What We Do
How we do it
Resources
SECURITY ADVISORIES
May 11, 2022
CVE-2022-26923 - Active Directory Domain Services Elevation of Privilege Vulnerability
THE THREAT Microsoft has disclosed a new vulnerability impacting Active Directory Certificate Services (ADCS) tracked as CVE-2022-26923 (Active Directory Domain Services Elevation of Privilege Vulnerability). If exploited successfully, an authenticated attacker can escalate privileges in environments where ADCS is running on the domain. eSentire is aware of technical details and tooling [2] for…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1200+ organizations in 75+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
May 17, 2022
Cybersecurity Leader eSentire Continues Its Commitment to Rigorous Security Standards Earning PCI DSS Certification
Waterloo, ON, May 17, 2022 — eSentire, the Authority in Managed Detection and Response (MDR), maintains one of the most secure and robust IT environments of any MDR provider in the industry. To that end, eSentire today announced that it has received the Payment Card Industry Data Security Standard (PCI DSS) certification, considered one of the most stringent and comprehensive payment card…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Nov 25, 2020

CCPA Plymouth Rock of Privacy Gets Hardened with the CPRA

CCPA Update with CPRA

Speak With A Security Expert Now

A new president-elect wasn’t the only decision in California on November 3. Voters approved the California Rights and Enforcement Act of 2020 (CPRA), which amends the California Consumer Privacy Act (CCPA) that came into effect in January.

What is CCPA?

As a reminder, the CCPA is the Plymouth Rock of privacy protection in the United States. Other regions, like Europe, introduced the General Data Protection Regulation (GDPR) back in 2018. But the CCPA goes beyond protecting the privacy of citizens to also exposing economic relationships developed and fueled by their information. Like GDPR, CCPA provides a “right to know” why personal information is collected and how it is used and shared, a “right to delete” personal information and a “right to opt out” of the sales of their personal data with a protected “right to non-discrimination” when they exercise their CCPA rights.

What is CPRA?

California has also created a new oversight agency called the California Protection Agency to enforce consumer privacy protections. The newest act, CPRA, also triples the maximum penalties for privacy violations involving minors (consumers under 16) to $7,500 per violation.

The California Rights and Enforcement Act of 2020 (CPRA), which takes effect on January 1, 2023, amends and hardens the preceding CCPA act in the following ways:

Higher inclusion thresholds with CPRA

Under the CPRA, any business that buys, sells or shares personal data of 100,000 consumers for business purposes is required to comply with the law. The old threshold, before CPRA, was 50,000 and included the sale of devices, which has now been eliminated. Note that the annual gross revenue of $25 million or 50 percent of annual revenues derived from the sale of consumer data remains the same.

CPRA brings expanded information definitions

With CPRA, consumers can request that businesses stop selling “sensitive personal information,” defined as any one of the following: social security number, account credentials and geolocation. It also protects more abstract information such as health, race, ethnicity, religion and memberships.

CPRA expands consumer rights

The CPRA expands the “right to opt out” beyond resale to include non-monetary transfers. Now, consumers can opt out from the sharing of their personal information, defined as disclosure or transfer to a third-party.

The CPRA expands the “right to know” from a 12-month limitation to beyond one year. And, the law also expands disclosure obligations to require businesses to notify consumers of the length of time they will retain personal information.

In addition to the amendments, CPRA adds a new “right of correction,” which provides a mechanism for consumers to correct inaccurate information. Businesses must now disclose this right and make “commercially reasonable” efforts to do so.

CPRA new exceptions and extensions

The CPRA doesn’t swing all to the consumer. The new law creates an exception to the “right to delete” allowing businesses to deny a request of the retention of personal data is “reasonably necessary and proportionate” and is adequately protected. Also, the CPRA extends employee and business-to-business exemptions until January 1, 2023.

CCPA and CPRA

Beyond the new rights and exemptions, the CCPA and CPRA duo demonstrate an overwhelming demand by consumers for their privacy and eliminate a carte blanche approach to the collection and dissemination of information. By implication, it means consumers expect that businesses will protect their data, not only from business operations, but from unauthorized access, transfer and resale. CPRA means businesses, while mapping data flow and resale, need to secure that entire pipeline from one end to the other.

View Most Recent Blogs
eSentire
eSentire

eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1200+ organizations in 75+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.