Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/4/2016
08:00 AM
Jason Straight
Jason Straight
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
0%
100%

Avoiding Legal Landmines in Data Breach Response

Building a legally defensible cybersecurity program means seeking out guidance from legal advisors before a serious incident forces you together.

Lawyers and information security professionals have something very fundamental in common: We see risk everywhere we look. 

As someone who began his career as an attorney but has gradually transitioned into information security, I have hung around long enough now to see the two disciplines gradually converge. Cybersecurity and the law are colliding all around us—sometimes violently, but increasingly in a more productive and mutually beneficial way. I have been an advisor to lawyers and security professionals alike, helping each understand the perspective and preoccupations of the other. Each discipline needs the other, and nowhere is that more apparent than in the area of data breach response. 

Companies who suffer a security breach that exposes sensitive information can now expect to be abruptly thrust into one legal process or another. Whether that process takes the form of a regulatory inquiry, a class-action suit or a contractual dispute, counsel’s role in helping respond to what was long considered “an IT issue” is more critical than ever before. For this reason, proactive cybersecurity professionals have begun seeking guidance from the legal department before an incident forces them together.

But where to start? 

I recommend that legal and cybersecurity professionals focus their initial collaborative efforts on achieving defensibility. From a legal perspective, a defensible security program is one that will withstand post-breach scrutiny and be deemed “reasonable” under the microscope of hindsight. Developing a defensible cybersecurity risk program involves working backwards from the moment of breach impact to look at all the steps along the way that could have been taken to prevent or mitigate the damage from a breach event. 

Why do I suggest this as a starting point? Because scrutiny of the steps taken – or not taken – to forestall a cybersecurity incident will undoubtedly come once you have suffered an incident. It’s far better to have taken a look in the mirror before you present yourself to the world. Despite the fact that your program will, by definition, have “failed” by the time the scrutiny commences, it is still possible to demonstrate your diligence in limiting exposure and containing the damage.

So how can you ensure your diligence is reasonably defensible?

Lawyers will rightly point to the concept of precedence. Courts are nearly always influenced—and in some cases bound—by similar cases and judicial reasoning that have come before. While there are not many judicial opinions at this stage that provide concrete parameters around what constitutes a defensible cybersecurity program, there are several potential sources of guidance.

A good starting point is to identify the regulators most relevant to your business. If you are in the financial services sector, then the Securities and Exchange Commission (SEC), the Federal Reserve Board (FRB) and the Consumer Financial Protection Bureau (CFPB) will likely be on your list. If you are in the retail or hospitality sector, you should pay close attention to the Federal Trade Commission (FTC) as well as state-level consumer protection law enforcers. Once you’ve compiled your list of regulators, do some research to identify what they have been doing – and saying – about cybersecurity. In addition to looking at the regulations themselves and formal filings by the agencies, you will also find speeches, position papers and bulletins that can help clarify what regulators find most important when it comes to cybersecurity risk management. If you are a security professional blanching at the thought of this exercise, here’s a hint: Most lawyers love a task like this, and are actually quite good at it. But they’ll undoubtedly need your help in interpreting what they find and understanding its implications.

It is important to note that this is not a compliance exercise.

Attaining a defensible security posture goes beyond merely being able to pass an audit. Indeed, much of the “guidance” out there will not present hard-and-fast rules. Logic and judgment are required for you to settle on a defensible standard. Security pros will need to help their legal colleagues understand the reality that aggressive security measures tend to undermine convenience and practicality. A good example is encryption, which can be very effective in protecting sensitive data and  meeting regulatory and judicial guidelines. But any IT professional will tell you that encryption technology is expensive and implementation can create operational delays and challenges that render it unfeasible. For instance, encrypting data at rest in a high-capacity data processing environment can grind processing operations to a halt. Finding the right balance between security and practicality is what achieving defensibility is all about. 

Security and legal professionals have a lot more in common than you might think. Avoiding the many hidden traps and obstacles in building a cybersecurity program requires openness to collaboration and real creativity. Bringing together legal and cybersecurity practitioners is the surest path to achieving a defensible cybersecurity program.   

Related Content:

  

Interop 2016 Las VegasCheck out Jason's upcoming presentation on legal landmines around IT infrastructure, Wednesday, May 4, at Interop 2016 at the Mandalay Bay Convention Center, Las Vegas. Click here for pricing information and to register.

Jason Straight<http://www.unitedlex.com/about-us/jason-straight.php> is the Senior Vice President and Chief Privacy officer at UnitedLex<http://www.unitedlex.com/>. He has more than a decade of experience assisting clients in managing information security risks, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
moarsauce123
100%
0%
moarsauce123,
User Rank: Ninja
5/16/2016 | 7:27:25 PM
Avoid lawyers talking cyber
Avoid paying lawyers like baldy here to write about cyber. I'm dumber having read this. This clown went from bilking legal clients hourly to now charging per hour for cyber for his company for people stupid enough to hire him with experience doing what? Find some better authors please.
Gary Scott
0%
100%
Gary Scott,
User Rank: Strategist
4/18/2016 | 6:56:49 PM
Lawyers see risk everywhere
Has the process of computer recycling or IT decommissioning hit your radar?  i've found many companies don't have policies and procedures for data destruction - from storing equipment to be recycled to how to destroy digital media such as hard drivs and backup tapes.
Psychologue Lyon
0%
100%
Psychologue Lyon,
User Rank: Guru
4/6/2016 | 3:10:29 PM
Security and justice
I am a French psychologist and I am pleased that you think about 
the data security problem and the legal consequences that this may have ...
In France it's much more complicated to address this problem .
Thank you for your post !
wendycohen
0%
100%
wendycohen,
User Rank: Apprentice
4/5/2016 | 3:48:39 PM
Protect the data BEFORE you're breached
The key is to protect the data before you're breached.  All organizations must understand and know how their organization monitors its sensitive data, stays compliant and if a DLP system is in place; can it actually block valuable data from being breached? 

A few suggested best practices for Global Governance, Risk & Compliance are:

- Be aware of the data that is being sent out of your control

- Know what data can be sent out of the network, is it being sent and where to

- Data detection accuracy of the organizations DLP system ensures the protection of the sensitive data with the proper control and notification of irregular activity. 

For more information on Data Security GR&C go to gttb

 

Wendy Cohen

GM Global Cloud Data Protection Practice

GTB Technologies, the "Content Aware" Data Protection Co.

#dlpthatworks
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-35519
PUBLISHED: 2021-05-06
An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel i...
CVE-2021-20204
PUBLISHED: 2021-05-06
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbi...
CVE-2021-30473
PUBLISHED: 2021-05-06
aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
CVE-2021-32030
PUBLISHED: 2021-05-06
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in router/httpd/httpd.c and auth_chec...
CVE-2021-22209
PUBLISHED: 2021-05-06
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted in GraphQL mutation being executed.