CYBERSECURITY PREPAREDNESS: IT’S A DANGEROUS WORLD OUT THERE

Virtually all of us are dependent on the internet and internet-connected devices. People are plugged in, online and in constant communication through wired and wireless networks coupled to the internet.

By virtue of this dependency, we entrust internet-enabled applications, programs and connected devices with our most private communications and personal and financial details. Yet we read, almost on a daily basis, of hacks and compromises on a gargantuan scale, of the very systems we entrust with our private business and personal data.

The disclosures of Edward Snowden and others have increased public awareness about the need to be mindful of cybersecurity and cyberthreats in our ITenabled world of smartphones, internet and cloud-based services.

Businesses are faced with many of the same cybersecurity risks as individuals, but businesses are made to bear greater legal and financial responsibility in the event of a compromise.

Today, cybersecurity, including data protection, is a board-level critical business risk area. A major compromise of a corporate IT system may raise significant business continuity and business reputation risks, in addition to possible lawsuits by customers and actions by the government and regulators, such as investigations, penalties and fines. Companies now find their risk management committees devoting more and more time to cybersecurity issues.

The cyber risk landscape is highly dynamic, making ongoing proactive prevention necessary but also difficult. Moreover, it is very difficult for a business to keep a breach of its IT system private, irrespective of legal obligations or attempts to control public disclosure that a system has been hacked.

Worse still, the detection of a compromise or hack often happens many months or even years after the initial compromise. Clearly, dealing with cyber risks requires diligent attention. But given the dynamic nature of such risks, what areas should a business focus on when establishing a cybersecurity preparedness programme?

Cybersecurity preparedness necessarily involves much more than board supervision and risk management committee oversight. It also requires a review of what cybersecurity processes, structures and mitigation measures government regulators expect in each of the jurisdictions where a company does business, and/or where the relevant data resides. Going beyond legal issues, the review must also take account of practicalities, including costs, perceived risk and objective reasonableness.

One key component of such a review is an assessment of vendor risk management, which has become even more important given the broad adoption of cloud services. The review should include consideration of vendor policies, procedures and contracts to ensure the sufficiency of security obligations and legal remedies to protect the company against a compromise by, or through, any of its vendors.

Cybersecurity risk assessment has also become a core component of due diligence, particularly in mergers and acquisitions. The due diligence process first needs to consider whether there are any ongoing regulatory investigations or enforcement actions relating to breaches or other compromises. It must also address whether the target company has critical data assets (personal data of customers and/or credit card data for example) and whether the target has experienced data breaches. If so, there must be an explanation of the damage and how it was mitigated.

The review should also take account of the risk of future breaches, and more generally, whether the target’s cybersecurity programme is adequate in relation to both industry benchmarks as well as legal requirements.

For example, a cybersecurity programme should include an incident response plan that is tested through tabletop exercises with senior management, technology representatives and legal counsel. It also should be kept up to date, taking account of new threats that are identified.

The incident response plan should be developed using multiple scenarios to realistically simulate potential incidents including advanced persistent threat (APT) intrusions, data theft, insider attacks and denial of service attacks. The plan must also take account of the type of business. For example, retailers should consider point-of-sale attack scenarios.

While important, detection is merely the first step. Businesses should also have policies and procedures for a proper response, providing for appropriate escalation within the organisation’s management structure, mitigation of risk and preservation of forensic evidence once a compromise is discovered. It should also protect attorney-client privilege materials and the company’s legal rights, in case lawsuits or government or regulatory investigations subsequently arise.

Companies’ dependence on IT systems and cloud-based services will only increase, and cybersecurity will continue to become ever more important. Companies must prepare for attacks from the inside as well as from outside third parties (including both criminally motivated individuals as well as statesponsored attacks).

Company executives, hand in hand with legal counsel and the technology team, must work together to continually evaluate preparedness and develop and implement defence and mitigation strategies to prevent and limit damage due to cyberattacks.