunt for Materiality: Disagree on Cybersecurity Enforcement Actions<\/strong><\/p>\n

On October 22, 2024, Republican SEC Commissioners Hester Peirce and Mark Uyeda issued a joint dissent sharply criticizing charges brought against four companies for allegedly making materially misleading disclosures regarding cybersecurity. The charges stemmed from the SEC\u2019s investigation into public companies impacted by the widespread 2019\u20132020 compromise of SolarWinds\u2019 Orion software. The companies agreed to pay civil penalties ranging from $900,000 to $4 million.<\/em><\/p>\n

According to the SEC\u2019s orders against the four companies \u2014 Unisys Corp., Avaya Holdings Corp., Check Point Software Technologies Ltd., and Mimecast Ltd. \u2014 each was aware that a threat actor had accessed their systems as a result of the SolarWinds Orion hack but negligently minimized these cybersecurity incidents in public disclosures filed with the SEC.<\/em><\/p>\n

The dissent characterizes the enforcement allegations as being of two types:<\/em><\/p>\n

(1) Failing to disclose material information (in the cases of Avaya and Mimecast); and
\n(2) Failing to update an existing risk factor in response to a cyberattack (in the cases of Check Point and Unisys).<\/em><\/p>\n

Notes<\/h3>\n

The dissenting opinions reflect concerns that the agency may be overreaching in its pursuit of transparency, potentially penalizing companies for not disclosing details that may not have been materially relevant to investors.\u00a0 This case underscores the evolving nature of cybersecurity compliance and the increasing pressure on organizations to provide clear, defensible disclosures. As regulatory expectations grow, companies must refine their incident response strategies to ensure they not only comply with SEC rules but also communicate cyber risks in a way that genuinely informs investors without unnecessary speculation or over-disclosure.\u00a0 If the SEC begins enforcing a stricter disclosure standard, companies may struggle with the balance between timely, relevant reporting and avoiding excessive regulatory scrutiny.<\/p>\n

SEC Commissioners on the Hunt for Materiality | JDSupra<\/a><\/p>\n

ENFORCEMENT NEWS<\/h1>\n

SEC Charges Flagstar for Misleading Investors About Cyber Breach<\/strong><\/p>\n

The SEC’s order found that Flagstar negligently made materially misleading statements regarding the Citrix Breach, which resulted in, among other things, the encryption of data, network disruptions, and the exfiltration of the personally identifiable information (“PII”) of approximately 1.5 million individuals, including customers. According to the order, the risk factors in Flagstar’s 2021 Form 10-K, which it filed on March 1, 2022, stated that cybersecurity attacks “may interrupt our business or compromise the sensitive data of our customers,” but Flagstar did not disclose that Flagstar had already experienced cybersecurity attacks that resulted in the exfiltration of sensitive customer data and that the Citrix Breach interrupted its business.<\/em><\/p>\n

Without admitting or denying the findings in the SEC’s order, Flagstar agreed to cease and desist from committing or causing any violations of these provisions and to pay a $3.55 million civil money penalty.<\/em><\/p>\n

Notes<\/h3>\n

This case highlights the growing regulatory scrutiny around cybersecurity disclosures and the broader implications for businesses that fail to provide accurate and timely information. In an era where cyber threats are a constant risk, organizations must implement strong security frameworks and, just as importantly, establish rigorous internal processes to assess and disclose incidents properly.\u00a0 Inadequate reporting hinders informed decision-making. Investors rely on accurate disclosures to assess a company\u2019s risk exposure, while customers need to know if their data has been compromised. Without clear and honest communication, stakeholders are left in the dark, increasing the potential for reputational harm and long-term financial instability.<\/p>\n

SEC Charges Flagstar for Misleading Investors About Cyber Breach | SEC.gov<\/a><\/p>\n

CYBER NEWS<\/h1>\n

SEC Announces Cyber and Emerging Technologies Unit to Protect Retail Investors | SEC.gov<\/a><\/p>\n

With rapid technological innovation and the rise of digital platforms, protecting retail investors is crucial, as they are often vulnerable to sophisticated fraud. Before CETU, the SEC had units like the Office of Investor Education and Advocacy and the Division of Enforcement to address fraud and misconduct. The Crypto Assets and Cyber Unit also focused on digital assets and cybersecurity. CETU expands on these efforts, offering a more specialized focus on emerging technologies for enhanced investor protection.<\/p>\n

Study finds \u2018significant uptick\u2019 in cybersecurity disclosures to SEC | CyberScoop<\/a><\/p>\n

The SEC\u2019s new cybersecurity disclosure rules took effect in 2023 and since then, public companies have reported a 60% increase in cybersecurity incidents\u2014with 78% of these reports filed within eight days of discovering an incident. Despite the surge, less than 10% of disclosures include details on the material impact of these incidents. The report by Paul Hastings LLP highlights how companies struggle to balance rapid disclosure (to avoid SEC penalties) with the need to protect sensitive operational details.<\/p>\n

Lock All The Doors: The Cybersecurity Risks Of Overlooked Devices In Computer Networks | Forbes<\/a><\/p>\n

Governments are starting to demand tougher security rules for IoT devices and appliances, but progress is slow and there\u2019s no guarantee new regulations will stick. At the same time, many organizations are unaware of the solutions available to address IoT security gaps. Raising awareness is critical. Companies should regularly ask themselves: What devices on our network aren\u2019t being monitored? How can we improve visibility into their activity?<\/p>\n

Data Suggests It’s Time to Rethink Cloud Permissions | DarkReading<\/a><\/p>\n

In the age of cloud computing, identity has become the new perimeter, which means identity and access management plays an outsized role in minimizing risk. Once accounts are compromised, they can enable more destructive cyberattacks that impact employees, customers, and others up and downstream. \u00a0Left unchecked, excessive permissions can put organizations in the crosshairs of ransomware groups.<\/p>\n

DECODE THE TERMS<\/h1>\n

APT (Advanced Persistent Threat) <\/strong>\u2013 An Advanced Persistent Threat (APT) is a sophisticated, long-term cyberattack by nation-states or organized groups. APTs use advanced techniques, maintain persistent access, and evade detection to achieve targeted objectives like espionage or data theft.<\/p>\n

RCE (Remote Code Execution) \u2013 <\/strong>is a critical cybersecurity vulnerability that allows an attacker to execute arbitrary code on a target system remotely. This can lead to full system compromise, data theft, or further exploitation. RCE typically results from flaws in software, such as input validation failures, buffer overflows, or deserialization vulnerabilities.<\/p>\n

OTP (One-Time Password) \u2013 <\/strong>is a security mechanism that generates a unique, temporary password for a single authentication session. OTPs enhance security by preventing replay attacks and are commonly used in multi-factor authentication (MFA) via SMS, email, or authenticator apps.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

ELTENI’S CYBER SCOOP Latest News In this newsletter, we focus on the SEC creation of the Cyber and Emerging Technologies Unit (CETU), challenges identifying materiality of cyber incidents […]<\/p>\n","protected":false},"author":3,"featured_media":19651,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[114,67,134,113,68,3,133,135,101,102,103,18,140,136,47,17,25,106,137,89,138,90,127,19],"tags":[],"class_list":["post-19649","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-alternative-asset-management","category-awareness","category-breaches","category-business-email-compromise","category-cloud","category-cyber","category-finra","category-ftc","category-hackers","category-hedge-fund","category-investment-adviser","category-microsoft","category-newsletter","category-nydfs","category-ocie","category-password","category-pii","category-private-equity","category-private-funds","category-regulatory","category-rules","category-sec","category-technology","category-vulnerability"],"yoast_head":"\n2025 March Newsletter - Insights<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.elteni.com\/insights\/?p=19649\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"2025 March Newsletter - Insights\" \/>\n<meta property=\"og:description\" content=\"ELTENI’S CYBER SCOOP Latest News In this newsletter, we focus on the SEC creation of the Cyber and Emerging Technologies Unit (CETU), challenges identifying materiality of cyber incidents […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.elteni.com\/insights\/?p=19649\" \/>\n<meta property=\"og:site_name\" content=\"Insights\" \/>\n<meta property=\"article:published_time\" content=\"2025-03-03T17:06:02+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2025\/03\/032025-Front-Page-Image-e1741020627608.png\" \/>\n\t<meta property=\"og:image:width\" content=\"813\" \/>\n\t<meta property=\"og:image:height\" content=\"1050\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"dtuck\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"dtuck\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649\"},\"author\":{\"name\":\"dtuck\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/14c8aed9360eb93e744ed177fab3c94b\"},\"headline\":\"2025 March Newsletter\",\"datePublished\":\"2025-03-03T17:06:02+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649\"},\"wordCount\":1058,\"image\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/032025-Front-Page-Image-e1741020627608.png\",\"articleSection\":[\"Alternative Asset Management\",\"Awareness\",\"Breaches\",\"Business Email Compromise\",\"Cloud\",\"Cyber\",\"FINRA\",\"FTC\",\"Hackers\",\"Hedge Fund\",\"Investment Adviser\",\"Microsoft\",\"Newsletter\",\"NYDFS\",\"OCIE\",\"Password\",\"PII\",\"Private Equity\",\"Private Funds\",\"Regulatory\",\"Rules\",\"SEC\",\"Technology\",\"Vulnerability\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649\",\"name\":\"2025 March Newsletter - Insights\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/032025-Front-Page-Image-e1741020627608.png\",\"datePublished\":\"2025-03-03T17:06:02+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/14c8aed9360eb93e744ed177fab3c94b\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649#primaryimage\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/032025-Front-Page-Image-e1741020627608.png\",\"contentUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2025\\\/03\\\/032025-Front-Page-Image-e1741020627608.png\",\"width\":813,\"height\":1050},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19649#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.elteni.com\\\/insights\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"2025 March Newsletter\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#website\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/\",\"name\":\"Insights\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/14c8aed9360eb93e744ed177fab3c94b\",\"name\":\"dtuck\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"caption\":\"dtuck\"},\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?author=3\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"2025 March Newsletter - Insights","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.elteni.com\/insights\/?p=19649","og_locale":"en_US","og_type":"article","og_title":"2025 March Newsletter - Insights","og_description":"ELTENI’S CYBER SCOOP Latest News In this newsletter, we focus on the SEC creation of the Cyber and Emerging Technologies Unit (CETU), challenges identifying materiality of cyber incidents […]","og_url":"https:\/\/www.elteni.com\/insights\/?p=19649","og_site_name":"Insights","article_published_time":"2025-03-03T17:06:02+00:00","og_image":[{"width":813,"height":1050,"url":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2025\/03\/032025-Front-Page-Image-e1741020627608.png","type":"image\/png"}],"author":"dtuck","twitter_card":"summary_large_image","twitter_misc":{"Written by":"dtuck","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.elteni.com\/insights\/?p=19649#article","isPartOf":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19649"},"author":{"name":"dtuck","@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/14c8aed9360eb93e744ed177fab3c94b"},"headline":"2025 March Newsletter","datePublished":"2025-03-03T17:06:02+00:00","mainEntityOfPage":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19649"},"wordCount":1058,"image":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19649#primaryimage"},"thumbnailUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2025\/03\/032025-Front-Page-Image-e1741020627608.png","articleSection":["Alternative Asset Management","Awareness","Breaches","Business Email Compromise","Cloud","Cyber","FINRA","FTC","Hackers","Hedge Fund","Investment Adviser","Microsoft","Newsletter","NYDFS","OCIE","Password","PII","Private Equity","Private Funds","Regulatory","Rules","SEC","Technology","Vulnerability"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.elteni.com\/insights\/?p=19649","url":"https:\/\/www.elteni.com\/insights\/?p=19649","name":"2025 March Newsletter - Insights","isPartOf":{"@id":"https:\/\/www.elteni.com\/insights\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19649#primaryimage"},"image":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19649#primaryimage"},"thumbnailUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2025\/03\/032025-Front-Page-Image-e1741020627608.png","datePublished":"2025-03-03T17:06:02+00:00","author":{"@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/14c8aed9360eb93e744ed177fab3c94b"},"breadcrumb":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19649#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.elteni.com\/insights\/?p=19649"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.elteni.com\/insights\/?p=19649#primaryimage","url":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2025\/03\/032025-Front-Page-Image-e1741020627608.png","contentUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2025\/03\/032025-Front-Page-Image-e1741020627608.png","width":813,"height":1050},{"@type":"BreadcrumbList","@id":"https:\/\/www.elteni.com\/insights\/?p=19649#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.elteni.com\/insights"},{"@type":"ListItem","position":2,"name":"2025 March Newsletter"}]},{"@type":"WebSite","@id":"https:\/\/www.elteni.com\/insights\/#website","url":"https:\/\/www.elteni.com\/insights\/","name":"Insights","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.elteni.com\/insights\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/14c8aed9360eb93e744ed177fab3c94b","name":"dtuck","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","caption":"dtuck"},"url":"https:\/\/www.elteni.com\/insights\/?author=3"}]}},"_links":{"self":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts\/19649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=19649"}],"version-history":[{"count":0,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts\/19649\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/media\/19651"}],"wp:attachment":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=19649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=19649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=19649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}