Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


03:01 PM
Connect Directly

Managing The Legal Risks Of Active Defense

Legal considerations must come to bear in risk management calculations made with regard to implementing active defense measures with IT security practices

As increasingly more organizations deliberate adding active defense strategies to their IT security practices, they'll need to consider the risk management baggage that accompanies these aggressive maneuvers. One of the top risk considerations to factor into a decision about active defense activities should be legal concerns, according to a cyber law expert who last week at Black Hat outlined the legal ramifications of a number of common active defense scenarios.

Among the highlights, Robert Clark, distinguished professor of law for the Cyber Operations Center for Cyber Security Studies at the US Naval Academy, recommended that enterprises bear in mind two important points. First, that the right to protect property is not unlimited—in the physical world, for example, one can't kill someone who has stolen their stuff. And, second, that if IT risk managers are contemplating going down the path of active defense they should be involving their attorneys early and often in the decision-making process.

Click here for more of Dark Reading's Black Hat articles.

"If you're going to do this, you're going to need a great team of lawyers, or at least one really great lawyer, to handle this for you," said Clark, who said he was speaking in a personal capacity as a cybersecurity law expert. "Explain the technology to them at a third-grade level so that they can turn to senior leaders or judge and jury to explain it at a first-grade level."

Clark detailed some of the legal aspects of common active defense situations, including the legal pitfalls of seeding networks with deceptive information or decoy honeypots. For example, if an organization sets up fake internal documents with no intent for them to be made public but they are nevertheless stolen and sent to the media these seemingly legitimate documents could be confused as public disclosure to the Securities and Exchange Comission (SEC).

"If I'm the SEC and I see the documents coming out there, I can tell you, I'm going to be knocking at your door. And your shareholders are going to be knocking at your door as you're sitting there trying to explain it is part of a deception plan," he said. "That's why you have to get your SEC lawyers involved when you're having this discussion of what you want to do."

Even more common, though, are the situations Clark went over with regard to recovery of stolen intellectual property or other sensitive data when an organization can locate where the data is housed outside of the network. Every scenario is different, but he advised his audience that the law will likely look more favorably if the organization has done everything it can on the prevention side before it takes an intrusive measure against an antagonist.

"The law favors prevention over post-trespass recovery," he said. Also, the courts are likely to consider whether an organization is supposed to be where it is from a permissions standpoint, using the real-world analogy of sitting in a bar frequented by a competitor's executives versus using a hidden microphone in a private office.

So, there would be a lot more grey area to work around if an organization erased data from an anonymous FTP server with open privileges than if they escalated privileges or broke into an attacker's private machine. Meanwhile if an innocent and unknowing third party's machine is being used to host data, the organization would likely have no legal standing to simply go in and act , but they could ask permission to delete the data. However, even situations like the first one with the anonymous FTP server could have the potential to land an organization in hot water with the Department of Justice (DOJ) for Computer Abuse and Fraud Act violations. According to Clark, organizations that don't like it shouldn't blame the DOJ.

"I'll tell you something. When you're talking about recovery operations, I really do believe that this is a no-win situation," Clark says. "Don't blame doj for anything. Blame congress. If you've got a problem with something, you need to talk to congress about changing the law. You elected them, they work for you, that's what needs to be changed."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Human Nature vs. AI: A False Dichotomy?
John McClurg, Sr. VP & CISO, BlackBerry,  11/18/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: -when I told you that our cyber-defense was from another age
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-11-20
An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities.
PUBLISHED: 2019-11-20
The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.
PUBLISHED: 2019-11-20
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail syste...
PUBLISHED: 2019-11-20
A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service.
PUBLISHED: 2019-11-20
A potential vulnerability in the discontinued Customer Engagement Service (CCSDK) software version may allow local privilege escalation.