What We Do
How we do it
Resources
SECURITY ADVISORIES
Jul 29, 2021
UPDATE: PetitPotam NTLM Relay Attack
THE THREAT PetitPotam is a variant of the NTLM Relay attack discovered by security researcher Gilles Lionel. It is tracked as an authentication bypass vulnerability in Active Directory (Certificate Services); currently no CVE identifier has been assigned to this vulnerability. Proof of Concept (PoC) code released last week [1] relies on the Encrypting File System Remote (EFSRPC) protocol to…
Read More
View all Advisories →
Company
ABOUT eSENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Jul 12, 2021
Tecala and eSentire Partner to Protect Enterprises across APAC from Business-Disrupting Cyber Attacks
Sydney, 12 July, 2021 - Tecala, Australia’s award-winning technology services and IT consulting provider, today announced it has chosen eSentire, the global Authority in Managed Detection and Response (MDR) cybersecurity services, as their exclusive MDR solution provider in Australia and New Zealand. This partnership will enable Tecala to augment its cybersecurity practice and offer enterprises…
Read More
Partners
PARTNER PROGRAM
Partners
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
Resources
Blog — Nov 25, 2020

CCPA Plymouth Rock of Privacy Gets Hardened with the CPRA

CCPA Update with CPRA

3 min read

A new president-elect wasn’t the only decision in California on November 3. Voters approved the California Rights and Enforcement Act of 2020 (CPRA), which amends the California Consumer Privacy Act (CCPA) that came into effect in January.

What is CCPA?

As a reminder, the CCPA is the Plymouth Rock of privacy protection in the United States. Other regions, like Europe, introduced the General Data Protection Regulation (GDPR) back in 2018. But the CCPA goes beyond protecting the privacy of citizens to also exposing economic relationships developed and fueled by their information. Like GDPR, CCPA provides a “right to know” why personal information is collected and how it is used and shared, a “right to delete” personal information and a “right to opt out” of the sales of their personal data with a protected “right to non-discrimination” when they exercise their CCPA rights.

What is CPRA?

California has also created a new oversight agency called the California Protection Agency to enforce consumer privacy protections. The newest act, CPRA, also triples the maximum penalties for privacy violations involving minors (consumers under 16) to $7,500 per violation.

The California Rights and Enforcement Act of 2020 (CPRA), which takes effect on January 1, 2023, amends and hardens the preceding CCPA act in the following ways:

Higher inclusion thresholds with CPRA

Under the CPRA, any business that buys, sells or shares personal data of 100,000 consumers for business purposes is required to comply with the law. The old threshold, before CPRA, was 50,000 and included the sale of devices, which has now been eliminated. Note that the annual gross revenue of $25 million or 50 percent of annual revenues derived from the sale of consumer data remains the same.

CPRA brings expanded information definitions

With CPRA, consumers can request that businesses stop selling “sensitive personal information,” defined as any one of the following: social security number, account credentials and geolocation. It also protects more abstract information such as health, race, ethnicity, religion and memberships.

CPRA expands consumer rights

The CPRA expands the “right to opt out” beyond resale to include non-monetary transfers. Now, consumers can opt out from the sharing of their personal information, defined as disclosure or transfer to a third-party.

The CPRA expands the “right to know” from a 12-month limitation to beyond one year. And, the law also expands disclosure obligations to require businesses to notify consumers of the length of time they will retain personal information.

In addition to the amendments, CPRA adds a new “right of correction,” which provides a mechanism for consumers to correct inaccurate information. Businesses must now disclose this right and make “commercially reasonable” efforts to do so.

CPRA new exceptions and extensions

The CPRA doesn’t swing all to the consumer. The new law creates an exception to the “right to delete” allowing businesses to deny a request of the retention of personal data is “reasonably necessary and proportionate” and is adequately protected. Also, the CPRA extends employee and business-to-business exemptions until January 1, 2023.

CCPA and CPRA

Beyond the new rights and exemptions, the CCPA and CPRA duo demonstrate an overwhelming demand by consumers for their privacy and eliminate a carte blanche approach to the collection and dissemination of information. By implication, it means consumers expect that businesses will protect their data, not only from business operations, but from unauthorized access, transfer and resale. CPRA means businesses, while mapping data flow and resale, need to secure that entire pipeline from one end to the other.

Mark Sangster
Mark Sangster Vice President and Industry Security Strategist

Mark is a cybersecurity evangelist who has spent significant time researching and speaking to peripheral factors influencing the way that legal firms integrate cybersecurity into their day-to-day operations.