Increased Cyber Regulation in the Offing as Attacks Mount

Cybersecurity could be heading for a Sarbanes Oxley-type of regulation in light of escalating attacks, but the devil is in the details.

Jeff Moss on stage at Black Hat Europe
Jeff Moss on stage at Black Hat Europe 2023.Source: Dan Raywood at Black Hat Europe

BLACK HAT EUROPE 2023 — London — Expect governments to impose greater levels of cybersecurity regulation if businesses cannot defend against major attacks and stop breaches from happening.

That's a prediction from Black Hat founder Jeff Moss, speaking at Black Hat Europe in London this week. He believes that eventually, the world will come to a tipping point where too many highly impactful breaches and escalating infrastructure hits from nation state-sponsored attackers will spur governments to act.

"Self-regulation is not working," he noted from the keynote stage.

Moss also said that security could head towards a Sarbanes Oxley (SOX) moment, a US law implemented after the 2001 collapse of Enron that protects investors by auditing for fraudulent accounting and shady financial practices at publicly traded companies. Achieving SOX compliance requires financial reports to include an internal controls report to show that a company's financial data is accurate, and adequate controls are in place to safeguard financial data — and one can easily see how that could translate to cybersecurity auditing.

Regulation Needs to Be Nuanced

Meanwhile, Black Hat Europe keynote speaker and former Uber CISO Joe Sullivan (who himself has been convicted of and on probation for fraud for failing to alert regulators of a 2016 cybersecurity breach at the ride-share giant) stresses that regulators need to be level-headed in terms of who should be held accountable for keeping people safe, and consider the realities of how data breaches and their containment play out on the ground. Should someone face jailtime for succumbing to social engineering, for instance? Is the CFO who doesn't think two-factor authentication fits the company budget on the hook for fines when an account takeover leads to a ransomware attack? What about the security team who failed to appropriately make the case for it?

Speaking to Dark Reading, Sullivan uses the example of the SEC's newly implemented data-breach reporting rules; when the SEC put a request out for feedback on a draft set of the rules, it failed to incorporate insight from those working in the trenches, he alleges.

"I wish the security community would actually give them feedback, not just the [victims affected by breaches]," he says. "I think most of the people who have sat in those government seats have never sat in the CISO seat or the security engineer seat, and they're not going to have empathy."

Even so, a regulatory approach, if done correctly, could make security a whole-of-company focus, which could lead to positive outcomes in terms of preparedness and defenses, he says.

"[The] regulators' message is, 'if you're not going to keep people safe, there is going to be consequences,'" he notes. "We need that to be heard at the highest levels of the company, not just at the security level of the company, and then we'll get real change."

Read more about:

Black Hat News

About the Author(s)

Dan Raywood, Senior Editor, Dark Reading

With more than 20 years experience of B2B journalism, including 12 years covering cybersecurity, Dan Raywood brings a wealth of experience and information security knowledge to the table. He has covered everything from the rise of APTs, nation-state hackers, and hacktivists, to data breaches and the increase in government regulation to better protect citizens and hold businesses to account. Dan is based in the U.K., and when not working, he spends his time stopping his cats from walking over his keyboard and worrying about the (Tottenham) Spurs’ next match.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights