Cybersecurity & Data Protection: Thinking About Risk & Compliance
•Als PPTX, PDF herunterladen•
4 gefällt mir•1,651 views
Cybersecurity & Data Protection: Thinking About Risk & Compliance is a presentation that Frisco business lawyer Shawn Tuma delivered to the Corporate Counsel Section of the Collin County Bar Association. The presentation date was May 29, 2015.
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Andere mochten auch
Andere mochten auch (8)
Ähnlich wie Cybersecurity & Data Protection: Thinking About Risk & Compliance
Ähnlich wie Cybersecurity & Data Protection: Thinking About Risk & Compliance (20)
Mehr von Shawn Tuma
Mehr von Shawn Tuma (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Cybersecurity & Data Protection: Thinking About Risk & Compliance
- 1. Cybersecurity & Data Protection Thinking About Risk & Compliance Shawn E.Tuma Scheef & Stone, LLP @shawnetuma www.solidcounsel.com
- 2. “There are only two types of companies: those that have been hacked, and those that will be.” –Robert Mueller
- 3. 97% - CompaniesTested – Breached in Prior 6 mos.
- 4. Odds: Security @100% / Hacker @ 1
- 6. www.solidcounsel.com first name or first initial last name SSN DLN or GovtID data breach first name or first initial last name Acct or Card # Access or Security Code data breach Info that IDs Individual Health-care, provided, or pay data breach Duty to notify when “unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information …” Tx. Bus. Comm. Code § 521.053 CIVIL PENALTY $100.00 per individual per day for notification delay, not to exceed $250,000 for single breach § 521.151
- 7. www.solidcounsel.com Average Cost of a Data Breach 2013 Cost (pre-Target) $188.00 per record $5.4 million = total average cost paid by organizations 2014 Cost $201 per record $5.9 million = total average cost paid by organizations “The primary reason for the increase is the loss of customers following the data breach due to the additional expenses required to preserve the organization’s brand and reputation.” –Ponemon Institute 2014 Cost of Data Breach Study
- 9. www.solidcounsel.com The Real Problems Theft Lost Passwords Phishing Websites Basic IT Case Stories
- 10. www.solidcounsel.com Blocking & Tackling: Best Practices Approved & Documented • Basic IT Security • Basic Physical Security • Policies & Procedures Focused on Data Security • Company • Workforce (Rajaee v. Design Tech Homes, Ltd.) • Network • Business Associates (Travelers Casualty v. Ignition Studio, Inc.) • Breach Response Plan • Implementation & Training • Regular Reassessment & Update
- 11. www.solidcounsel.com Security Culture Assess, Audit, Gap Analysis Develop Strategic Plan Implement & Execute Plan Manage Response & Conflict Reassess & Update protecting businesses’ information protecting businesses from their information Risk Compliance Program
- 12. www.solidcounsel.com •Login Credentials •“You don’t drown from falling into the water” •25k v. 40m (T) / 56m (HD)
- 15. www.solidcounsel.com Data Sources Company Data Workforce Data Customer / Client Data Other Parties’ Data 3rd Party Business Associates’ Data Outsiders’ Data
- 17. www.solidcounsel.com Malicious • compete • newco • Sabotage • disloyal insider Negligence • email • usb • passwords Blended • foot out the door • misuse of network • stealing data • negligence with data • violate use policies Hacking / Cracking Social Engineering Malware Stealing Planting Corrupting Outsider & Insider Threats
- 19. www.solidcounsel.com Misuse Case Examples Employees & Insiders disclosecompany’sIPonInternet emailscompany’sIPtoself deletescompany’semails&work projects/“eraser” backupcompanydatainviolationof policies generatefraudulentcommission payments stealcustomers’datatosellforfraud create“backdoor”intonetworkbefore leaving Business Associates stealcompanyserver scrapedataforcompetingcompany keyloggers/surreptitiousforwardingor monitoring takecontrolofaccounts,forceout partners permitbreach/wrongfulaccessto3rd party’sbusinessassociates’data Businesses remotewipephonewithoutBYOD lostdevices,laptop,phone,usb emailunencryptedPHIwithoutrequest scrapecompetitors’websiteswithout authorization databreach–hackedwebsitecheckout cart databreach–unpatchedlegacy programonserver extortion–bloggerdemandsmoneyto stop extortion–vulnerabilityoutsideofbug bountyprogram extortion–threatendeletewebsite unlesspayforservices
- 20. www.solidcounsel.com Protecting businesses from information Contracts • 3rd party liability • Healthcare (BA) • Software license audit • Permissible access & use in policies, BYOD • EULA / TOS Marketing • FTC Act § 5 • SPAM laws • NLRB rules • CDA § 230 • Website audits • IP issues • Acct ownership Privacy • Privacy policies • Privacy & data practices • Destruction policies • Monitoring workforce • Business intelligence Industry Regulation • PCI (Payment Card Industry) • FFIEC (Federal Financial Institution Examination Council) • FINRA (Financial Industry Regulatory Authority) • SIFMA (Securities Industry and Financial Markets Association)
- 24. www.solidcounsel.com Adviser Consultant Relationships Coordinator Attorney
- 25. ShawnTuma Partner, Scheef & Stone, L.L.P. 214.472.2135 shawn.tuma@solidcounsel.com @shawnetuma blog: shawnetuma.com web: solidcounsel.com This information provided is for educational purposes only, does not constitute legal advice, and no attorney-client relationship is created by this presentation. Shawn Tuma is a cyber lawyer business leaders trust to help solve problems with cutting- edge issues involving cybersecurity, data privacy, computer fraud, intellectual property, and social media law. He is a partner at Scheef & Stone, LLP, a full service commercial law firm inTexas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, throughout the world. Texas SuperLawyers 2015 Best Lawyers in Dallas 2014 & 2015, D Magazine (Digital Information Law) Chair, Collin County Bar Association Civil Litigation & Appellate Section College of the State Bar ofTexas Privacy and Data Security Committee, Litigation, Intellectual Property Law, and Business Sections of the State Bar ofTexas Information Security Committee of the Section on Science &Technology Committee of the American Bar Association Social Media Committee of the American Bar Association NorthTexas Crime Commission, Cybercrime Committee Infragard (FBI) International Association of Privacy Professionals Information Systems Security Association Contributor, Norse DarkMatters Security Blog Editor, Business Cyber Risk Law Blog