Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


03:01 PM
Connect Directly

Managing The Legal Risks Of Active Defense

Legal considerations must come to bear in risk management calculations made with regard to implementing active defense measures with IT security practices

As increasingly more organizations deliberate adding active defense strategies to their IT security practices, they'll need to consider the risk management baggage that accompanies these aggressive maneuvers. One of the top risk considerations to factor into a decision about active defense activities should be legal concerns, according to a cyber law expert who last week at Black Hat outlined the legal ramifications of a number of common active defense scenarios.

Among the highlights, Robert Clark, distinguished professor of law for the Cyber Operations Center for Cyber Security Studies at the US Naval Academy, recommended that enterprises bear in mind two important points. First, that the right to protect property is not unlimited—in the physical world, for example, one can't kill someone who has stolen their stuff. And, second, that if IT risk managers are contemplating going down the path of active defense they should be involving their attorneys early and often in the decision-making process.

Click here for more of Dark Reading's Black Hat articles.

"If you're going to do this, you're going to need a great team of lawyers, or at least one really great lawyer, to handle this for you," said Clark, who said he was speaking in a personal capacity as a cybersecurity law expert. "Explain the technology to them at a third-grade level so that they can turn to senior leaders or judge and jury to explain it at a first-grade level."

Clark detailed some of the legal aspects of common active defense situations, including the legal pitfalls of seeding networks with deceptive information or decoy honeypots. For example, if an organization sets up fake internal documents with no intent for them to be made public but they are nevertheless stolen and sent to the media these seemingly legitimate documents could be confused as public disclosure to the Securities and Exchange Comission (SEC).

"If I'm the SEC and I see the documents coming out there, I can tell you, I'm going to be knocking at your door. And your shareholders are going to be knocking at your door as you're sitting there trying to explain it is part of a deception plan," he said. "That's why you have to get your SEC lawyers involved when you're having this discussion of what you want to do."

Even more common, though, are the situations Clark went over with regard to recovery of stolen intellectual property or other sensitive data when an organization can locate where the data is housed outside of the network. Every scenario is different, but he advised his audience that the law will likely look more favorably if the organization has done everything it can on the prevention side before it takes an intrusive measure against an antagonist.

"The law favors prevention over post-trespass recovery," he said. Also, the courts are likely to consider whether an organization is supposed to be where it is from a permissions standpoint, using the real-world analogy of sitting in a bar frequented by a competitor's executives versus using a hidden microphone in a private office.

So, there would be a lot more grey area to work around if an organization erased data from an anonymous FTP server with open privileges than if they escalated privileges or broke into an attacker's private machine. Meanwhile if an innocent and unknowing third party's machine is being used to host data, the organization would likely have no legal standing to simply go in and act , but they could ask permission to delete the data. However, even situations like the first one with the anonymous FTP server could have the potential to land an organization in hot water with the Department of Justice (DOJ) for Computer Abuse and Fraud Act violations. According to Clark, organizations that don't like it shouldn't blame the DOJ.

"I'll tell you something. When you're talking about recovery operations, I really do believe that this is a no-win situation," Clark says. "Don't blame doj for anything. Blame congress. If you've got a problem with something, you need to talk to congress about changing the law. You elected them, they work for you, that's what needs to be changed."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Are You One COVID-19 Test Away From a Cybersecurity Disaster?
Alan Brill, Senior Managing Director, Cyber Risk Practice, Kroll,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-28
An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=manage_car because .php files can be uploaded to admin/assets/uploads/ (under the web root).
PUBLISHED: 2020-10-28
The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certain varieties of games were created within MediaWiki, their names or titles could be manipulated to generate stored XSS within the RandomGameUnit extension.
PUBLISHED: 2020-10-27
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS.
PUBLISHED: 2020-10-27
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Apple Music 3.4.0 for Android. A malicious application may be able to leak a user's credentials.
PUBLISHED: 2020-10-27
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra. A malicious application may be able to overwrite arbitrary files.