Consumer Bureau Taking Action to Protect Data Security

Federal regulator says companies to be held liable when consumer data is threatened, breached

The Consumer Financial Protection Bureau (CFPB) announced this week it is taking action to ensure the safety of consumer data.

Specifically, the CFPB says companies will be held liable when they fail to protect consumer data or engage in practices that put consumer data at risk.

"Financial firms that cut corners on data security put their customers at risk of identity theft, fraud, and abuse," said CFPB Director Rohit Chopra. "While many nonbank companies and financial technology providers have not been subject to careful oversight over their data security, they risk legal liability when they fail to take commonsense steps to protect personal financial data."

Specifically, the CFPB outlined three areas where companies should take action in order to protect consumer data. These include:

• Multi-factor Authentication: Multi-factor authentication greatly increases the level of difficulty for adversaries to compromise enterprise user accounts, and thus gain access to sensitive customer data. Multi-factor authentication can protect against credential phishing, such as those using the Web Authentication standard supported by web browsers.
• Adequate Password Management: Unauthorized use of passwords is a common data security issue, as is the use of default enterprise logins or passwords. Username and password combinations can be sold on the dark web or posted for free on the internet, creating risk of future breaches. For firms that are still using passwords, password management policies and practices allow for ways to monitor for breaches at other entities where employees may be re-using logins and passwords.
• Timely Software Updates: Software vendors and creators, including open-source software libraries and projects, often send out patches and other updates to address continuously emerging threats. Upon announcement of these updates to address vulnerabilities, hackers immediately become aware that firms using older versions of software are potential targets to exploit. Protocols to immediately update software and address vulnerabilities once they become publicly known can reduce vulnerabilities.

Read the CFPB's full position on data security here.

Markus Spiske/Unsplash