Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
3/14/2018
09:00 AM
Peter Martini
Peter Martini
Partner Perspectives
50%
50%

How to Interpret the SECs Latest Guidance on Data Breach Disclosure

Forward-looking organizations should view this as an opportunity to reevaluate their cybersecurity posture and install best practices that should have already been in place.

On the heels of several headline-grabbing data breaches – and greater emphasis on the importance of disclosure in the lead-up to the May 25 General Data Protection Regulation (GDPR) deadline – the US Securities and Exchange Commission (SEC) recently issued a statement that puts more responsibility on executives for data breaches.

This updated guidance calls for public companies to provide investors with more information on all cybersecurity incidents – even just the existence of potential risks – with minimal delay. The statement goes a step farther in attempting to thwart the potential for the exchange of "insider" information, which was a major concern on the heels of the record-shattering Equifax data breach.

Specifically, corporate officers, directors and “other corporate insiders” are prohibited from trading shares if they have knowledge of any unpublicized security incident within the company.

While the overall intent of this latest statement is clear, the guidance is vague in key areas by design. For instance, the second section of the guidance emphasizes that companies must make "timely disclosure of any related material nonpublic information." It’s unclear what the SEC explicitly means by "timely disclosure," as the SEC doesn’t provide a specific time limit that companies must meet. This puts a lot of trust in corporate leaders to put speedy remediation and due diligence at the center of their security policy, which is a bit of a gamble given the track record of executive action during the fallout of the Equifax breach.

The GDPR, on the other hand, is much more prescriptive, giving organizations 72 hours to report an incident related to the personal data of EU citizenry. This isn’t to say that the European Commission has greater distrust for business leaders to make the right call than legislators in the United States, so much as it creates a clear and distinct timetable.

The guidance from the SEC is significant, however, in that it essentially tees up every executive board to make room for or delegate an in-house expert on cybersecurity best practices. It updates a comparably less hawkish stance on the part of the SEC in trying to minimize the occurrence of insiders acting poorly in the time between a major data breach and public disclosure.

Another reason for the vagueness surrounding the actual time limits for disclosure is that the SEC doesn’t want to force businesses to prematurely disclose information that might only publicize vulnerabilities to potential hackers. It’s a delicate balance, as teams want to make sure they are planning their defense thoughtfully before inciting more damage to the company’s data stores – not to mention brand perception.

As part of the GDPR guidance, many data-centric businesses will be required by law to employ a Data Protection Officer (DPO) that acts alongside the network administrators and security teams to enforce best practices and report potential incidents. While this isn’t mandatory for all businesses, companies that aren’t looking to employ cybersecurity experts are doing so at their own risk – especially given this new guidance from the SEC. The cost for not following through on best practices in the event of a breach can be far more significant than putting an in-house expert on the payroll.

While many may view the new SEC guidance and GDPR as onerous red tape, forward-looking organizations should view this as an opportunity to reevaluate their cybersecurity posture and install best practices that should have already been in place. After all, having someone who is tasked with ensuring your organization is secure and protecting its data appropriately is something every organization should embrace.

As president and co-founder of iboss, Peter Martini has played a major role in developing iboss' innovative technology, and has helped shepherd iboss' phenomenal growth, since its founding. He has been awarded dozens of patents focused on network and mobile security, and with ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why CISOs Need a Security Reality Check
Joel Fulton, Chief Information Security Officer for Splunk,  6/13/2018
Cisco Talos Summit: Network Defenders Not Serious Enough About Attacks
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2018
Meet 'Bro': The Best-Kept Secret of Network Security
Greg Bell, CEO, Corelight,  6/14/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
iboss has created the first and only web gateway as a service specifically designed to solve the challenge of securing distributed organizations. Built for the cloud, the iboss Distributed Gateway Platform leverages an elastic, cloud-based node architecture that provides advanced security for todays decentralized organizations with more financial predictability. Backed by more than 110 patents and patents pending, and protecting over 4,000 organizations worldwide, iboss is one of the fastest growing cybersecurity companies in the world. To learn more, visit www.iboss.com.
Featured Writers
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12294
PUBLISHED: 2018-06-19
WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.
CVE-2018-12519
PUBLISHED: 2018-06-19
An issue was discovered in ShopNx through 2017-11-17. The vulnerability allows a remote attacker to upload any malicious file to a Node.js application. An attacker can upload a malicious HTML file that contains a JavaScript payload to steal a user's credentials.
CVE-2018-12588
PUBLISHED: 2018-06-19
Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-1 before 3.1.1-2 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the S...
CVE-2018-10811
PUBLISHED: 2018-06-19
strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable.
CVE-2018-10945
PUBLISHED: 2018-06-19
The mg_handle_cgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash, or NULL pointer dereference) via an HTTP request, related to the mbuf_insert function.