MANAGING CYBERSECURITY INVESTIGATIONS

Transcription

1 MANAGING CYBERSECURITY INVESTIGATIONS Tara Swaminatha, Of Counsel, Washington, DC Sam Millar, Partner, London May 12, 2016 If you cannot hear us speaking, please make sure you have called into the teleconference number on your invite information. US participants: Outside the US: The audio portion is available via conference call. It is not broadcast through your computer. *This webinar is offered for informational purposes only, and the content should not be construed as legal advice on any matter. May 12,

2 Speakers Tara Swaminatha Of Counsel, Washington, DC Sam Millar Partner, London May 12,

3 If you have a breach, call counsel yesterday Contact inside and outside counsel early (ideally before a breach) In the wake of a suspected or actual breach, using counsel (properly) allows you to keep things under wraps until you have a chance to get facts straight As you triage internally, keep your internal discussions and documents confidential Better to take a minute and sort out game plan before saying anything *Privilege is not automatic simply by using counsel Fact-specific inquiry Requires adherence to protocol May 12,

4 Incident response (IR) policy important elements Purpose Roles and responsibilities Escalation procedures Types of incidents Incident-specific response procedures Communications plan Contact information (consider alternative methods of communication) May 12,

5 Other important elements of strong IR plan (improves efficacy of investigations) Response plan cheat sheets organized by role Proper training for team members Vendors engaged through counsel Privileged protocol established Pre-existing relationships with law enforcement Tabletop/security drill Continually revise and adapt plans and protocol May 12,

6 Phase 1 Phase 2 Phase 3 Phase 4 Role `` Role Role ` Role Role Role May 12,

7 Security incident triage guidelines May 12,

8 Roles & Responsibilities Matrix May 12,

9 Chain of custody May 12,

10 Data breach incident response quick start guide Assemble an incident response team (IRT) Contact inside and outside counsel to establish a privileged reporting and communication channel Coordinate with legal counsel to bring in cybersecurity experts and forensic examiners Stop additional data loss Secure evidence Preserve computer logs Document the breach Define legal obligations Contact law enforcement (possibly) Conduct interviews of personnel involved Reissue or force security access changes Do not probe computers and affected systems Do not turn off computers and affected systems Do not image or copy data, or connect storage devices/media, to affected systems Do not run antivirus programs or utilities Do not reconnect affected systems May 12,

11 Importance of attorney-client privilege and confidentiality (in USA) Confidential discussions or documents ( privileged communications ) Write and distribute documents within organization with reduced likelihood of disclosure Forensic exam analysis kept confidential Tradeoffs in a risk analysis Purpose of attorney-client privilege May 12,

12 Discuss confidentiality procedures External team engaged through counsel PR/communications experts Forensic cybersecurity experts Internal team IT Legal HR PR/communications Customer relations Risk management Operations (physical breaches) Finance (company financial information lost) May 12,

13 Choosing a forensic partner/vendor Recent launch of two UK government schemes to help companies choose a cybersecurity incident response supplier CESG/CPNI CIR and CREST CSIR. Recognized set of professional qualifications and best practice standards Technical expertise to carry out sophisticated security incident investigations quickly and effectively Expert forensic ability Consider which elements of the investigation will be outsourced and which will be dealt with in-house Consider location of investigation e.g., does the business require a forensic vendor with international reach and ability to deploy teams globally? May 12,

14 Critical protections/lessons learned Strong security culture whistleblowing Businesses should have a robust set of policies and procedures to manage cyber security risks. Having such policies is not enough companies need to ensure that they are implemented correctly by monitoring compliance Regular training on cybersecurity issues linked to these policies is also important Screening: pre-employment and at regular intervals for employees and contractors to help manage "insider threat" Physical/digital security strong link Portable devices ban? encryption? May 12,

15 Critical protections/lessons learned (continued) Clear accountability for cybersecurity risk within the business Contract management to incorporate security controls User privileges Anti-virus software/malware detection Audit: security audits to include insider threat audit Incident management planning May 12,

16 Cybersecurity trends in the EU The FCA has identified cybercrime as a priority in its Business Plan EY's Global Information Security Survey 2015 indicates that the threats people are most concerned about are phishing and malware The Panama Papers leak highlights the risk of cybersecurity/data breaches for law firms Increased coordination and information sharing between the police and the NCA in responding to and managing cybersecurity threats CPNI, GCHQ, BIS and the Cabinet Office have published an updated '10 Steps to Cyber Security' practical steps businesses can take to improve the security of their networks and the information carried on them Increased reporting May 12,

17 EU General Data Protection Regulation Key provisions include: Harmonization: single set of rules, directly applicable in all EU member states Enforcement: power for regulators to levy heavy financial sanctions of up to 4% of the annual worldwide turnover of the organization. This significantly increases the risk associated with privacy non-compliance Offshore processing: application of EU regulatory framework to companies established outside the EU if they target EU citizens Governance: increased responsibility and accountability on organizations to manage how they control and process personal data One-stop-shop: ability to nominate a single national data protection authority as the lead regulator for all compliance issues in the EU, where the organization has multiple points of presence across the EU May 12,

18 EU General Data Protection Regulation (continued) Consent: adoption of a more active consent based model to support lawful processing of personal data Right to be forgotten: a statutory right to be forgotten which will allow individuals the right to require a controller to delete data files relating to them if there are not legitimate grounds for retaining it May 12,

19 Questions? Contact us to learn more Tara Swaminatha Of Counsel, Washington, DC Sam Millar Partner, London +44 (0) May 12,

20 May 12,