370 likes | 393 Views
Explore recent data breach incidents, lessons learned, and practice tips for protecting your business internationally. Learn about cross-jurisdictional crimes, multi-lateral enforcement, contracting for cloud safety, and more.
E N D
Lessons Learned From the Famous Data Breach Incidents Ted Claypoole Partner, Womble Carlyle
What will we Learn? • Recent Data Incidents • Lessons Learned • Practice Tips for Protecting a Business (throughout)
International Problem • Cross Jurisdictional Crimes • Multi-lateral Enforcement • Contracting for Cloud Safety • Cross-Border Data Transfers (EU)
Recent Attacks • Retail Giants Lose “Mass Quantities” • Target/Home Depot/Michaels/N-Marcus • Marriott/White Lodging/Trump • CVS/Costco/RiteAid • Heartland • Health Care Data Targeted • Anthem/Partners/Premera BC/CareFirst • 100 Bank Cyber heist/Scottrade • Vtech toy hack • Ashley Madison
Recent Attacks • Nation state Attacks • The Strange Case of Sony • Kaspersky Labs/RSA/LastPass/Infrastructure providers • OPM/DoD/HSD/Army Nat. Guard • Banks hit by Iran • Attacks by Criminals on Government • IRS/State Tax Authorities
All Data Holders are Targets • Wherever valuable data can be found • Creative uses of data (blackmail) • Data is power (OPM) • Quantity and Quality • Law firms are “soft underbelly” of business • Panama Papers • Cravath/ Weil Gotshal
Credit Cards Are Not the Only Target of ID Thieves • Medical Records • Anthem/BCBS • Tax Records • IRS • South Carolina • School Information • Many examples (fresh identities, unchecked) • Immigration Fraud
Hacking is now Highly Organized Crime • Tools available for anyone (marketplaces) • Organized markets for the stolen goods • System kidnapping • Botnet networks for lease • Hacking for hire • Bitcoin for payments
Secondary Markets • Market for Hacking Tools (Target) • Markets for stolen information
Secondary Market Exploits Zero-Day Prices Over Time “Some exploits” $200,000–$250,000 2007 “Weaponized exploit” $20,000–$30,000 2007 A “real good” exploit $100,000 2007 Microsoft Excel > $1,200 2007 Adobe Reader $5,000–$30,000 2012 Android $30,000–$60,000 2012 Chrome or Internet Explorer $80,000–$200,000 2012 Firefox or Safari $60,000–$150,000 2012 Flash or Java Browser Plug-ins $40,000–$100,000 2012 iOS $100,000–$250,000 2012 Mac OSX $20,000–$50,000 2012 Microsoft Word $50,000–$100,000 2012 Windows $60,000–$120,000 2012.
Secondary Market Data • Sales test – Most interest in Brazil, Russia and Nigeria • Creativity – discounts, guaranties, and customer loyalty programs according to Krebs • Darkode Bust, July 2015 • Arrests in 20 countries • Most sophisticated English Language forum for criminal hackers • Darkode was one of 800 data bazaars
Take Away • Anybody can be a hacker now • Anybody can profit from hacking now • Any data holder can be hacked • Your company HAS been hacked, IS being hacked, and WILL be hacked
Resiliency is the Watchword • Increasing Sophistication of Attacks • Attacks for Reasons Beyond Greed • Private Political Hackers • Attacking Business as an Act of War • Job 1 – Keep the Enterprise Running • Job 2 – Be Competent in Handling Adversity
Buck Stops at C-Level • Recent Study Finds Majority of Board Executives blame CEO rather than security team for a data breach. • NY Stock Exchange/Veracode study – 200 directors • C-Level holds purse • C-Level sets enterprise priorities • Target CEO fired • Sony Co-Chair resigned
Buck Stops at C-Level SEC holds Directors Responsible “Given the significant cyber-attacks that are occurring with disturbing frequency, and the mounting evidence that companies of all shapes and sizes are increasingly under a constant threat of potentially disastrous cyber-attacks, ensuring the adequacy of a company’s cybersecurity measures needs to be a critical part of a board of director’s risk oversight responsibilities.” See: CF Disclosure Guidance: Topic No. 2, Cybersecurity, Oct. 13, 2011
Protecting Your Company: Sweat the Small Stuff • Install updates and patches • Proper Password Hygiene • Protect your valuables (Sony) • Listen to alerts (Target) • TRAIN, REINFORCE, TRAIN MORE regarding NO clicking on unknown links
Corporate Hack Victim will be Treated as Offender • Stolen data is not per se proof of recklessness or malfeasance • All systems can be breached • Yours will be • Guard against all parties with an interest in your company’s liability
How to Protect Your Board/Executives • Regular security training • Exposure to budgets and risks • Role for Outside Experts • Document, Document, Document • Train, Train, Train
Take Away • Your regulators care about data security • Your bosses will be held responsible for • successful attacks, and • insufficient responses • You can make a difference for your company/clients
Data Loss Litigation is Becoming More Complicated • Palkon v. Holmes, No. 2:14-CV-01234 (D.N.J. Oct. 20, 2014) Shareholder filed against 10 officers and directors. Board had firm grasp of data situation. (evidence of security discussions in meetings) • In re Heartland Payment Systems Inc. Securities Litigation, No. 09-1043 (D. N.J. Dec. 7, 2009)Plaintiffs alleged securities fraud for claiming in 10-K that company placed emphasis on security. Fact of breach was not, in itself, enough to show careless company. High spending on security in favor of company
Data Loss Litigation is Becoming More Complicated • Genesco v. Visa, U.S. M.D. Tennessee, No. 3:13-00202 $13 Million seized by Visa after Data Breach Claimed “operating expenses” • Similar to Elavon v. Cisero’s, Summit County Utah, Case No. 100500480 • In re: Target Corporation Customer Data Security Breach Litigation, U.S. Dist. Minnesota, No. 14-md-02522. $10 Million in settlement to class of affected individuals Class members don’t need to show damages to collect
Remember all Stakeholders • Customers • Employees • Regulators • Merchant Bank • Vendors • Contracting Requirements
Phishing Works • Phishing will likely always work • Easiest way to introduce malware into your system • Separate Internet from wall safe • Internal Encryption is becoming standard
No Solution to Ransomware • State Bar advisory to law firms • Law enforcement advice – “pay the man” • No one is safe • Did we mention – “Thou shalt not click on Links in Email from unknown senders, EVER.”
No Network Connection is Safe • Target (HVAC Vendor Portal) • Online Restaurant menu • Email is not the only way in
Take AwayWhat is Reasonable? • Appropriate budget for security • Appropriate training • Up to Date Knowledge on tools, standards, risks • Local Risk management structure • Pre-planning for incidents • Build security around obligations, risks and types of data
Internal Walls as Important as External • “They are in your system now” • How does someone walk from the vendor portal t the cash registers? • System level, Application level, Hardware level protection
Cyber Insurance is Vital for Many • Rapidly evolving market • Costs decreasing for better coverage
Preparing for the Worst • Spend the money for smart protection • Follow advice • Be prepared to defend your decisions
Take Away • Hedge your Risks • Document your reasoning and your actions • Third party advice can show why your decision was reasonable
Things Target Did Wrong • System Issues: • Upgraded POS systems without security audit • Did not listen to its own network warnings • Needed more compartmentalized network • Personnel Issues: • No CISO or single name for data security • CTO/CIO had no technical background
Things Target Did Well • Its Website is helpful, informative and complete • Apologize • “Hold Harmless” promise to customers • Help line • It is investing in Cyber Security Education with BBB
Credit Monitoring may not be the Best Service to Offer • What was stolen • ID Theft consulting may be more useful to affected parties • Free credit freeze available without additional purchase
The Role of Vendors • The vendor may be a trap door • The vendor may lose your data • Require: protection, notice, insurance, audit, indemnity, high liability cap • Review: procedures, personnel, technology, training
Take AwayTechnical Lessons • Close Your System • Log what goes out and what comes in • Internal Encryption • Segmented System • Access Management • Keep a wall safe in your bedroom
Take AwayLessons on Surviving • Getting it right is better than quick • All about Competence • Speak up • Work with Law Enforcement/Regulators • Don’t go it alone
Thank You • Ted Claypoole • Partner, Womble Carlyle