Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/23/2019
10:00 AM
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

How Network Logging Mitigates Legal Risk

Logging that is turned on, captured, and preserved immediately after a cyber event is proof positive that personal data didn't fall into the hands of a cybercriminal.

One of the first questions I ask in my role as an attorney responding to a cybersecurity incident is typically: Do you have any logs?

All too often, the answer is no.

The sad truth is that even a simple ransomware event becomes legally complicated without logging mechanisms. Why? Because a cybersecurity attorney's job is to navigate the statutory framework applicable to a cyber event. That includes determining whether the client needs to give notice under any applicable law to a client's customers, employees, patients, or other affected individuals.

The legal implications of notice can be intense. A standard breach notice contains a brief summary of the incident along with specific language from the relevant breach notification statute. But beyond the piece of paper, the breach notice can give rise to affected individuals bringing lawsuits or making demands related to the cyber event. Notice to customers or other affected persons can also then require notice to regulators. Notice is often the last thing a company will want to do unless it is absolutely forced to do so under the law.

For most businesses, there is no uniform breach notification protocol that must be followed. Instead, it is left to me, the lawyer, to piece together the myriad applicable statutes potentially at play and to determine whether notice is required under those statutes.

Here are three important examples to consider in a breach context:

HIPAA (Health Insurance Portability and Accountability Act), governing protected health information, requires that a healthcare provider (or business associate) presume that an impermissible use or disclosure has occurred unless the entity can demonstrate that there is a low probability that the protected health information has been compromised based on a factor-by-factor analysis.

Virginia's breach notification statute defines a breach as "the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes, or the individual or entity reasonably believes has caused, or will cause, identity theft or other fraud to any resident of the Commonwealth."

New York's data breach notification statute was recently amended to apply beyond the notification of the unauthorized acquisition of computerized data to both unauthorized access to or acquisition of such data.

What do these arcane legal regulations mean in the context of network logs? It means that if an organization is victimized by a ransomware attack, for example, a lawyer can use the logs to show that personal or protected information did not leave the client's systems.

On the other hand, the lack of network logs would lead me to recommend that the company undertake complicated forensic steps — at significant cost — including the procurement of forensic images and assessments of those images as circumstantial evidence that information did not leave the safety of a client's network. Not only that, but network logs insulate a client from a regulator's watchful eye after an event. Having the logs to show a regulator that personal identifying information did not leave the client's systems is proof that may assist in shutting a regulatory inquiry down.

While notice to consumers or affected individuals can be necessary and unavoidable in certain cyber scenarios, it is never a decision that I as an attorney make lightly. As mentioned above, notice alerts a consumer to a potential negligence claim against a company for failure to provide adequate security protections. Notice can lead to lawsuits and lawsuits can lead to liability. Notice is, in short, the legal nuclear option.

Ensuring that logging is turned on, captured, and preserved immediately after a cyber event is critical to mitigating legal risk. Having proof that information did not get into the hands of a cybercriminal after a simple cyber event will avoid significant expense and exposure. So, turn the logs on. Your lawyer will thank you.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "A Beginner's Guide to Microsegmentation."

Beth Burgin Waller is a lawyer who knows how to navigate between the server room and the board room. As chair of the cybersecurity & data privacy practice at Woods Rogers, she advises clients on cybersecurity and on data privacy concerns. In this capacity, she ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27486
PUBLISHED: 2021-04-12
The Fatek Automation WinProladder Versions 3.3 and prior are vulnerable to an integer underflow, which may cause an out-of-bounds write and allow an attacker to execute arbitrary code.
CVE-2021-3465
PUBLISHED: 2021-04-12
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-15942
PUBLISHED: 2021-04-12
An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile.
CVE-2021-22190
PUBLISHED: 2021-04-12
A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token
CVE-2021-24024
PUBLISHED: 2021-04-12
A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files.