Cybersecurity: Lessons from 2014 Prevention, Reaction & Communication

Transcription

1 Cybersecurity: Lessons from 2014 Prevention, Reaction & Communication Rebecca Perry, CIPP US/G Director of Professional Services, Jordan Lawrence Shiraz Saeed Cyber Liability Specialist, AIG Shamoil T. Shipchandler Partner, Bracewell & Giuliani LLP Setting expectations Are you susceptible to a data breach? 1

2 October 7, 2014 Setting expectations Victim Perpetrator 2

3 It s only a matter of time Number of reported breaches (2005 present) YTD It s only a matter of time Legend: Healthcare Retail Financial Institution Higher Education Government Entity Defense Telecom Other Multiple University of California Irvine Baylor Regional Med Ctr ebay (145M) Placemark Investments Willis Power Equipment Direct Auto Nation Miami Dade County Montana Health Dept PF Chang s AT&T Mobility Butler University (163K) Houstonian Hotel Goldman Sachs City of Encinitas Boeing/ Lockheed Martin CVS Caremark Northern Trust Russian Password hacking (2B) REI Albertsons Grocery Stores UCSB Community Health Systems (4.5M) UPS Stores May June July Aug 3

4 It s only a matter of time 14% 17% Insider theft Hacking 42% 27% Accidental exposure or negligence Subcontractor Breach Types 2007 through 2013 (4215 breaches) Subcontractors Responsible for 14.3 percent of breaches in 2013 Examples: Paytime, Inc., a payroll service for corporations (subcontracted by Hanover Foods) Safety First, a fleet safety company (subcontracted by Lowe s) 4

5 Examples of common breaches Laptop thefts from two healthcare organizations led to an investigation by the Office for Civil Rights, which discovered that devices containing PHI were not encrypted and that there were numerous HIPAA violations. Both organizations paid a monetary settlement and implemented corrective action plans that included providing status updates to HHS. Total paid = $2,000,000 Examples of common breaches A cyberterrorist group hacked into company s network and accessed over 100 million customer accounts including customer usernames and passwords, credit card numbers and expiration dates. 65 suits were filed in the United States. There were also federal, state, and international investigations. Total paid = expected to be over $150,000,000 5

6 Examples of common breaches Over 5,000 medical records were left unattended on the driveway of a physician s home. The Office for Civil Rights investigated and the hospital was required to adopt a corrective action plan to address deficiencies in its HIPAA compliance program to include employee training. Total paid = $800,000 It s only a matter of time 6

7 It s only a matter of time October 28, 2014 Emerging risks Financial institutions In an increasingly interconnected banking environment, internet cyber threats have rapidly become the most urgent category of technological challenges facing our banks. The large number and sophistication of cyber attacks directed at financial institutions in recent years requires a shift in thinking. Cybersecurity is no longerjustanissuefortheitdepartment. Instead, it needs to be engaged at the very highest levels of corporate management.... For this reason, we encourage banks to practice responding to cyber threats as part of their regular disaster planning and business continuity exercises. Martin J. Gruenberg, FDIC Chairman, September 22,

8 October 15, 2014 Emerging risks Energy and utility companies Marathon Oil, ExxonMobil, ConocoPhilips, Telvent, Enervest, BP, Shell, and others 8

9 Emerging risks February 11, 2011 Emerging risks June 27,

10 Emerging risks October 16, 2014 Cost of a breach (by insurance payment) AVERAGES 2011 Findings (117 claims studied) 2012 Findings (137 claims studied) 2013 Findings (140 claims studied) # of Records Exposed 1.7 Million 1.4 Million 2.3 Million Cost per Claim $2,400,000 $3,700,000 $3,500,000 Legal Defense $500,000 $600,000 $574,984 Legal Settlement $1,000,000 $2,100,000 $258,099 Crisis Services: $800,000 $1,000,000 $737,473 Forensics $170,000 $341,000 $104,740 Notification $201,000 $180,000 $126,703 Call Center $15,000 $50,000 (Not broken out) Credit Monitoring $253,000 $345,000 $55,865 Legal Counsel $242,000 $66,000 $29,225 10

11 Re setting expectations Average cost to respond to a data breach? $5.4 million ($194 per record) Target Corp. s cost so far: $236 million and more than 100 lawsuits Analyst: Cost will exceed $1 billion Part I: Cybersecurity and data breach law 11

12 No foreign nation, no hacker, should be able to shut down our networks, steal our trade secrets, or invade the privacy of American families, especially our kids. We are making sure our government integrates intelligence to combat cyber threats, just as we have done to combat terrorism. And tonight, I urge this Congress to finally pass the legislation we need to better meet the evolving threat of cyberattacks, combat identity theft and protect our children s information. If we don t act, we ll leave our nation and our economy vulnerable. If we do, we can continue to protect the technologies that have unleashed untold opportunities for people around the globe. State of the Union Address, January 20, 2015 White House proposals Personal Data Notification & Protection Act to set a national breach notice standard with a 30 day deadline for informing affected individuals Identifying and Preventing Identity Theft initiative to make credit scores more easily available to consumers Student Digital Privacy Act to restrict the use of data collected from students to educational purposes Private Sector Commitments to Help Enhance Student Privacy from 75 companies pledging to protect student data Department of Education Tools to empower educators and protect students through model terms of service Voluntary Code of Conduct for Smart Grid Customer Data Privacy to protect consumer information collected through the electricity smart grid Consumer Privacy Bill of Rights which revises the administration's 2012 proposal Federal Payments Security effort to help drive the market forward Measures to Prevent Identity Theft through Federal Trade Commission one stop shop consumer assistance and enhanced federal investigation efforts 12

13 Cybersecurity and data breach law The FTC, SEC, FCC, and NY Other federal statutes States The FTC The FTC conducts its data security investigations to determine whether a company s data security measures are reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its data operations, and the cost of available tools to improve security and reduce vulnerabilities. The Commission s 50 settlements with businesses that it charged with failing to provide reasonable protections for consumers personal information have halted harmful data security practices; required companies to accord strong protections for consumer data; and raised awareness about the risks to data, the need for reasonable and appropriate security, and the types of security failures that raise concerns. Edith Ramirez, FTC Chairwoman, Congressional testimony (April 2, 2014) 13

14 The FTC Settlements with, among others, Fandango, Credit Karma, CVS Caremark, Settlement One Credit Corp., Value Click ($2.9M), Life Is Good, Reed Elsevier Inc., Dave & Busters, Inc., and TJX, all for privacy and data security breaches. The FTC Example: What did TJX do? Failed to implement measures to limit wireless access to its stores, allowing a hacker to connect wirelessly to its networks without authorization Did not require administrators to use strong passwords Failed to use a firewall or otherwise limit access to the internet on networks processing cardholder data Lacked procedures to detect and prevent unauthorized access, such as by updating antivirus software and responding on security warnings and intrusion alerts 14

15 The SEC Given the significant cyber attacks that are occurring with disturbing frequency, and the mounting evidence that companies of all shapes and sizes are increasingly under a constant threat of potentially disastrous cyber attacks, ensuring the adequacy of a company s cybersecurity measures needs to be a critical part of a board of director s risk oversight responsibilities. In addition to the threat of significant business disruptions, substantial response costs, negative publicity, and lasting reputational harm, there is also the threat of litigation and potential liability for failing to implement adequate steps to protect the company from cyber threats. Perhaps unsurprisingly, there has recently been a series of derivative lawsuits brought against companies and their officers and directors relating to data breaches resulting from cyber attacks. Thus, boards that choose to ignore, or minimize, the importance of cybersecurity oversight responsibility, do so at their own peril. Luis Aguilar, SEC Commissioner, speech given at NYSE on June 10, 2014 The SEC Guidance (not regulation) released on October Calls for companies to analyze their cyber vulnerabilities just as they would any other business risk. Disclosures may include past incidents, current risks, and potential impact 15

16 The SEC Risk factor disclosure Aspects of business giving rise to cybersecurity risks Cybersecurity risks related to outsourcing Description of actual cyber incidents, if material Risks related to non detection of cyber incidents Description of related insurance coverage Business description Material impacts to business from cyber incident Management s analysis of financial condition Known cyber incidents and material losses Legal proceedings and financial statements The SEC An SEC comment: We note that your network security insurance coverage is subject to a $10 million deductible. Please tell us whether this coverage has any other significant limitations. In addition, please describe for us the certain other coverage that may reduce your exposure to Data Breach losses. (Target Form 10 K, March 2014) 16

17 The SEC Another SEC comment: Please expand your risk factor disclosure to describe the cybersecurity risks that you face or tell us why you believe such disclosure is unnecessary. If you have experienced any cyber attacks in the past, please state that fact in any additional risk factor disclosure in order to provide the proper context. Please refer to the Division of Corporation Finance s Disclosure Guidance Topic No. 2 at for additional information. (Hilton Worldwide Holdings, Inc. S 1, October 2013) The SEC One more SEC comment: We note your disclosure that an unauthorized party was able to gain access to your computer network in a prior fiscal year. So that an investor is better able to understand the materiality of this cybersecurity incident, please revise your disclosure to identify when the cyber incident occurred and describe any material costs or consequences to you as a result of the incident. Please also further describe your cyber security insurance policy, including any material limits on coverage. (Alion Science and Technology Corp. S 1 filing, March 2014) 17

18 The SEC Possible disclosures Form 8 K Forms 10 Q and 10 K Earnings releases Proxy statements The FCC After levying a $10 million fine against two telecom companies for storing personally identifiable customer data online without firewalls, encryption, or password protection: This is unacceptable. This is the first data security enforcement action [by the FCC], but it will not be the last. Travis LeBlanc, FCC s top enforcement official (October 28, 2014) 18

19 New York Proposed cybersecurity regime for banks Chief information security officers, cybersecurity programs, quarterly penetration tests, oh my. Cybersecurity is one of the most important issues the Department of Financial Services will face as a regulator in the months and years ahead across the entire financial system. And you will be hearing a lot more from our agency about this in the near future. Benjamin Lawsky, State Regulator, NY Dep t of Financial Services (October 20, 2014) Other federal statutes HITECH (medical information) HIPAA (medical information) GLBA (financial institutions) FTCA (federal trade commission act) FERRPA (educational records) FCRA (consumer reporting agencies) COPPA (children s information) 19

20 States There are 47 different state laws with different requirements, different definitions of whether notifications need to occur, and different timings for notifications. Some require harm to occur to trigger notification Some require notice to their attorneys general or agencies (some are before notice is sent to consumers, some are after) Some have a specific time frame Some permit a private right of action Some have different provisions for third parties that hold data. Ouch Chase is trying to diminish the extent of the breach, but what s clear is that people can no longer assume their information is safe. The fact that Chase only revealed the still limited details of the breach in a regulatory filing makes the situation worse. Millions of Americans trusted Chase to secure their money and personal information, but by failing to be forthcoming, they have lost their confidence in Chase. Lisa Madigan, Illinois Attorney General, confirming an Illinois investigation (October 3, 2014) [Chase]said in the statement that it isn t legally required to disclose that contact information alone had been breached. It said it wanted to do the right thing, while pursuing an internal probe to obtain the most complete information. The Washington Post (October 4, 2014) 20

21 Part II: What to do right now Get your Board on err board. Ensure the company s focus on cybersecurity Provide oversight of the risk management process Identify and empower your experts Include information security as a regular Board agenda item 21

22 Create an information security plan Why? Minimize employee related breaches Reduce overall exposure Reductions for CISO, information security program, strong security Legally important Increase customer trust and company reputation Don t be a or a Create an information security plan In November 2005, Jason Spaltro, executive director of information at Sony Pictures Entertainment [said], There are decisions that have to be made. We re trying to remain profitable for our shareholders, and we literally could go broke trying to cover for everything. So, you make riskbased decisions. Legislative requirements are mandatory, but going the extra step is a business decision. Your Guide to Good Enough Compliance CIO Magazine April 6,

23 Create an information security plan Designate a lead Conduct a systems assessment Implement a security program Policies and training Thanks, Sony! Create and implement a crisis response plan Create your crisis response team Think dress rehearsal versus the show Useful for other situations, too Implement a security program Locate your data. Delete what you don t need. Improve policies & training. 23

24 Implement a security program: What keeps CIOs up? Not knowing where sensitive or confidential data is Temporary worker or contractor mistakes Third party or outsourcer management of data (including cloud) Migration to new mobile platforms 64% 50% 57% 64% 50% 57% 34% 39% 43% 56% 46% 52% North America Europe ROW N=1587, Source: Ponemon Research, May 2014 Implement a security program: Understand business practices RETENTION WHAT SENSITIVITY RECORDS INVENTORY WHERE BUSINESS BUSINESS PROCESSES PROCESSESS 24

25 Implement a security program: What do you have? Accident/Incident Records Advertising Records Benefit Records Budget Records Contracts & Agreements Coupon Records Credit Approvals Customer Information Customer Orders Employee Medical Files Gift Card Functions Payment Records Sales Receipts Implement a security program: Where is it?

26 Implement a security program: Requirements BUSINESS NEEDS SENSITIVITY Corporate Sensitive PII Customer Data Intellectual Property Bio Metric Patient Health Info. Personal Financial Sensitive EU REQUIREMENTS DOL FSMA GLB HIPAA OSHA PCI SEC State Privacy Laws Consider insurance coverage October 12,

27 Cyber vs. non cyber policies Non Cyber Property Covers first party property damage or loss of income due to non cyber triggers E&O General Liability Covers third party bodily injury/property damage due to noncyber triggers Covers financial injury to third parties suffered in the provision of professional services Crime Covers theft of money or securities, not data D&O Covers the personal assets of directors and officers and balance sheet protection for the company as a result of alleged mismanagement Cyber Covers financial injury (and next generation policies to cover bodily injury/property damage) due to cyber triggers. Addresses both first party loss and third party liability. Consider insurance coverage First Party Coverage (occurrence) Event Management / Notification Costs Cyber Extortion Business/Network Interruption Crisis Fund Third Party Liability Coverage (claims made) Tech E&O Media Content Liability Internet Professional Services Security & Privacy Liability Regulatory Proceedings Costs 27

28 Create a crisis response team Identify the key constituents Identify the decision maker Part III: I ve been breached (and I can t get up) 28

29 Crisis response Feel free to take all the time you need!... yeah. Just kidding. Clock starts ticking from DOB (discovery of breach**) Crisis response What did Part II give us? Faster reaction time More thorough reaction Ability to minimize risk and damage Without Part II... 29

30 Crisis response Coordinate first response team (IT, HR, legal, PR, and business) Investigate, isolate, contain, and secure Notify (federal, state, int l, individual, media, insurance, and other) Consider referral to law enforcement and/or civil remedy Re evaluate Crisis response Coordinate first response team (IT, HR, legal, PR, and business) Investigate, isolate, contain, and secure Notify (federal, state, int l, individual, media, insurance, and other) Consider referral to law enforcement and/or civil remedy Re evaluate 30

31 Crisis response Coordinate first response team (IT, HR, legal, PR, and business) Investigate, isolate, contain, and secure Retain forensic investigator Interview witnesses Preserve documents and systems Identify what was compromised Document everything Notify (federal, state, int l, individual, media, and other) Consider referral to law enforcement and/or civil remedy Re evaluate Crisis response Coordinate first response team (IT, HR, legal, PR, and business) Investigate, isolate, contain, and secure Notify Federal, state, international Individuals Insurers and credit card companies (PFI!) Media Employees Consider referral to law enforcement and/or civil remedy Re evaluate 31

32 Crisis response Coordinate first response team (IT, HR, legal, PR, and business) Investigate, isolate, contain, and secure Notify Consider referral to law enforcement and/or civil remedy E.g., 18 U.S.C. 1030; Texas Penal Code, Title 7, Chapter 33 Re evaluate Crisis response Coordinate first response team (IT, HR, legal, PR, and business) Investigate, isolate, contain, and secure Notify Consider referral to law enforcement and/or civil remedy Re evaluate 32

33 Contact Information Rebecca Perry, CIPP US/G Director of Professional Services, Jordan Lawrence Shiraz Saeed Cyber Liability Specialist, AIG Shamoil T. Shipchandler Partner, Bracewell & Giuliani LLP 33

34 INTERNAL DATA BREACH RESPONSE TEAM IN-HOUSE COUNSEL MEDIA AND PR CONTACT HUMAN RESOURCES DESIGNATED INCIDENT LEAD BUSINESS SPECIFIC CONTACT COMPLIANCE IN-HOUSE IT

35 STATE NOTIFICATION LAWS Alaska: Alaska Stat , et seq. Arizona: Ariz. Rev. Stat Arkansas: Ark. Code , et seq. California: Cal. Civ. Code , , et seq. Colorado: Colo. Rev. Stat Connecticut: Conn. Gen Stat. 36a-701b Delaware: Del. Code tit. 6, 12B-101, et seq. Florida: Fla. Stat Georgia: Ga. Code , -911, -912; Hawaii: Haw. Rev. Stat. 487N-1, et seq. Idaho: Idaho Stat to -107 Illinois: 815 ILCS 530/1 to 530/25 Indiana: Ind. Code , et seq., , et seq. Iowa: Iowa Code 715C.1, 715C.2 Kansas: Kan. Stat. 50-7a01, et seq. Kentucky: 2014 H.B. 5, H.B. 232 Louisiana: La. Rev. Stat. 51:3071, et seq. Maine: Me. Rev. Stat. tit , et seq. Maryland: Md. Code Com. Law et seq., Md. State Govt. Code to Massachusetts: Mass. Gen. Laws 93H-1, et seq. Michigan: Mich. Comp. Laws , Minnesota: Minn. Stat. 325E.61, 325E.64 Mississippi: Miss. Code Missouri: Mo. Rev. Stat Montana: Mont. Code , , et seq. Nebraska: Neb. Rev. Stat , -802, -803, -804, -805, -806, -807 Nevada: Nev. Rev. Stat. 603A.010, et seq., New Hampshire: N.H. Rev. Stat. 359-C:19, -C:20, -C:21 New Jersey: N.J. Stat. 56:8-163 New York: N.Y. Gen. Bus. Law 899-aa, N.Y. State Tech. Law 208 North Carolina: N.C. Gen. Stat 75-61, North Dakota: N.D. Cent. Code , et seq. Ohio: Ohio Rev. Code , , , Oklahoma: Okla. Stat , to -166 Oregon: Oregon Rev. Stat. 646A.600, et seq. Pennsylvania: 73 Pa. Stat. 2301, et seq. Rhode Island: R.I. Gen. Laws , et seq. South Carolina: S.C. Code , 2013 H.B Tennessee: Tenn. Code Texas: Tex. Bus. & Com. Code , , Tex. Ed. Code (b)(5) Utah: Utah Code , et seq. Vermont: Vt. Stat. tit , 2435 Virginia: Va. Code , :05 Washington: Wash. Rev. Code , West Virginia: W.V. Code 46A-2A-101, et seq. Wisconsin: Wis. Stat Wyoming: Wyo. Stat , et seq. District of Columbia: D.C. Code , et seq. Guam: 9 GCA 48-10, et seq. Puerto Rico: 10 Laws of Puerto Rico 4051, et seq. Virgin Islands: V.I. Code tit. 14, 2208 Alabama, New Mexico, South Dakota: No law as of September 24, 2014