The business world today is dramatically different than it was just a couple years ago. Out of necessity and convenience, companies have become increasingly reliant on newer technologies, such as cloud-based applications and mobile platforms. As such, the separation between corporate and personal devices has blurred as employees regularly use their own hardware to access corporate networks and conduct work on behalf of their employers. Meanwhile, data volumes continue to escalate at an incredible rate, making data management a top-of-mind challenge for many organizations. These changes to the enterprise IT infrastructure mean that, more than ever, corporations need to have cybersecurity policies and plans in place to help safeguard corporate data and minimize exposure to legal and regulatory risks.
While in-house counsel may not have an in-depth knowledge of a company’s data environment, they are still critical first-line defenders in the fight for cybersecurity. From education to policy development to developing response plans, corporate counsel play a significant role in ensuring corporate data remains secure and in mitigating liability should a breach occur.
Understanding Cybersecurity
If in-house counsel are to effectively serve as champions of cybersecurity, they must first develop a thorough understanding of the problem.
First, know that no industry is safe from a cyberattack. True, some sectors assume a disproportionate percentage of overall data breaches. For example, according to our “2013 Trustwave Global Security Report,” in 2012, the retail industry made up 45 percent of all data breach investigations—the highest of any sector. Still, cyberattacks occur across all businesses, regardless of size, sophistication, or product type. Furthermore, certain industries are governed by regulations that can dramatically increase the cost associated with a data breach. For example, the Graham-Leach-Bliley Act contains provisions that require financial services companies to establish privacy safeguards to protect consumer information and to alert consumers in the event of a data breach. Likewise if an organization handles cardholder information for credit or debit card purchases, it must abide by the Payment Card Industry Data Security Standard (PCI DSS), a set of industry-issued security requirements. Noncompliance with PCI DSS not only makes cardholder information vulnerable to cyberattacks, but it can also result in card companies levying major monetary penalties against the organization in possession of the cardholder information.
Second, understand that data breaches can affect anyone who has a relationship with the company. Customer and employee data are likely targets for attacks because of the sensitive nature of this information. But other parties stand to be affected by a data breach as well, including vendors, suppliers, shareholders, and investors. Once again, there are laws and regulations that protect certain parties that can increase the damage of a security breach. For instance, the Health Insurance Portability and Accountability Act (HIPAA) establishes privacy protocols for the protection of employee health-related information.
Third, understand the types of harm that a single data breach can invite. Obviously, there are a number of significant costs associated with data breaches—outside counsel and forensic investigation fees, the resources and time required to conduct an investigation, business interruption, potential regulatory fines, and potential notification costs, to name a few examples. Data breaches can also result in unquantifiable costs, such as reputational damage, that can have a long-lasting impact on customer trust and the organization’s bottom line.
Finally, in-house counsel should have a basic overview of the types of activities that can result in a cybersecurity breach. Not all data breaches are the result of a malicious cyber-attack. True, external hackers and disgruntled employees are likely perpetrators of cybercrimes. However, many data breaches are caused by a lack of education or an oversight by an otherwise trustworthy employee. For example, if an employee establishes a weak password to protect access to information on the corporate network, an external hacker can easily exploit the weakness to gain entry to sensitive information.
