Data Breaches Are the New Reality: Are You Ready?...• As you investigate, facts may become more...

Data Breaches Are the New Reality: Are You Ready?

February 6, 2014

Brought to you by Winston & Strawn

© 2014 Winston & Strawn LLP 2

Today’s eLunch Presenters

Steve Grimes Partner

Winston & Strawn

[email protected]

312-558-8317

William Ridgway Assistant U.S. Attorney

U.S. Department of Justice, U.S. Attorney’s Office

[email protected]

Liisa Thomas Partner

Winston & Strawn

[email protected]

312-558-6149

Sheryl Falk Of Counsel

Winston & Strawn

[email protected]

713-651-2615

mailto:[email protected]





1. Hackers Are Everywhere!: Reduce Risk 2. Reduce Exposure: The Plan

–Investigation Plan –Notice Plan

3. Preparing for the Future: Cases and Concluding Thoughts


Is Our Data Sufficiently Secure?


• Who does this? – 92% outsiders – 19% state-affiliated

• How do they do it? – 52% hacking – 76% stolen credentials – 40% malware – 29% leverage social attacks

(from Verizon Report)

Who Is Doing It, and How?


• Trojan – malicious code surreptitiously inserted into target computer to allow remote access/control by unauthorized person

• Botnet – network of infected computers controlled remotely

• Phishing – common infection technique involving email that lures user to take action that unwittingly downloads malicious code

• Drive-by infection – infection of internet sites so that user clicking on button on web page unwittingly downloads malware

• Backdoor – creation of means for unauthorized and undetected access

• Keylogger – software tool that logs keystrokes

Tools of the Trade


Organized Crime


Hacktivists


Nation-State Hacking


Protection Against Hacking?

Passwords Monitor logs

Firewalls Vendor audits/compliance

Secure disposals

DLP software/practice


Employees, Consultants, Vendors


How to Protect Your Company

Monitor Restrict permissions

Strong policies Investigate

Background checks

Confidentiality requirements


Why You Care: Costs

Reputation with

regulators PR Stock or

sales losses


IT Security Standards?

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&frm=1&source=images&cd=&docid=tjUD3JkJ0j7_3M&tbnid=HxfNa5leCrBAkM:&ved=0CAUQjRw&url=http://newshopper.sulekha.com/barack-obama_photo_515248.htm&ei=WoynUtbVKMa0qwGU24DACw&bvm=bv.57799294,d.aWM&psig=AFQjCNG_BttCl14DwM30m7-HWolLQo-mIg&ust=1386798550229036

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&frm=1&source=images&cd=&cad=rja&docid=1u4EQqUybM0aUM&tbnid=3AaaJJYWLL39iM:&ved=0CAUQjRw&url=http://www.washingtonpost.com/politics/obama-campaigns-in-final-days-before-election/2008/10/27/AG0B6QFH_gallery.html&ei=fIynUqufNcLPqgGMloHQBQ&psig=AFQjCNHh2RHiHQg-PYxDH5uaQfH79sjDvw&ust=1386798584213583


Lesson Learned: Audit and Improve, Implement Plan



– Investigation Plan –Notice Plan



Breach Happened: What to Do?


• Be ready to act quickly – In 84% of cases, the initial compromise took hours or less

• Be proactive – In 66%, the breach wasn’t discovered for months or years – In 69%, someone outside the company spotted breach

• FBI will come knocking to let you know you’ve been breached

• If you get a notice from law enforcement, take it seriously

– 2013 Verizon Data Breach Report

Data Breach Detection

http://www.google.com/url?sa=i&rct=j&q=&esrc=s&frm=1&source=images&cd=&cad=rja&docid=6iv13-77D-j_5M&tbnid=WNEDu_OnONyREM:&ved=&url=http://www.computerweekly.com/&ei=7z2iUoz-H-bm2AX6jIHwCA&psig=AFQjCNGdLBGfu_5WI3mUzy_uuCV1zx5KWQ&ust=1386450799948946


Plan: Select Team Members

Internal incident

response team

In-house counsel

In-house IT

CPO/CSO compliance

Business unit

Outside counsel

Client and media

relations

Forensic consultant


Plan: Think About Scope


Investigation Plan

Secure the data

Preserve evidence

Analyze forensic data

Interview key witnesses

Document security controls


• As you investigate, facts may become more damning • Could be other things in the data sets

– Proposed business plans – Trade secrets – And more

• Retained faster/investigation quicker • Hire experts (including investigators) under privilege

– Keep under the “direction of counsel”

Take Into Account Privilege in Developing Plan


Decide: Involve Law Enforcement?


Delay When Working With Law Enforcement


• Financial account data • SSNs • Government ID numbers • Credit card data • Dates of birth • Health information • Email address and passwords

Plan: Look at Types of Impacted Data


“Breach”

Unauthorized access and/or

acquisition

Compromise security

Likelihood of harm

Exceptions

Investigation Needs to Determine “Breach”






Impacted individuals

Government Authorities

Credit reporting agencies

Contractual Partners Press

Put Your Notice Plan in Place


Describe incident

Categories of information

Consequences of breach/nature of risk

• Steps to investigate, mitigate harm

Protection measures put in place

• Contact information for law enforcement • Where to get more information

Advice about how to protect self

Have a Sample Notice Ready to Go


• What happened? • When did it happen? • What information was compromised? • Was my information compromised? • How many people’s information was impacted? • Was the information encrypted? • Was my social security number compromised? • Did anyone misuse this information? • What should I do? • What are you doing to protect me? • Why aren’t you taking other measures to help? • What are you doing to protect others? • Will this happen again? • Who should I contact if I have more questions?

PR Plan: Remember What People Will Want to Know






• Victims of breach are litigation targets –FTC –State AGs –SEC –Shareholders –Customers

Once Notice Is Done, That’s It… Right?


Fed Regulators


Fighting Back: FTC v. Wyndham


State Regulators


SEC

Shareholder

Securities


Hot Area for Plaintiff’s Lawyers


Notification statutes Negligence

Contract / quasi

Statutory violations

Unfair trade practices

Consumer Class Action Lawsuits


– High Court May Tighten Reins On Data Breach Class Actions (by Steve Grimes,

Law360)

Supreme Court Helping Out…?


Create Plan Appropriate for Your Company

Analyze practices

Implement plan

Implement breach plan before hack

Tighten IT security (work with

consultants)

Train employees

Monitor compliance


Analyze practices

Implement privacy policy



consultants)

Train employees

Monitor compliance

Improve Security


Analyze practices

Implement plan



consultants)

Train employees

Monitor compliance

Monitor Compliance


• Winston Privacy Law News – Frequent Breach and Security Articles – Newsletter (US, Asia, Europe) – Twitter: @winstonprivacy – www.winston.com/privacylawcorner

• Publications

– Thomas on Data Breaches (to be published in the Spring) – High Court May Tighten Reins On Data Breach Class Actions (by Steve Grimes,

Law360)

• Breach “Crisis Simulation” Sessions – April, June, September

What’s Next? Stay Informed

http://www.winston.com/privacylawcorner


Thank You!

Steve Grimes Partner

Winston & Strawn

[email protected]

312-558-8317

William Ridgway Assistant U.S. Attorney

U.S. Department of Justice, U.S. Attorney’s Office

[email protected]

Liisa Thomas Partner

Winston & Strawn

[email protected]

312-558-6149

Sheryl Falk Of Counsel

Winston & Strawn

[email protected]

713-651-2615





Date post:	06-Aug-2020
Category:	Documents
Upload:	others
View:	1 times
Download:	0 times

Data Breaches Are the New Reality: Are You Ready?...• As you investigate, facts may become more...

Documents