Cybersecurity.

Transcription

1 Cybersecurity

2 2 Cybersecurity 2016 Our cybersecurity practice Computers, the internet, mobile devices and electronic transactions all play an important and ever-increasing role within the corporate environment, particularly for businesses with a strong online presence or with high volumes of customer data or other electronically stored information. But the continued growth of cyber technologies and the growing phenomenon of cyber-attacks pose significant business risks. Cyber attackers are often quick to spot the potential vulnerabilities of new technologies and to exploit them to commit civil and criminal offences (and to frustrate detection of those activities). Damage to reputation Business interruption Financial loss Litigation Costs Loss of IP and confidential information Regulatory sanctions Unlike most tangible goods, the value of data has increased as the volume of data that is available and capable of being collected, processed and retained by organisations has exploded. The more data companies have access to, the better they get to know the market and their customers and the more value they can extract from it. In common with other valuable assets, data is therefore subject to heightened risk of misuse, alteration, theft or loss. Cyber-security is about prevention of (and/or preparation for) cyber-attacks, but also about incident response once the risk has realised. It requires an integrated approach across traditional security disciplines proactively to understand, detect and respond to advanced and evolving threats. Our integrated team of diverse practitioners reflects this requirement. Allen & Overy LLP 2016

3 3 Prevention The task of managing legal risk in relation to the threat of cyber-attacks has many different components. Our experience in preventing cyber and information breaches includes advising on: Policies Standards Practices Governance Contracts Insurance including with respect to data security, data retention and destruction; privacy impact assessments and risk assessments. including awareness and understanding of available standards and guidance (eg from NIST, BIS, ENISA, EC3, ISO and others). including education and training programmes, employee monitoring (including ILP and other measures); and penetration testing. including advising on appropriate structures and processes (eg with respect to service provider selection and management). including review and drafting of provisions concerning imposition of security standards (eg specifications, testing and rights to participate, certification, audits, training), governance and control (eg reporting requirements, step in rights, control of announcements and communications with authorities) and liability (eg force majeure, recoverable losses, insurance). including reviewing coverage especially exclusions. incident response Allen & Overy s cross-practice team of cyber-incident response specialists supports clients to ensure they are resilient to cyber-attacks or other data breaches which may impact them or their customers or clients. We act as a partner to make sure you react quickly and effectively. Our experience in reacting to cyber and information breaches includes advising on: Coordination Communications Investigations Civil remedies Reporting Wash up including coordination, managing internal stakeholders and external vendors (eg forensic teams). including advising on approach to, and facilitating, communications (eg with employees, clients, media, and others). including assisting with investigations by law enforcement authorities and regulators (including the ICO), preparation and review of reports. including pro-active response and civil remedies (such as Emergency Injunctions, Search Orders, Freezing Injunctions and Disclosure Orders). including advising on reporting obligations (eg to markets, insurers, counterparties, regulators). including dealing with post-incident actions, including liaison with regulators, defence of civil claims and employee (eg disciplinary) issues.

4 4 Cybersecurity 2016 Overview of threats and trends Top 10 Threat Trends in Emerging Areas Top Threats Current Trends Cyber-Physical Systems and CIP Mobile Computing Cloud Computing Trust Infrastr. Big Data Internet of Things Netw. Virtualisation 1. Malicious code: Worms/Trojans Ý Ý Ý Ý Ý Ý Ý 2. Web-based attacks Ý Ý Ý Ý Ü Ý 3. Web application attacks / Injection attacks Ý Ý Ý Ý Ý Ý Ý 4. Botnets Þ Ý Ý 5. Denial of service Ý Ý Ü Ü Ý Ý 6. Spam Þ Ý 7. Phishing Ý Ý Ý Ý Ý Ý 8. Exploit kits Þ Ý Ý Ý 9. Data breaches Ý Ý Ý Ý 10. Physical damage/theft/loss Ý Ý Ý Ý Ý Ý Ý 11. Insider threat Ü Ý Ý Ý Ý Ý 12. Information leakage Ý Ý Ý Ý Ý Ý Ý Ý 13. Identity theft/fraud Ý Ý Ý Ý Ý Ý Ý Ý 14. Cyber espionage Ý Ý Ý Ý Ý 15. Ransoware/ Rogueware/ Scareware Þ Ý This table is sourced from the European Networking and Information Security Agency publication, ENISA Threat Landscape Overview of current and emerging cyber-threats, December Trends Þ Declining Ü Stable Ý Increasing Allen & Overy LLP 2016

5 5 Our experience A US-based global bank on developing a pro-active strategy for responding to cyber-attacks, including participation in wargames and preparation of court papers for the purpose of pursuing remedies through the courts. A global financial services group on an electronic denial-of-service attack set up by a former customer combined with threats and other offences. A major UK retailer on responding to a data breach perpetrated by an employee, including liaison with the ICO and other law enforcement authorities. A leading provider of financial messaging services on the legal aspects of the security of its global network, including provision of penetration testing by third party vendors. The administrators of a UK retailer in administration on responding to a data breach affecting customer data. A fund manager on an assessment of its approach to cyber-risk management, including a training programme targeting all levels of the organisation. An international bank on the legal risks associated with taking private action against attacks on its online banking platform co-ordinated by botnets. Toyota Motor Europe on the review of data retention and encryption issues relating to the IT security policy code of Toyota Motor Europe. A global bank on assessing its risk of different modes of cyber-attacks from different actors/jurisdictions. An online services provider in relation to third party disclosure applications, requesting customer information for asset-tracing purposes. We successfully defended a number of these Norwich Pharmacal applications on behalf of our client. A media organisation on freedom of information request issues and reputation management aspects following a widely publicised attack on its networks. A global provider of service solutions to the power generation industry, on data privacy issues in connection with the rollout of data loss prevent software. This advice covers 18 jurisdictions. A major international hedge fund in relation to the hacking and theft of highly valuable confidential information and trading strategies by a rogue employee. This was a critical case for the client and involved civil and criminal proceedings in multiple jurisdictions to ensure that the breach was controlled and the employee extradited for criminal trial. An international bank on cyber attacks co-ordinated by botnets (in particular, fraudsters infecting customers computers with trojans which hid on their computers until the customer navigated to the online banking website, and subsequently client information was captured and uploaded by malware to a dropzone ). Several Luxembourg financial sector actors (including banks and electronic payment services providers) on the approach to be taken in responding to a data breach affecting customer data from both, a banking regulatory and data protection law perspective.

6 6 Cybersecurity 2016 Key team members Peter Eijsvoogel Partner Amsterdam Tel Filip Van Elsen Partner Antwerp Tel filip.vanelsen@allenovery.com Victor Ho Partner Beijing Tel victor.ho@allenovery.com Will McAuliffe Partner Hong Kong Tel will.mcauliffe@allenovery.com Lawson Caisley Tel lawson.caisley@allenovery.com Jane Finlayson-Brown Tel jane.finlayson-brown@allenovery.com Philip Mansfield Tel philip.mansfield@allenovery.com Nigel Parker Tel nigel.parker@allenovery.com Mark Ridgway Tel mark.ridgway@allenovery.com Catherine Di Lorenzo Senior Associate Luxembourg Tel catherine.dilorenzo@allenovery.com Ahmed Baladi Partner Paris Tel ahmed.baladi@allenovery.com Benjamin Bai Partner Shanghai Tel benjamin.bai@allenovery.com Krystyna Szczepanowska- Kozlowska Partner Warsaw Tel William White Partner Washington, D.C. Tel william.white@allenovery.com Allen & Overy LLP 2016

7 7

8 GLOBAL PRESENCE Allen & Overy is an international legal practice with approximately 5,000 people, including some 527 partners, working in 44 offices worldwide. Allen & Overy LLP or an affiliated undertaking has an office in each of: Abu Dhabi Amsterdam Bucharest (associated office) Budapest Ho Chi Minh City Hong Kong Moscow Munich Seoul Shanghai Antwerp Casablanca Istanbul New York Singapore Bangkok Barcelona Doha Dubai Jakarta (associated office) Johannesburg Paris Perth Sydney Tokyo Beijing Düsseldorf London Prague Warsaw Belfast Bratislava Frankfurt Hamburg Luxembourg Madrid Riyadh (cooperation office) Rome Washington, D.C. Yangon Brussels Hanoi Milan São Paulo Allen & Overy means Allen & Overy LLP and/or its affiliated undertakings. The term partner is used to refer to a member of Allen & Overy LLP or an employee or consultant with equivalent standing and qualifications or an individual with equivalent status in one of Allen & Overy LLP s affiliated undertakings. Allen & Overy LLP 2016 CS1509_CDD-43196_ADD