Michael Vega, associate managing director of the cyber risk practice, Kroll. (Photo courtesy of Kroll)

Michael Vega says it’s hard to keep good talent these days—and he’s a good example of that. Last week it was announced that Vega would be joining Kroll’s cyber risk practice as associate managing director, fresh from a tenure as global head of digital forensics and analytic services at JPMorgan Chase and Co.

Prior to making the jump to the corporate sector, Vega served as a special agent in the U.S. Army Criminal Investigation Command, where he spent time in the organization’s Computer Crime Investigative Unit. He also helped to launch and operated as team chief of the cybercrime program at the U.S. Department of Defense’s Finance and Accounting Service.

Having had a foot in both the corporate and government worlds, Vega spoke to Legaltech News about the disparity in threats and resources as well as how the market for forensic products has shifted over the last decade. This interview has been edited for clarity and length.

Legaltech News: From a forensic standpoint, what’s the biggest mistake companies are prone to making after a cyber breach?

Michael Vega: Companies need to ensure that they are closing the gaps that are identified during post incident investigation. … [They need to be] doing a good after-action review and determining not only how did the adversary get in, but how can we as a company protect against future adversarial action.

What would you say is the biggest distinction between the types of cyber threats those the government and those in the private sector face?

The federal government, the Department of Defense, have concerns around state-sponsored terrorist activity. The corporate side, although they need to be concerned of state-sponsored [threats], they have a much larger concern with insider threats, whether it’s malicious or accidental. That’s not to say the U.S. government doesn’t have those same issues. The biggest advantage I see that corporate America has over the government, from my experience, is corporate America has the ability to change quickly and throw money and resources at a problem.

Companies in the corporate sector are taking a more proactive approach in using analytics tools to mine their data for insights or other strategic value. Do you think that this has had any crossover benefit for cybersecurity efforts?

Well, the ability for corporations to utilize Big Data analytics does help. It allows us to search across vast amounts of data looking for indicators of compromise, especially the companies that have large data sets of logs. … People understand that it’s important to maintain logs and the availability of cloud storage or cheaper storage has allowed companies to maintain a longer life for those logs.

Are there challenges like ephemeral messaging where forensic technology is still playing catch up?

If you look back 10 years, 12 years, there were a few big forensic products that everyone used. Today I’m seeing a lot more in-house development, with individuals developing tools for very specific forensic processes. … I think it helps when you have somebody who is focused on one small piece of the incident response process.

Do you think that we’re approaching a point in forensic technology where digital communications or records will never truly be gone? Or are we already there?

I coach girls softball, and I’ll tell you the same thing I tell them: Once you put it on the internet, it’s there forever. No matter how hard you try get rid of it all, somewhere, someplace, that information is still around. Now, the same doesn’t go for corporate America, but corporate America needs to understand where their data is, what that data life should be and when that data should be deleted. And the ability to delete that data for things like [EU's General Data Protection Regulation].