© maxkabakov - Fotolia.com
Paul Mandell
Despite the growing threat of computer security breaches, some 30 percent of general counsel in a recent survey said their companies were not prepared to deal with such a crisis. And experts say more GCs need to overcome their technophobia and help their firms face the increasing risk.
“Among the most fearsome threats facing corporations in 2012 was an increasing proliferation of cybersecurity breaches of various orders of complexity and impact,” according to the “2012 General Counsel Survey,” by global consultants Consero Group. The survey, produced in partnership with Applied Discovery Inc., is based on responses from 48 general counsel in December 2012.
“From terrorism to competitive attacks to random hacking, global businesses have their hands full keeping systems and data safe,” the report warned.
“Indeed, the stakes are high for general counsel in this area—particularly in highly regulated industries,” it said.
Some 28 percent of the GCs surveyed indicated that their companies had experienced a cybersecurity breach over the last 12 months. And that figure may be low.
“It’s safe to assume that a breach is a source of great anxiety and embarrassment for large companies. So there is a natural disinclination to report it,” explained attorney Paul Mandell, founder and chief executive of Consero. The group is located in Bethesda, Maryland.
“But cybersecurity was clearly a very hot topic and a source of concern for the general counsel,” Mandell added.
The theft of company data by employees is also a growing concern, Mandell said, and “there was quite a bit of discussion [among general counsel] about employees bringing their own devices [BYOD] to work. It’s a huge issue.”
So far there is very little understanding of what the best practices are in the BYOD area, he said.
Mandell explained that much of the anxiety about cybersecurity stems from “lawyers not generally being tech savvy by nature,” and the fact that no one has found a perfect solution for protecting data.
The report explained that a company’s GC also must be aware of international regulatory requirements regarding digital security, while ensuring compliance and addressing breaches when they result in litigation or government action.
The trend Mandell sees is for general counsel to increasingly explore the addition of tech-savvy attorneys, like those who handle intellectual property.
Stan Stahl, cofounder and president of Los Angeles-based Citidel Information Group, another cybersecurity consultant, said he’s not surprised that 30 percent of GCs say their companies are not prepared.
“We find the companies we go into are woefully unprepared” to deal with a cyber breach, Stahl said. “There is the misconception that firewalls and anti-viral programs protect everything, and that’s a myth.”
He also agreed that the 28 percent who reported security breaches might be low because “the incentives are to not report them.”
Stahl explained, “If you report a breach, your costs are going to be, say, about $200 per record, and you may have 1,000 people in your database. If you do not report that breach and don’t get caught, you can save yourself $200,000. So I would tend to think that a significant number of breaches go unreported.”
He concurred with Mandell that some of the problem is that top management, including the general counsel, does not understand how technology works. They have a tendency to simply send the problems to IT.
“The IT folks may know technology, but not necessarily security,” Stahl said. “Many attacks that come in today take advantage of human weaknesses, and not just weak technology.”
He gave the example of a payroll clerk who clicks on a link purporting to be from Facebook about her high school reunion. Instead, the link downloads malware onto the company computer system, traces her keystrokes, and allowes hundreds of thousands of dollars to be diverted from the company’s payroll account.
What can the GC do? The most important thing is to create an ongoing culture of cybersecurity best practices across the company. “It’s not like you can just get a flu shot and now you’re OK,” Stahl said. “It’s more like everyone has to diet and exercise every day.”
Stahl added, “Our motto is, it takes the village to secure the village.”
See also: "Obama announces cybersecurity executive order," The National Law Journal, February 2013.
