This presentation was delivered by Shawn E. Tuma, Cybersecurity and Data Privacy Attorney, to ISACA CSXNA 2016 in Las Vegas on October 18, 2016. https://www.isaca.org/cyber-conference/index.html This presentation was significantly updated from past presentations and included a discussion of the groundbreaking New York Department of Financial Services (NYDFS) Cybersecurity Requirements for Financial Services Companies. The main points of this presentation are: (1) Cybersecurity events create a crisis situation and should be treated as such; (2) Cybersecurity incidents are as much legal events as they are IT or Business / Public Relations events; (3) Companies must have a cybersecurity breach response plan in place and tested, in advance; (4) While consumer class action data breach litigation is a significant threat to companies and their leadership, it is not as great of a threat as regulatory enforcement by agencies such as the FTC and SEC, or the shareholder derivative claims for officer and director liability; and (5) The odds are that all company will be breached, but preparation and diligence can help minimize the likelihood that such a breach from being a catastrophic event. This presentation addresses the role of attorneys as the first responders in leading their clients through cybersecurity and data loss crisis events. The discussion begins by looking at the risk business have of being the victim of a cybersecurity or data loss incident and examining the nature of such incidents and the crisis environment they create. Then, because of this crisis environment, the need for leadership in helping keep the parties calm, rational, and making deliberate, calculated decisions. The discussion then explains why cybersecurity events are legal events and legal counsel is the natural leader that should fulfill this role and how they can do so. It will then discuss the process legal counsel will take, including assembling the key players in such an event, both internally and externally. It discusses the obligations for responding to such an event, the steps that must be taken, those that must be considered, and certain factors that go into the decision-making process. It briefly addresses the costs of such an incident and the liability issues that can arise from such an incident and failing to properly respond to the incident. This section includes a discussion of the cybersecurity lawsuit landscape, cybersecurity regulatory landscape, and the issue of cybersecurity-related officer and director liability stemming from shareholder derivative lawsuits based on cybersecurity incidents. It concludes with a discussion of the steps that companies can take to prepare for and be in a better position to respond to and mitigate the negative repercussions of such an incident.

1. Shawn E. Tuma, Cybersecurity Attorney
Partner, Scheef & Stone, LLP
Get the FUD out of
Cybersecurity!

2. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Join the conversation!
@shawnetuma
#CSXNA

3. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
• The Y2K Legal Expert
• Path: Y2K > computer fraud >
data breach
• 2011
• “Year of Data Breach”
• “Who’s Gonna Get It?”
Do you remember Y2K?

4. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
2014: The real Year of the Data Breach
Cybersecurity:
a legal issue?

5. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Consider these 2 statements:
• “There are only two types of
companies: those that have been
hacked, and those that will be.”
• “It’s not a matter of if, but when your
company is hacked.”
Selling FUD is so 2014!

6. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
• FUD = fear × uncertainty × doubt
• Why?
• It gets media attention
• It is cool, exotic, sexy
• It justifies the most sophisticated (i.e.,
expensive) tools
Why so much FUD?

7. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
• Cybersecurity & data breaches are an
epidemic
• Impacted by data breach?
The threat is real

8. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Awareness is real, also
What concerns keep Chief
Legal Officers awake at
night?
#2 = Data Breaches
82% consider as somewhat,
very, or extremely important

9. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
• “These three thieves, fear,
uncertainty, and doubt, will rob you
of your future.” –E.R. Haas
• Complacency was the problem
• Hopelessness is now the problem
• Eat a live frog –Mark Twain
The “too much FUD” problem

10. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Easily preventable
• 90% in 2014
• 91% in 2015
The Turning Point
• 63% confirmed breaches from weak, default, or
stolen passwords
• Data is lost over 100x more than stolen
• Phishing used most to install malware

11. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Where Would You Start?
Easily Preventable Sophisticated Attacks
Threats

12. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
“We must free ourselves
of the hope that the sea
will ever rest. We must
learn to sail in high
winds.”
-Aristotle Onassis
Leadership

13. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
• Leaders find solutions.
• Leaders bring calm and rational
decision making to crisis situations.
• Yes, this is new, unchartered territory.
• But, we are pioneers made to thrive in
the unknown – it’s what we do.
• Focus on what we know.
Leadership

14. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
• “All warfare is based on deception.”
• “Water shapes its course according
to the nature of the ground over
which it flows; the soldier works out
his victory in relation to the foe whom
he is facing.”
• “In all fighting the direct method may
be used for joining battle, but indirect
methods will be needed to secure
victory.”
• “Attack him where he is unprepared;
appear where you are not expected.”
Sun Tzu on Hacking

15. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
• “The general who wins the battle
makes many calculations in his temple
before the battle is fought. The general
who loses makes but few calculations
beforehand.”
• “Strategy without tactics is the slowest
route to victory. Tactics without strategy
is the noise before defeat.”
• “The quality of decision is like the well-
timed swoop of a falcon which enables
it to strike and destroy its victim.”
Sun Tzu on Security

16. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Preparation
“You don’t drown
by falling in the
water; You drown
by staying there.”

17. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
“Some people try to find
things in this game that
don’t exist but football is
only two things – blocking
and tackling.”
-Vince Lombardi
Start with the Basics

18. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
• Attacks will be different than past.
• Attacks will usually be indirect, not
direct.
• Attackers will use deception.
• Attackers will focus on the area least
protected – the human element.
• Preparation allows adaptation.
What We Know

19. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
• Culture of security
• Policies and procedures
• Systems and controls
• Education and training
• Goal: teach people to think,
recognize, and resist
Prepare Workforce

20. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
“Security and IT protect companies’ data;
Legal protects companies from their data.”

21. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Takeaway: Standard is reasonableness.
• In re Target Data Security Breach Litigation (Financial
Institutions) (Dec. 2, 2014)
• Companies have a duty to be reasonably informed and take
reasonable measures to protect against cybersecurity risks.
• It’s the diligence, not the breach, that counts.
• The court found duties to
• Reasonably protect others’ data
• Not disable security devices (i.e., if have it, use it)
• Respond when alerted of an attack
Legal Foundations

22. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Takeaway: Must have basic IT security.
• F.T.C. v. Wyndham Worldwide Corp., 799 F.3d 236 (3rd Cir. Aug.
24, 2015).
• The FTC has authority to regulate cybersecurity under the
unfairness prong of § 45(a) of the FTC Act.
• Companies have fair notice that their specific cybersecurity
practices could fall short of that provision.
• 3 breaches / 619,000 records / $10.6 million in fraud
• Rudimentary practices v. 2007 guidebook
• Website Privacy Policy misrepresentations
Legal Foundations

23. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Takeaway: Must have internal network controls.
• F.T.C. v. LabMD (July 2016 FTC Commission Order)
• LabMD had 1 employee using LimeWire, Tiversa obtained file
with PHI information and provided to the FTC.
• “LabMD’s data security practices constitute an unfair act or
practice within the meaning of Section 5 of the FTC Act. We
enter an order requiring that LabMD notify affected consumers,
establish a comprehensive information security program
reasonably designed to protect the security and confidentiality of
the personal consumer information in its possession, and obtain
independent assessments regarding its implementation of the
program.”
Legal Foundations

24. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Takeaway: Must have written policies & procedures.
• S.E.C. v. R.T. Jones Capital Equities Management, Consent
Order (Sept. 22, 2015).
• “R.T. Jones failed to adopt written policies and procedures
reasonably designed to safeguard customer information.”
• R.T. Jones violated the Securities Act’s “Safeguards Rule”
• 100,000 records vulnerable; no reports of actual harm
• $75,000 penalty
• Cease and desist having any future violations
Legal Foundations

25. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Takeaway: Must have written incident
response plan.
• S.E.C. v. R.T. Jones Capital Equities Management,
Consent Order (Sept. 22, 2015).
• Firms “need to anticipate potential cybersecurity events
and have clear procedures in place rather than waiting to
react once a breach occurs.”
Legal Foundations

26. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Response Plan Points
• Goal is to execute
• This is check list, not
an IRP
• How detailed?
• Tabletop exercises
Legal Foundations

27. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
How quick to respond?
• 45 days (most states)
• 30 days (some states)
• 3 days (fed contracts)
• 2 days (business expectation)
• Immediately (contracts)
Legal Foundations

28. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Takeaway: Must evaluate third-parties’ security.
• In re GMR Transcription Svcs., Inc., Consent Order (Aug. 14,
2014).
• FTC’s Order requires business to follow 3 steps when working
with third-party service providers:
• Investigate before hiring data service providers
• Obligate data service providers to adhere to the appropriate
level of data security protections
• Verify that the data service providers are complying with
obligations (contracts)
Legal Foundations

29. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Takeaway: Know your contractual obligations.
• Addendum to business contracts
• Common names: Data Security & Privacy Agreement; Data
Privacy; Cybersecurity; Privacy; Information Security
• Common features:
• Defines subject “Data” being protected in categories
• Describes acceptable and prohibited uses for Data
• Describes standards for protecting Data
• Describes obligations and responsibility for breach of Data
• Requires binding third-parties to similar provisions
Legal Foundations

30. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
The Game Changer?
New York Department of Financial Services
Cybersecurity Requirements for Financial Services
Companies + [fill in]
• All NY “financial institutions”
• Establish Cybersecurity Program (w/ specifics)
• Adopt Cybersecurity Policies
• Designate qualified CISO to be responsible
• Written Incident Response Plan
• Third-Party Providers – examine, obligate, audit
• Board or Senior Officer Certify Compliance

31. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Cybersecurity Risk Management

32. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
Instead of FUD
“You don’t drown
by falling in the
water; You drown
by staying there.”
Teach people how
to swim – better
yet, how to surf!

33. Copyright © 2016 Information Systems Audit and Control Association, Inc. All rights reserved.
• Board of Directors & GeneralCounsel, Cyber Future Foundation
• Board of Directors, NorthTexasCyber Forensics Lab
• Cybersecurity & Data Privacy LawTrailblazers, National Law Journal (2016)
• SuperLawyersTop 100 Lawyers in Dallas (2016)
• SuperLawyers 2015-16 (IP Litigation)
• Best Lawyers in Dallas 2014-16, D Magazine (Digital Information Law)
• Council, Computer &Technology Section, State Bar ofTexas
• Privacy and Data Security Committee of the State Bar ofTexas
• College of the State Bar ofTexas
• Board of Directors,Collin County Bench Bar Foundation
• Past Chair, Civil Litigation & Appellate Section,Collin County Bar Association
• Information SecurityCommittee of the Section on Science &Technology Committee of the
American Bar Association
• NorthTexasCrime Commission, CybercrimeCommittee
• Infragard (FBI)
• InternationalAssociation of Privacy Professionals (IAPP)
• Board of AdvisorsOffice of CISO, Optiv Security
• Editor, Business Cybersecurity Business Law Blog
Shawn Tuma
Cybersecurity Partner
Scheef & Stone, L.L.P.
214.472.2135
shawn.tuma@solidcounsel.com
@shawnetuma
blog: www.shawnetuma.com
web: www.solidcounsel.com