[Cannabis Law] SAFE Banking Act Removed from Defense Spending Bill by Jonathan Gallo

After legalizing simple possession of marijuana less than 1 year ago, Virginia is seeking to become the next state, behind Oregon to decriminalize the possession of psilocybin or psilocyn, commonly known as psychedelic or “magic” mushrooms.  Recent legislation introduced in the Virginia Senate this week by Senators Ghazala Hashmi (D) and Jennifer Boysko (D) would make the possession of these substances by a person over 21 punishable by a civil penalty of no more than $100.  Currently, possession of these substances is a Class 5 felony punishable by up to 10 years in prison.  A similar bill, introduced in the Virginia House of Delegates by Delegate Dawn Adams (D) would also decriminalize the possession of peyote, a cactus that contains the psychedelic compound mescalin, as well as ibogaine, an alkaloid substance found in a native African shrub called Tabernantheiboga that has hallucinogenic properties.

The legislation follows a slow but growing movement toward decriminalizing certain drugs based on studies of their use in medical applications.  For example, according to the results of a recent study psilocybin was found to be an effective therapy for treatment-resistant depression and ibogaine has been used to treat opioid and other addictions.  However, these hallucinogens are still considered illegal federally and are classified as Schedule 1 drugs (similar to heroin and LSD) under the federal Controlled Substances Act (CSA).  Pursuant to the CSA, Schedule 1 substances have a high potential for abuse, no currently accepted medical use in treatment in the United States, and a lack of accepted safety for use under medical supervision.  However, non-hallucinogenic versions of some of these drugs are being developed.

Whether either of these bills passes remains to be seen, however, it does demonstrate that Virginia appears to be one of the states at the forefront of new and upcoming drug-related legislation. 

Phishing has been a staple in the cybersecurity threat landscape for decades. That means that phishing is one of the most dangerous activities to an organization’s cybersecurity health. As a result, the need for proper anti-phishing hygiene and best practices is an absolute must.

With that in mind, here are a few quick best practices and tips for dealing with phishing threats. Think before you click on any suspicious emails, links, or attachments.

Know the Red Flags

Phishes are masters of making their content and interactions appealing. From content design to language, it can be difficult to discern whether the content is genuine or a potential threat, which is why it is so important to know the red flags. Awkward and unusual formatting, overly explicit call-outs to click a hyperlink or open an attachment, and subject lines that create a sense of urgency, are all indicators that the content you received could be a potential phishing attack and should be handled with caution.

Verify the Source

Phishing content comes in a variety of ways however, many phishes will try to impersonate someone you may already know – such as a colleague, service provider, or friend – as a way to trick you into believing their malicious content is actually trustworthy. Don’t fall for it. If you sense any red flags that something may be out of place or unusual, reach out directly to the individual through a different method (for example, if the potential phish was an email, call the person instead) to confirm whether the content is authentic and safe. If not, break off communication immediately and flag the incident through the proper channels.

Be Aware of Vishing and Other Phishing Offshoots

As more digital natives have come online and greater awareness has been spread about phishing, bad actors have begun to diversify their phishing efforts beyond traditional email. For example, voice phishing, or vishing, has become a primary alternative for bad actors looking to gain sensitive information from unsuspecting individuals. Similar to conventional phishing, vishing is typically executed by individuals posing as a legitimate organization such as a healthcare provider or insurer and asking for sensitive information. Simply put, it is imperative that individuals be wary of any sort of communication that asks for personal information whether it be via email, phone, or chat, especially if the communication is unexpected. If anything seems suspicious, again, break off the interaction immediately and contact the company directly to confirm the veracity of the communications.

Phishing may be “one of the oldest tricks in the book,” but it is still incredibly effective. And although it may be hard to spot when you may be in the midst of a phishing attempt, by exercising caution and deploying these few fundamentals, individuals and organizations more broadly can drastically mitigate the chances of falling victim to a phishing attack.

---------------------

*Adapted from content provided by the National Cybersecurity Alliance (NCA). Vandeventer Black is an authorized NCA Cybersecurity Champion for their 2021 campaign “Do Your Part. #BeCyberSmart.”

Marijuana Banking Legislation Update:

This week, the Secure and Fair Enforcement (SAFE) Banking Act, which would prohibit financial institutions from being penalized for doing business with marijuana companies, was stripped from the National Defense Authorization Act (NDAA), the omnibus spending bill pending in Congress. In September, the House included the SAFE Banking Act as an amendment to the NDAA for the fiscal year 2022, but the Act was removed by a conference committee in the Senate this week. U.S. Rep. Ed Perlmutter (D – Colorado) confirmed the legislation’s removal on Twitter.

The House passed a similar cannabis banking reform bill in 2019, but the legislation has yet to make it through the Senate. The SAFE Banking Act would ease restrictions on the use of banking services by legitimate marijuana-related businesses by, among other things, prohibiting a federal banking regulator from penalizing a depository institution for providing banking services to a cannabis-related business where state law allows such businesses.

According to a recent tweet by Rep. Perlmutter, the SAFE Banking Act would “strengthen the security of our financial system & keep bad actors like cartels out. Most importantly, it will reduce the risk of violent crime in our communities.”

The SAFE Banking Act, along with other federal legislation such as the Marijuana Opportunity Reinvestment & Expungement (MORE) Act, which seeks to remove marijuana from the list of scheduled substances under the Controlled Substances Act, the proposed Cannabis Administration and Opportunity Act, a comprehensive de-scheduling and restorative justice proposal, and the recently announced States Reform Act, which seeks to end the federal prohibition of marijuana, all represent the latest efforts in Congress to decriminalize marijuana at the federal level. While cannabis reform legislation has been gaining momentum in Congress in recent years, thus far, these efforts have been unsuccessful.

Over the past few years, some of the largest and well-known companies have been affected by data breaches resulting in millions of dollars in losses.  Smaller businesses are not immune from data breaches, and even a small data breach impacting only a few thousand records can expose a business to significant losses and reputational damage that may have a devastating impact on its ability to function.  Various attack methods can be used against businesses to obtain sensitive data or access funds through fraud.  Some common attack methods are compromised credentials, social engineering attacks such as phishing, vishing, and smishing, business email compromise scams, ransomware, and vulnerabilities in third-party software.  While no business can expect to be 100% safe, here are some basic practices businesses can implement to improve their cyber hygiene.

1. Keep Software Updated

• Keep all software, including applications, web browsers, firmware, and operating systems up to date by installing updates regularly or consider implementing automatic updates
• Discontinue and remove any software that is no longer supported

2. Use Strong Passwords/Passphrases

• Longer is more secure: consider the longest password allowable or consider using a group of words to create a passphrase that is long and memorable
• Consider using a password manager
• Use separate passwords/phrases for separate accounts
• Never reuse passwords and require password changes on a regular basis
• Limit the number of allowable unsuccessful login attempts

3. Use Multi-factor Authentication

• Using strong passwords or passphrases alone are not enough and using multi-factor authentication provides a more secure method of authorizing access such as through a temporary code provided on a smartphone or a token

4. Encrypt Devices

• This includes laptops, tablets, smartphones, removable media that contain sensitive personal information, and data backups

5. Backup Files

• Utilize data backups. Multiple backups that are separate from your internal network such as through the cloud and/or on external drives or other media are more secure if your network is compromised by ransomware

6. Secure Wireless Networks

• Change router default name and password and turn off remote management
• Use at least WPA3 encryption
• Limit remote access to the network using a virtual private network (VPN)
• Do not use open wireless networks
• Utilize up to date firewalls and anti-virus software

7. Be Suspicious of Unexpected Emails, Phone Calls, and Text Messages

• Social engineering attacks can come from a variety of sources
• When in doubt, do not click on suspicious links, attachments, or give out personal information over the phone

8. Limit Who Has Access to Sensitive Data By Implementing Least Privilege Access

• Determine who requires access to sensitive information and limit access to the lowest level necessary and only to those who require access to perform job functions
• Implement physical security protocols to protect sensitive data. These may include monitoring access to facilities, ensuring visitors are escorted and ensuring that employees who are no longer employed by the business no longer have access to facilities and systems.

9. Data Destruction

• As part of a data retention policy, require sensitive data that is no longer needed or required by policy or applicable law to be destroyed in a secure manner

10. Develop an Information Security/Breach Response and Notification Plan

• The worst time to develop an information security/breach response/notification plan is after a breach has already occurred and the plan should include not only the steps to take immediately after a breach is discovered but a process for any required notifications
• Include other policies such as a social media/bring your own device (BYOD) policy to define when and how employees may access these devices, social media, and personal email

11. Business Continuity/Disaster Recovery Plan

• Any information security plan should include continuity of operations and a disaster recovery plan.
• If a breach or other event impacting the availability of information systems occurs, your business must have the ability to be able to have access to the information you need to continue operating.

12. Continuous Review

• Once developed, policies should be reviewed and updated at least annually, or more frequently, to ensure they are up to date and accurately reflect your business’s operating model and technical environment.

13. Training

• Have a regular training program to educate your employees on cyber risk
• Awareness of cyber risks is part of an overall risk mitigation strategy and creates a culture of good cyber hygiene

Be sure to return to our website throughout October for additional information and resources to raise your business’s cybersecurity awareness and to help prepare for and respond to cyber-attacks.

This recording provides an overview of the recent legislation, the Virginia Cannabis Control Authority and licensing, and general considerations for new businesses in Virginia. ​ 

-Virginia’s Cannabis Landscape​ 

-Virginia’s New Marijuana Law​ 

-Regulations/Licensing​ 

-Business and Employment Considerations