Lawyers May Be Limiting Threat Info Sharing – Gcn.com

Lawyers may be limiting threat info sharing – GCN.com

GettyImages/ skynesher
Sign up for our newsletter.
Stay Connected
By Stephanie Kanowitz
Although effective in protecting confidentiality, lawyers who handle cybersecurity cases “frequently undermine the long-term cybersecurity of their clients and society more broadly,” a new study finds.
Published July 28, “How Privilege Undermines Cybersecurity” finds that as the number of cyberattacks grows, so too do questions about common legal tools such as attorney-client privilege and work product immunity . That’s because although both protect confidentiality by “limiting and shaping the documentation that is produced by breached firms’ personnel and third-party consultants in the wake of a cyberattack, attorneys can limit the availability of potentially damaging information to plaintiffs’ attorneys, regulators, or media,” the report states.
The lack of information impairs “the ability of breached firms to learn from cybersecurity incidents and implement long-term remediation measures,” according to the document. Additionally, cybersecurity insurers – whose fees are often already prohibitive for many public-sector agencies – can’t get a full picture of how well cybersecurity measures work, and regulators are also impeded in their ability to investigate incidents.
For instance, the study points to cases arising out of the theft of personal data from 100 million Capital One customers in 2019. After a federal district court ruled in a class-action lawsuit that the company must share its forensic incident report with plaintiffs, lawyers have doubled down on limiting written reports or recommendations from third-party forensic firms after breaches – a move that the report states “dramatically [impairs] the ability of both breached firms and third parties to prevent future cyberattacks.”
What’s more, some stakeholders said that the practice could disincentivize firms from using robust cybersecurity efforts, although they generally believe “the benefits to firms of proactively limiting the risk of cyber intrusions or the consequences of such events when they occurred dramatically outweighed the potential costs that documents produced during this process could be used against firms,” the report states.
To prevent these problems, the research suggests “disentangling the incident response process from the production of information that can hold firms accountable for failing to take appropriate and required precautions.”
One way to do this would be to have courts determine whether the purpose of a breach investigation entitles victims for protection under attorney-client privilege or work product immunity by looking at factors such as who hired and pays the forensic firm (the business or the lawyers) and when (before or after the breach).
More specifically, the report proposes a nonwaivable cyber-incident response privilege that “would not attach to any pre-incident cybersecurity measures” and “only shield from discovery firms’ incident response efforts.” Additionally, it would also cover internal communications within a breached firm. “A major cybersecurity goal should not only be to encourage full and frank communication between firm personnel and outside parties like lawyers or forensic firms, but also to encourage full and frank internal communication within breached firms,” the report states.
It also recommends reforming federal information-sharing requirements. The Cybersecurity Information Sharing Act of 2015 states that organizations that share cyber threat indicators and defensive measures for a cybersecurity purpose get some protections from liability, while the Cyber Incident Reporting for Critical Infrastructure Act of 2022 mandates reporting to the Homeland Security Department cyber incidents involving critical infrastructure. Neither law goes far enough or is detailed enough, however, according to the report. What’s needed is an extension of the requirements to include a broader range of firms and incidents.
“We suggest expanding the confidentiality protections that apply to incident response so as to enable swifter responses to incidents, more robust documentation of breaches, and broad sharing of this information with interested third parties,” the report states. “Pairing these enhanced confidentiality protections with new requirements to collect and share forensic evidence and analysis can ensure that law and regulation continue to hold firms accountable when they fail to invest in adequate security protections before a breach occurs.”
The study, “the first to empirically examine how confidentiality concerns impact breach response,” involved 69 interviews with lawyers, forensic investigators, insurers and regulators between 2020 and 2022.
Stephanie Kanowitz is a freelance writer based in northern Virginia.
NEXT STORY: Emergency alert system vulnerable, FEMA warns
Do Not Sell My Personal Information
When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.
Manage Consent Preferences
Strictly Necessary Cookies – Always Active
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Sale of Personal Data, Targeting & Social Media Cookies
Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link
If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.
Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.
If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings

Cookie List
A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:
Strictly Necessary Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Functional Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Performance Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Sale of Personal Data
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Social Media Cookies
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Targeting Cookies
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Help us tailor content specifically for you:

source

Leave a Comment

Leave a Reply

Your email address will not be published.

Cybersecurity Threats and Mobile Banking/Crypto – Security Boulevard

Fulton superintendent talks cyber security as school year begins – krcgtv.com

Taiwan Strait war could lead to undersea internet cables cutoff, costly shipping disruptions: Report – Washington Times

Google announces cyber security upskilling programme for 100,000 developers in India | Mint – Mint