Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/23/2019
10:00 AM
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

How Network Logging Mitigates Legal Risk

Logging that is turned on, captured, and preserved immediately after a cyber event is proof positive that personal data didn't fall into the hands of a cybercriminal.

One of the first questions I ask in my role as an attorney responding to a cybersecurity incident is typically: Do you have any logs?

All too often, the answer is no.

The sad truth is that even a simple ransomware event becomes legally complicated without logging mechanisms. Why? Because a cybersecurity attorney's job is to navigate the statutory framework applicable to a cyber event. That includes determining whether the client needs to give notice under any applicable law to a client's customers, employees, patients, or other affected individuals.

The legal implications of notice can be intense. A standard breach notice contains a brief summary of the incident along with specific language from the relevant breach notification statute. But beyond the piece of paper, the breach notice can give rise to affected individuals bringing lawsuits or making demands related to the cyber event. Notice to customers or other affected persons can also then require notice to regulators. Notice is often the last thing a company will want to do unless it is absolutely forced to do so under the law.

For most businesses, there is no uniform breach notification protocol that must be followed. Instead, it is left to me, the lawyer, to piece together the myriad applicable statutes potentially at play and to determine whether notice is required under those statutes.

Here are three important examples to consider in a breach context:

HIPAA (Health Insurance Portability and Accountability Act), governing protected health information, requires that a healthcare provider (or business associate) presume that an impermissible use or disclosure has occurred unless the entity can demonstrate that there is a low probability that the protected health information has been compromised based on a factor-by-factor analysis.

Virginia's breach notification statute defines a breach as "the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes, or the individual or entity reasonably believes has caused, or will cause, identity theft or other fraud to any resident of the Commonwealth."

New York's data breach notification statute was recently amended to apply beyond the notification of the unauthorized acquisition of computerized data to both unauthorized access to or acquisition of such data.

What do these arcane legal regulations mean in the context of network logs? It means that if an organization is victimized by a ransomware attack, for example, a lawyer can use the logs to show that personal or protected information did not leave the client's systems.

On the other hand, the lack of network logs would lead me to recommend that the company undertake complicated forensic steps — at significant cost — including the procurement of forensic images and assessments of those images as circumstantial evidence that information did not leave the safety of a client's network. Not only that, but network logs insulate a client from a regulator's watchful eye after an event. Having the logs to show a regulator that personal identifying information did not leave the client's systems is proof that may assist in shutting a regulatory inquiry down.

While notice to consumers or affected individuals can be necessary and unavoidable in certain cyber scenarios, it is never a decision that I as an attorney make lightly. As mentioned above, notice alerts a consumer to a potential negligence claim against a company for failure to provide adequate security protections. Notice can lead to lawsuits and lawsuits can lead to liability. Notice is, in short, the legal nuclear option.

Ensuring that logging is turned on, captured, and preserved immediately after a cyber event is critical to mitigating legal risk. Having proof that information did not get into the hands of a cybercriminal after a simple cyber event will avoid significant expense and exposure. So, turn the logs on. Your lawyer will thank you.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "A Beginner's Guide to Microsegmentation."

Beth Burgin Waller is a lawyer who knows how to navigate between the server room and the board room. As chair of the cybersecurity & data privacy practice at Woods Rogers, she advises clients on cybersecurity and on data privacy concerns. In this capacity, she ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Rookiewilliams99@gmail.com
50%
50%
[email protected],
User Rank: Apprentice
10/8/2019 | 4:50:35 PM
Network logging
I am sure that logging does mitigate the legal risk, but is there any information on which logs are adequate for that task? 

I collect and keep a lot of logs from servers, Internet access, logins/logouts, etc. but trying to prove that a bad actor didn't copy and encrypted file outbound using HTTPS would be a tall task indeed.

 
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
TPM-Fail: What It Means & What to Do About It
Ari Singer, CTO at TrustPhi,  11/19/2019
Ransomware Surge & Living-Off-the-Land Tactics Remain Big Threats
Jai Vijayan, Contributing Writer,  11/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19013
PUBLISHED: 2019-11-22
A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.
CVE-2019-3427
PUBLISHED: 2019-11-22
The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability. An attacker could exploit the vulnerability to inject malicious code into the management page, resulting in users� information leakage.
CVE-2019-3428
PUBLISHED: 2019-11-22
The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker could directly access the management portal in HTTP, resulting in users� information leakage.
CVE-2019-4214
PUBLISHED: 2019-11-22
IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 159185.
CVE-2019-4215
PUBLISHED: 2019-11-22
IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks ag...