It was late March 2021 when a phishing email was sent to a network administrator of TTEC Healthcare Solutions, Inc. (TTEC HS) - an integrated healthcare CX solutions provider - and a threat actor gained highly privileged access to the network. On September 12, 2021, a common ransomware scenario was triggered, with approximately 1,800 devices compromised via the access channel obtained almost 5 months earlier.
Prior to executing the ransomware attack, the threat actor successfully exfiltrated data from the TTEC HS network, containing non-public information (NPI) of current and former employees of TTEC HS, and for individuals who were insured by one of TTEC HS’s clients, including, importantly, some New York residents. TTEC HS was licensed to sell life and health insurance in New York State, so an investigation into the breach was started by The New York State Department of Financial Services (NYSDFS) per cybersecurity regulation, 23 NYCRR Part 500.
An investigation into the incident found that, at the time of the breach and ransomware event, TTEC HS only maintained active audit trail records for 90 days, with archived audit trail records maintained for an additional 15 months. The audit trail records were insufficient to effectively assist TTEC in detecting and responding to the incident, and it was also not enough to stay compliant with the 23 NYCRR Part 500 regulation.
As a result, TTEC HS had to pay “a total civil monetary penalty pursuant to Financial Services Law § 408 to the Department in the amount of One Million Nine Hundred Thousand U.S. Dollars ($1,900,000.00).”
What is 23 NYCRR 500?
Alongside different nationwide (GDPR, NIS, DPA, etc.) and industry-specific (PCI DSS, HIPAA, GLBA, NRCRG5.71, etc.) cybersecurity regulations, many local rules affect a security strategy and must be taken into account. The NYDFS Cybersecurity Regulation (23 NYCRR 500) is an example.
Back in 2017, the State of New York Department of Financial Services imposed new requirements on financial institutions that are authorized to run business in the state. “Title 23 New York Codes, Rules, and Regulation Part 500: Cybersecurity Requirements for Financial Services Companies” was designed to protect customer data. It’s applies to all entities operating under NYDFS licensure, registration, charter, or that are otherwise NYDFS-regulated, including those third parties working with regulated entities.
Banks, both state-chartered, international and private, mortgage brokers, and insurance companies are good examples of regulated entities.
The regulation enforces strict rules on covered organizations, including CISO appointment (or third-party equivalent), a detailed cybersecurity plan enablement, the enactment of a comprehensive cybersecurity policy, and ongoing reporting for cybersecurity events.
23 NYCRR 500 and log management
23 NYCRR 500 is based on the NIST Cybersecurity Framework (CSF) and provides direct guidance on log management as a crucial part of a cybersecurity strategy through a number of its sections:
-
Section 500.6 Audit trail
Each covered entity shall securely maintain systems that are designed to reconstruct material financial transactions and audit trails designed to detect and respond to cybersecurity events.
Transaction records shall be maintained for not fewer than five years and audit trails for not fewer than three years.
-
500.14 Monitoring and training
As part of its cybersecurity program, each covered entity shall monitor the activity of authorized users and detect unauthorized access or use of, or tampering with, nonpublic information by such authorized users.
Each class A company (one with at least $20,000,000 in gross annual revenue) shall implement an endpoint detection and response solution to monitor anomalous activity and a solution that centralizes logging and security event alerting.
How NXLog helps with compliance
NXLog helps organizations stay 23 NYCRR 500 compliant by providing a centralized security observability solution. Collect and analyze audit logs across disparate systems to aid in real-time threat detection and response, and ensure you always stay compliant with the State of New York Department of Financial Services cybersecurity regulation.
-
Enable audit log centralization with nothing missed
NXLog supports all popular and advanced log data collection methods. It seamlessly integrates with various data sources, including databases, network appliances, SIEM, and APM systems to ensure a compliant log management process.
-
Enable cost-efficient audit log retention
According to 23 NYCRR 500, audit trails must be retained for three years - a huge storage capacity problem. NXLog provides log filtration, flexible retention, and routing mechanisms, creating a cost-efficient retention process.
-
Enforce audit log and system file monitoring against unauthorized changes
NXLog provides a File Integrity Monitoring (FIM) module that detects when files are changed and promptly triggers a security event. This helps to protect both critical system files and retained logs from unauthorized tampering.
-
Simplify processes with unified log collection infrastructure
NXLog allows an organization to define a unified log collection mechanism across an entire infrastructure, including system and operational components. Unified log collection helps design comprehensive technical solutions and simplify routines and policies that must be documented and communicated to staff.
