Businesses need to look beyond tick-box compliance on information security, says expert

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.out-law.com/en/articles/2015/november/businesses-need-to-look-beyond-tick-box-compliance-on-information-security-says-expert/

Major organisations operating in multiple jurisdictions face a growing
number of legal and regulatory obligations on information security. As a
result of the fact that laws on information security can be said to lag
behind technology, companies should look to industry best-practices and not
merely their minimum legal duties on information security to reduce their
own exposure to cyber risk.

Deploying a high level of preventative security measures is just one of
three steps organisations need to take to address the cyber threat posed to
their business.

Information security measures – going beyond legal requirements

Cyber attacks on trusted organisations are becoming more frequent and high
profile, as shown by the major incident that recently affected telecoms
provider TalkTalk. Cyber security is now firmly a board room issue. Nobody
wants to be the one who gets hit, and many blue chip companies are now
role-playing what would happen in that scenario to establish their response
strategy.

However, the legal, technical and reputational challenges of addressing
information security are proving highly complex for organisations to
manage. The issue is not helped by the fact that multinational companies
face an increasing number of laws and regulations on information security.

In the EU organisations face general obligations around the security of
personal data under the Data Protection Directive. National laws
implementing the Directive, however, vary. For instance, whilst only
general data security rules apply under UK law, other countries, like
Denmark, are specific about the security measures organisations need to
implement to remain compliant.

Information security is a main thrust of planned new EU data protection
laws. The forthcoming EU General Data Protection Regulation would directly
impose security obligations, and liability, on data processors as well as
data controllers. New data breach notification obligations look set to be
imposed on data controllers too under the Regulation.

Then there are sector-specific requirements. In the US, for instance,
health care providers face information security obligations under HIPAA. In
the EU, financial services companies have to adhere to the MiFID regime,
whilst telecoms providers have obligations to report data breach incidents
to regulators under the EU's e-Privacy regime.

Further data breach notification laws are set out in many US states,
whilstthe Federal Trade Commission has attempted to regulate security under
its "unfair or deceptive acts or practices" remit.

In Asia, companies have had to respond to a maturing data protection law
framework, with new legislation implemented in Singapore, for example.

The threat posed by cyber criminals to critical national infrastructure has
also been recognised by EU law makers who are currently negotiating a
newNetwork and Information Security Directive to stiffen protections.

The various laws affecting security can be divided into two main types:
those that require certain security measures to be taken for compliance,
and those that impose obligations or liabilities in relation to security
breaches – notably, duties to report such breaches. They are related, of
course, as failure to implement required security measures could require
the business to report the failing if there is a breach.

However, the law often lags behind technology. Industry best practices may
recommend taking security measures that laws may not seem to cover
specifically. It is sensible for businesses to implement security measures,
appropriate to the particular risks they face, which are identified as best
practices even if their implementation is not a legal requirement.

Implementing industry standard measures can also help to provide some
defence or reduce liability or fines if there is a security breach.

Implementing a high level of security, which means having the right
technology to address external threats, together with appropriate policies,
procedures and processes that govern how people within their organisations
and interact with their systems, is the first step in addressing modern day
cyber risk.

Preparing for cyber attacks also means knowing how to respond

As well as implementing preventative security measures, businesses need to
have in place, in advance of an incident, a clear strategy for engaging
with regulators and those affected when a breach occurs. They also need a
structured incident response plan which deals with the technical and legal
consequences and reputational impact of a hack or data breach.

Much of the focus of recent discussion on information security has centred
on the protection of personal data and addressing privacy rights. However,
the growing frequency of high profile incidents shows that greater
attention needs to be placed on putting the processes and controls in place
to protect confidential information and intellectual property as well.

A thorough vulnerability assessment, of people and processes as well as
systems, should be conducted, and scoped and reviewed with the assistance
of relevant experts. Lawyers and security experts can provide guidance to
businesses when designing new systems or launching new products and
services, or when changing existing systems, products or services. To
maintain effective security standards, regular staff training and a
frequent review of security policies, among other actions, should become
ingrained in company best practice.

Many businesses are now working hard not just to implement industry best
practice and good procedures and controls, but also to develop
cross-disciplinary teams who understand the technical, legal and
reputational issues in the event of a crisis. Chief executives, CIOs,
general counsel and communications firectors are getting around the table
to say: how do we respond if this happens to us?

In the event of a breach, it is important to bring in qualified lawyers and
security experts to assess the situation immediately.  Lawyers can advise
on the necessary approach to regulators with respect to notifying them of
the breach and what information can, or must legally, be disclosed to
customers. Instructing external experts through lawyers may also help to
maintain the confidentiality of security reports and other sensitive
documents through 'legal privilege'.

Approaching reputation management experts is also advisable to assist in
handling the PR fallout, as reputational damage from security breaches have
been known to cost businesses as much as, if not more than, the actual data
losses if handled poorly.

The cost of getting prevention and response wrong

The potential legal claims that could be brought against businesses by
people, such as customers, in the event of a security breach will vary
depending on the countries and the laws concerned. In the UK, data
protection laws enable an individual who has suffered 'distress' as a
result of a security breach to sue the controller or processor.

Significantly, 'distress' is enough: it is no longer necessary to show
financial loss in order to qualify, provided the individual can prove their
claim in distress. This ruling, while consistent with the approach in many
other EU countries, is under appeal to the UK’s highest court.

Legal recourse is not limited to lawsuits. A particularly damaging cyber
attack could see millions of personal data records compromised. In the US,
'class actions' are increasingly common, which enable an individual to
represent the affected group in a claim for compensation, and a similar
'group litigation order' is possible in the UK. Under the proposed EU
General Data Protection Regulation, a kind of representative 'class action'
by public interest bodies such as NGOs on behalf of data subjects may also
be made possible.

The ramifications of claims like these could be financially devastating for
a business.

The additional issue for businesses is that the legal impact is not limited
to the customers involved. When a significant breach occurs it is the
responsibility of the regulator to investigate. If a business has failed to
comply with the mandatory requirements for information security then
financial sanctions can follow.

The UK's information commissioner currently has the power to issue a fine
of up to £500,000 for a serious breach of the Data Protection Act. Fines
for security breaches may be even larger under the proposed General Data
Protection Regulation where personal data is involved, possibly from 2 to
5% of the organisation’s annual global turnover.

The development of 'cyber insurance' products could offer a lucrative niche
for the insurance sector and a financial safety net for businesses. Yet,
whilst many are beginning to explore its potential, the market remains
underdeveloped, especially in Europe, although a PwC report earlier this
year predicted that the global cyber insurance market could triple in size
by the end of the decade, from $2.5 billion to $7.5bn.

Regardless of the financial protection which insurance of this kind may
provide, businesses cannot afford to risk the legal and reputational
repercussions of an attack.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!