Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/23/2019
10:00 AM
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

How Network Logging Mitigates Legal Risk

Logging that is turned on, captured, and preserved immediately after a cyber event is proof positive that personal data didn't fall into the hands of a cybercriminal.

One of the first questions I ask in my role as an attorney responding to a cybersecurity incident is typically: Do you have any logs?

All too often, the answer is no.

The sad truth is that even a simple ransomware event becomes legally complicated without logging mechanisms. Why? Because a cybersecurity attorney's job is to navigate the statutory framework applicable to a cyber event. That includes determining whether the client needs to give notice under any applicable law to a client's customers, employees, patients, or other affected individuals.

The legal implications of notice can be intense. A standard breach notice contains a brief summary of the incident along with specific language from the relevant breach notification statute. But beyond the piece of paper, the breach notice can give rise to affected individuals bringing lawsuits or making demands related to the cyber event. Notice to customers or other affected persons can also then require notice to regulators. Notice is often the last thing a company will want to do unless it is absolutely forced to do so under the law.

For most businesses, there is no uniform breach notification protocol that must be followed. Instead, it is left to me, the lawyer, to piece together the myriad applicable statutes potentially at play and to determine whether notice is required under those statutes.

Here are three important examples to consider in a breach context:

HIPAA (Health Insurance Portability and Accountability Act), governing protected health information, requires that a healthcare provider (or business associate) presume that an impermissible use or disclosure has occurred unless the entity can demonstrate that there is a low probability that the protected health information has been compromised based on a factor-by-factor analysis.

Virginia's breach notification statute defines a breach as "the unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security or confidentiality of personal information maintained by an individual or entity as part of a database of personal information regarding multiple individuals and that causes, or the individual or entity reasonably believes has caused, or will cause, identity theft or other fraud to any resident of the Commonwealth."

New York's data breach notification statute was recently amended to apply beyond the notification of the unauthorized acquisition of computerized data to both unauthorized access to or acquisition of such data.

What do these arcane legal regulations mean in the context of network logs? It means that if an organization is victimized by a ransomware attack, for example, a lawyer can use the logs to show that personal or protected information did not leave the client's systems.

On the other hand, the lack of network logs would lead me to recommend that the company undertake complicated forensic steps — at significant cost — including the procurement of forensic images and assessments of those images as circumstantial evidence that information did not leave the safety of a client's network. Not only that, but network logs insulate a client from a regulator's watchful eye after an event. Having the logs to show a regulator that personal identifying information did not leave the client's systems is proof that may assist in shutting a regulatory inquiry down.

While notice to consumers or affected individuals can be necessary and unavoidable in certain cyber scenarios, it is never a decision that I as an attorney make lightly. As mentioned above, notice alerts a consumer to a potential negligence claim against a company for failure to provide adequate security protections. Notice can lead to lawsuits and lawsuits can lead to liability. Notice is, in short, the legal nuclear option.

Ensuring that logging is turned on, captured, and preserved immediately after a cyber event is critical to mitigating legal risk. Having proof that information did not get into the hands of a cybercriminal after a simple cyber event will avoid significant expense and exposure. So, turn the logs on. Your lawyer will thank you.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "A Beginner's Guide to Microsegmentation."

Beth Burgin Waller is a lawyer who knows how to navigate between the server room and the board room. As chair of the cybersecurity & data privacy practice at Woods Rogers, she advises clients on cybersecurity and on data privacy concerns. In this capacity, she ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
APT Groups Set Sights on Linux Targets: Inside the Trend
Kelly Sheridan, Staff Editor, Dark Reading,  9/11/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9739
PUBLISHED: 2020-09-18
Adobe Media Encoder version 14.3.2 (and earlier versions) has an out-of-bounds read vulnerability that could be exploited to read past the end of an allocated buffer, possibly resulting in a crash or disclosure of sensitive information from other memory locations. User interaction is required to exp...
CVE-2020-9744
PUBLISHED: 2020-09-18
Adobe Media Encoder version 14.3.2 (and earlier versions) has an out-of-bounds read vulnerability that could be exploited to read past the end of an allocated buffer, possibly resulting in a crash or disclosure of sensitive information from other memory locations. User interaction is required to exp...
CVE-2020-9745
PUBLISHED: 2020-09-18
Adobe Media Encoder version 14.3.2 (and earlier versions) has an out-of-bounds read vulnerability that could be exploited to read past the end of an allocated buffer, possibly resulting in a crash or disclosure of sensitive information from other memory locations. User interaction is required to exp...
CVE-2020-0089
PUBLISHED: 2020-09-18
In the audio server, there is a missing permission check. This could lead to local escalation of privilege regarding audio settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-137015603
CVE-2020-0262
PUBLISHED: 2020-09-18
In WiFi tethering, there is a possible attacker controlled intent due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156353008